Privacy

We will manage the process of dealing with an actual or suspected Data Breach in accordance with the Notifiable Data Breach (NBD) Scheme pursuant to Part IIIC of the Privacy Act.

An NBD will be considered to have occurred when the following three criteria are satisfied:

• We:

1. suffer a Data Loss, meaning accidental or inadvertent loss of Personal Information likely to result in Unauthorised Access or Unauthorised Disclosure (ie a laptop containing Personal or Sensitive information is lost or stolen). If data the subject of the Loss can be deleted remotely or is encrypted it will not constitute an NDB; or
2. suffer or are suspected to have suffered an Unauthorised Disclosure, meaning we release or make visible Personal or Sensitive Information in a way not permitted by the Privacy Act (ie an email is sent to the wrong address or employee accidently publishes a confidential data file containing personal information on the internet); or
3. suffer or are suspected to have suffered an Unauthorised Access, meaning Personal or Sensitive Information is accessed by someone who is not permitted to have access (ie a database is hacked by the third party);

• The Data Loss, Unauthorised Access or Unauthorised Disclosure is likely to result in serious harm to a person to whom the Personal Information relates; and
  • We have not been able to prevent the likely risk of serious harm.

Within 30 days of a suspected Data Breach occurring, we will assess the breach to determine if it is likely to cause serious harm, using the NDB Scheme list of relevant matters, including:

• The Sensitivity of the Personal Information or Sensitive Information (ie loss of medical records or details of sexual orientation would be more likely to be assess as capable of causing Serious Harm);
• The type of Personal Information or Sensitive Information (ie loss of credit card numbers or drivers’ licences may be more likely to result in serious harm);
• Whether security matters, such as encryption, protect the Personal Information following the Data Breach thereby limiting the likelihood of Serious Harm; or
• The nature of the harm (ie credit card details being released are more likely to harm serious and immediate consequences than other information).

We will take all reasonable steps to ensure an assessment is completed within 30 days and a notification submitted to the Office of the Australian Information Commissioner (OAIC).
As soon as is practicable after a Notifiable Data Breach is confirmed, we will provide a statement to each individual whose data was breached or who are at risk, including details of the breach and recommendations of the steps you should take in the circumstances.

Additionally, Where we collect and/or hold Heath Information (within the meaning of section 6 of the Health Records and Information Privacy Act 2002 (Cth) as a result of our contractual relationships with Health Provider Organisations (being those organisations that are a health service provider or that collects, holds or uses health information and are required to comply with the Health Records and Information Privacy Act 2002 (Cth)) (Health Provider Organisations) we will treat Health Information in compliance with the Privacy Act and all applicable State and Territory legislation governing privacy of Health Information. We will only use or disclose health information for the purpose for which it was collected or a directly related purpose that is expected.

In the event of a Data Breach or suspected Data Breach, we will provide the Health Provider Organisation within 14 days of the Data Breach of suspected Data Breach:
The identity and contact details of the relevant client/s of the Health Provider Organisation (if identifiable by us);

• A description of the data breach;
• The kinds of information concerned (if identifiable by us);
• Recommendations about the steps that those affected should take in response to the data breach; and
• Steps taken by us to secure our systems against further breach;

Unless otherwise agreed between us and the Health Provider Organisation in writing, we will not identify whether the Data Breach is an NDB in circumstances where we are in possession of Health Information as a result of providing services to a Health Provider Organisation. The Health Provider Organisation will be responsible for making an assessment as to whether the Data Breach constitutes an NDB and to report the NDB in compliance with the NDB Scheme.

We are not otherwise bound by the privacy policies and procedures of Health Provider Organisations unless we have had prior notice of the same and provided written acceptance of those policies and procedures to the Health Provider Organisation.