Heartland Health — Privacy Policy

Heartland Health collects information that is reasonably necessary to provide and administer psychological services, meet legal and professional obligations, and manage relevant funding or payment arrangements.

Depending on the service, this may include identifying and contact details; emergency contacts; referral, treating-practitioner, Medicare, private health and other funding information; health, developmental, psychological, educational and social information; relevant history, current circumstances, strengths, difficulties and support needs; clinical records, formulations, treatment or support plans; psychological assessment information, including questionnaires, scores, observations and reports; information provided by parents, carers, schools, health practitioners or other relevant people; correspondence, referrals and reports; appointment, billing and payment information; consent and information-sharing records; and information relating to enquiries, feedback or complaints.

Health information is sensitive information and is handled accordingly.

Information is usually collected directly from you through appointments, conversations, forms, the secure client portal, psychological assessment, questionnaires, email, telephone, bookings and other administrative processes.

With your consent, or where otherwise permitted or required by law, relevant information may also be obtained from your GP, paediatrician, psychiatrist, school, parent or carer, another health practitioner, or another person or organisation involved in your care.

Additional information about collection may be provided where appropriate.

Personal and health information may be used to provide psychological therapy, support and assessment; understand your circumstances and plan services; prepare clinical records, formulations, treatment or support plans, reports and correspondence; communicate with you and coordinate care where appropriately authorised; manage referrals, Medicare and other funding requirements; arrange appointments, administer the practice, issue invoices and process payments; support professional supervision or consultation; meet legal, regulatory, insurance and professional obligations; respond to concerns or complaints; and support the safe and effective operation of the practice.

Personal information is not sold. Health information will not be used for direct marketing without specific consent.

Splose is Heartland Health's primary practice-management and clinical record system and may be used for clinical records and documentation, intake and consent, bookings, correspondence, billing, the client portal and routine practice administration.

Heartland Health may also use third-party services for payments, claims and accounting, such as Tyro Health, HICAPS and Xero, which receive information relevant to their function.

AI-assisted functions available within Splose may also be used where appropriate. Clinical information generated or assisted by technology is reviewed before being relied upon as part of the clinical record or professional work.

Not every client uses every system, and information is provided to a service provider only where relevant to its function.

Psychological assessment may involve professional platforms including NovoPsych, Pearson Clinical/Q-global and MHS for assessment administration, scoring, interpretation and related functions.

The systems used depend on the assessment being undertaken, and not every client or assessment uses every platform. Some providers may process or store information outside Australia, as described under Overseas processing.

Heartland Health may use AI-assisted technology as part of normal clinical and administrative practice, including for clinical documentation, assessment-related work, reports, correspondence, treatment or support planning and administration.

NovoNote may assist with clinical documentation, including assessment, note-taking and treatment or support planning. Where session information is processed to produce a transcript or draft documentation, the resulting clinical documentation is reviewed and edited by the practitioner before being adopted or relied upon. Session audio or completed transcripts are not intended to be retained after they are no longer required for the documentation process.

Lyngo may be used for AI-assisted telephone reception, including routine enquiries, messages and appointment administration. It may process identity and contact details, appointment information and information voluntarily provided during a call. Calls may involve recording, transcription or automated processing. Callers are informed that they are interacting with an AI receptionist and, where applicable, whether recording is active.

AI-assisted technology does not replace professional responsibility, psychological judgement, formulation, diagnosis or clinical decision-making, and Heartland Health does not use automated systems to independently make significant clinical decisions about clients.

Where recording or transcription requires specific consent, this will be explained and consent obtained where required. Clients may ask questions about the technology used and may decline optional recording or transcription processes.

Heartland Health uses Google Workspace for email and practice administration. Google Drive is primarily used for templates, policies and administrative material and is not the primary clinical record system.

Email may nevertheless contain personal or health information, including referrals, reports, assessment information and other correspondence. Because ordinary email carries privacy and security risks, more sensitive information may be exchanged through the secure client portal or another appropriate method where practical.

Clients and others contacting the practice are encouraged to avoid including unnecessary sensitive information in ordinary email.

The Heartland Health website is primarily an information and contact point and is not intended for detailed clinical histories or extensive health information.

Initial website or email enquiries should include only enough information for Heartland Health to understand and respond to the enquiry. Where Heartland Health is an appropriate service, further intake, consent and clinical information can then be completed through the secure practice-management system.

The website and its hosting or technical providers may process limited technical information needed to operate and secure the site, such as IP address, browser or device information and server logs.

If analytics or tracking technologies are introduced, the website's privacy and cookie information will be updated to reflect the tools actually in use.

You may make a general enquiry without identifying yourself where lawful and practical.

For ongoing psychological services, assessment, clinical record keeping, billing, Medicare and other administrative requirements, Heartland Health will generally need accurate identifying information.

