INNER SOUTH COMMUNITY HEALTH SERVICE INC
Client Privacy Policy

INTRODUCTION
Inner South Community Health Service Inc ("ISCHS"') is required to comply with a number of privacy laws operating throughout Australia, including the Privacy Act 1988 (Cth), the Information Privacy Act 2000 (Vic), the Health Records Act 2001 (Vic) ("Privacy Laws"). The Privacy Laws regulate how personal information is handled throughout its life cycle, from collection to use and disclosure, storage, accessibility and disposal. This privacy policy sets out how ISCHS intends to comply with the Privacy Laws, when handling personal information about its clients. ISCHS is also required to comply with the DHS Information Privacy Principles issued by the Department of Human Services in Victoria. ISCHS will comply with all of the DHS Information Privacy Principles.

DEFINITIONS
In this Privacy Policy:

• Personal Information means information or an opinion whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion. Personal information includes sensitive information and health information.
• Sensitive Information means personal information about an individual's racial or ethnic origin, political opinions, membership of political associations, religious beliefs or affiliations, philosophical beliefs, membership of professional or trade associations, membership of trade unions, sexual preferences or practices, criminal records.
• Health Information means personal information that relates to a person's health or to the provision of a health service to the person.

COMPLIANCE

1. Collection of Personal Information
To the extent required by the Privacy Laws:

• ISCHS will not collect personal information about clients unless that information is necessary for one or more of its functions.
• ISCHS will collect personal information about clients only by lawful and fair means and not in an unreasonably intrusive manner.
• When ISCHS collects personal information directly from clients (for example if a client registers for a health service), ISCHS will take reasonable steps at or before the time of collection to ensure that the client is aware of certain key matters, such as the purposes for which ISCHS is collecting the information, the organisations (or types of organisations) to which ISCHS would normally disclose information of that kind, the fact that the client is able to access the information and how to contact ISCHS.
• ISCHS will collect client's personal information directly from the client where it is reasonable and practicable to do so. Where ISCHS collects information about a client from a third party (for example if the client authorises a parent, spouse or partner to make an appointment for you on your behalf), ISCHS will still take reasonable steps to ensure that the client is made aware of the details set out above.

2. Use and Disclosure of Personal Information
To the extent required by the Privacy Laws, ISCHS will only use or disclose personal information for a purpose (the "secondary purpose") other than the purpose for which it was originally collected (the "primary purpose") where:

• the secondary purpose is related to the primary purpose (or is directly related, in the case of sensitive information or health information), and the client would reasonably expect ISCHS to use or disclose the personal information for that secondary purpose; or
• the client has consented to the use or disclosure of their personal information for the secondary purpose; or
• the use or disclosure is required or authorised by or under law; or
• the use or disclosure is otherwise permitted by the Privacy Laws;

3. Security and Quality of your Personal Information
ISCHS is committed to ensuring that personal information is held securely. To the extent required by the Privacy Laws, ISCHS will take reasonable steps to:

• ensure that any personal information ISCHS collects, uses and discloses is accurate, complete and up to date;
• protect the personal information that ISCHS holds from misuse, loss, unauthorised access, modification or disclosure: and
• destroy or permanently de-identify personal information when required by the Privacy Laws.
Clients can help ISCHS to keep the personal information that it holds accurate, complete and up to date, by letting ISCHS know about any changes to their personal information, such as their name and address.

4. Access to and Correction of Client's Personal Information
Clients have the right to access the personal information that ISCHS holds about them, subject to any exceptions in the Privacy Laws. A charge may apply for providing such access. Clients may also request that personal information which ISCHS holds about them be corrected. Clients should contact ISCHS in writing at the following address to access or correct personal information that ISCHS holds about them:

Privacy Officer
Inner South Community Health Service Inc
240 Malvern Road
Prahran VIC 3181

If access to or correction of health information is denied, ISCHS will provide the client with written reasons for the refusal.

5. Commonwealth and State Government Identifiers

• Except to the extent permitted by the Privacy Laws, ISCHS will not use Commonwealth or State government identifiers as its own identifier nor will it disclose such identifiers to anyone else.
• ISCHS will only assign identification numbers to individuals if the assignment of identifiers is reasonably necessary to enable it to carry out its functions efficiently.

6. Anonymity
ISCHS will provide clients with the option of not identifying themselves when it is lawful and practicable to do so.

7. Transborder Data Flows

• If ISCHS transfers clients personal information outside Victoria, ISCHS will comply with the relevant requirements of those Privacy Laws that relate to transborder data flows outside Victoria.
• If ISCHS transfers clients personal information outside Australia, ISCHS will comply with requirements of those Privacy Laws that relate to transborder data flows outside Australia.

8. Health and Sensitive Information
ISCHS will not collect sensitive or health information about clients without their consent unless that collection is otherwise permitted by the Privacy Laws.

9. Other
ISCHS will comply with the relevant requirements of the Health Records Act 2001 (Vic):

• if it decides to transfer or sell its health service provider business
• in making health information available to another health service provider.

COMPLAINTS
Clients can contact ISCHS using the details set out above if they have any concerns or complaints about the manner in which ISCHS handled their personal information. ISCHS may change this Privacy Policy from time to time. Queries about this policy or about how ISCHS handles personal information about clients, should be directed to The Privacy Officer on tel: 9525 1300, or in writing to the above address.