Personal or health information may be used or disclosed with your consent; where reasonably necessary for the purpose for which it was collected or a related purpose permitted by law; to coordinate care as discussed with you; where a service provider needs information to provide or administer services; where disclosure is required or authorised by law; or where permitted in response to a serious threat to life, health or safety.

This may include communication with a referring GP or other treating practitioner where appropriately authorised.

Where information sharing is not otherwise covered by the service arrangements or applicable law, Heartland Health may ask you to complete an Authority to Release/Share Information.

Only information reasonably necessary for the purpose will be shared.

Some technology providers used by Heartland Health operate internationally or use overseas infrastructure. As a result, some personal or health information may be processed or stored outside Australia.

Depending on the system used, relevant locations may include Canada, Ireland and the United States, with other limited processing possible depending on a provider's infrastructure and configuration.

For example, Pearson/Q-global may involve data storage in Canada and Ireland, MHS may involve storage in the United States, and NovoNote states that patient session data is stored in Australia.

Heartland Health considers privacy and information-handling arrangements when selecting systems. If changes to systems materially affect how personal information is handled, this policy will be updated.

Heartland Health takes reasonable steps to protect personal and health information from misuse, interference, loss, and unauthorised access, modification or disclosure.

Measures may include professional practice-management and assessment systems; password, account and multi-factor authentication controls; device and software security; secure electronic record keeping; limiting access to what is reasonably necessary; appropriate privacy and information-security procedures; and reviewing the technology used by the practice.

No electronic communication or information-storage system can be guaranteed to be completely risk-free.

Heartland Health retains health information in accordance with applicable legal, professional and regulatory requirements.

For health information governed by NSW law, adult records are generally retained for at least 7 years after the last health service, while records collected when a person was under 18 are generally retained until age 25. Information may be kept longer where another legal, professional, insurance or other legitimate requirement applies.

Information will not be destroyed simply because deletion is requested where Heartland Health is required or permitted to retain it. When information is no longer required and may lawfully be destroyed, reasonable steps will be taken to securely destroy or de-identify it.

Electronic information may remain in archives or backups until removed through normal system or provider deletion cycles. Physical records will be securely destroyed where required.

Where required under NSW law, Heartland Health will retain a record of the individual's name, the period covered by the health information, and the date of deletion or disposal. If health information is transferred to another organisation and no copy is retained, the required record of that transfer will also be maintained.

For children and young people, consent, confidentiality, information sharing and access to records are considered according to the individual circumstances rather than by applying a single fixed age.

Relevant factors may include age and maturity, decision-making capacity, the nature of the service and information, parental responsibility or other legal authority, relevant court orders or agreements, safety considerations, and the young person's circumstances and interests.

A parent or guardian does not automatically have unrestricted access to all information about a child or young person.

Where appropriate, privacy and information-sharing arrangements will be explained to the young person and relevant parent, carer or guardian and revisited if circumstances change.

Professional supervision and consultation form part of safe psychological practice. Clinical work may be discussed with an appropriately qualified supervisor or professional colleague for clinical reflection, professional development, ethical decision-making or maintaining safe practice.

Only information reasonably necessary for the purpose is shared, with identifying details limited where reasonably practicable.

Where supervision, training, competency or professional-development activities involve audio/video recording or specifically arranged recorded observation, this will be explained and consent obtained where required.

You may request access to personal information Heartland Health holds about you, or ask for correction where information is inaccurate, out of date, incomplete, irrelevant or misleading.

Requests can be made to:

admin@heartlandhealth.com.au

Heartland Health may need to verify your identity or authority before releasing information. Access or correction may be limited or refused where permitted by law, in which case the reason and available complaint options will be explained where required.

Access to psychological assessment materials may also be subject to privacy law, test security, copyright and professional requirements.

Heartland Health maintains processes for responding to suspected privacy or information-security incidents.

If an incident occurs, reasonable steps will be taken to contain and investigate it, assess the information involved and potential risk, take remedial action where possible, and review whether further safeguards are needed.

Where an eligible data breach is likely to result in serious harm, affected individuals and the Office of the Australian Information Commissioner will be notified where required under the Notifiable Data Breaches scheme.

If you have a question or concern about how your information has been handled, please contact:

Heartland Health Email: admin@heartlandhealth.com.au

Heartland Health will consider the concern, investigate where appropriate, and respond within a reasonable period with the outcome and any action taken.

If the matter cannot be resolved directly with Heartland Health, external complaint options may include the Office of the Australian Information Commissioner (OAIC) or, where NSW health privacy legislation applies, the Information and Privacy Commission NSW (IPC).

Different complaint processes and time limits may apply depending on the relevant privacy law.

Heartland Health may update this Privacy Policy when its services, systems, information-handling practices, technology or legal obligations change.

The current version will be available free of charge on the Heartland Health website and on request.