Darling Downs Health ('Darling Downs Health', 'we', 'us', 'our') is committed to ensuring processes and strategies are in place for the handling and maintenance of information it receives, in accordance with the Information Privacy Act 2009 (Qld) (IP Act) and the Queensland Privacy Principles (QPPs). These strategies include taking reasonable steps to implement practices, procedures and systems in carrying out the agency’s functions and activities.
This policy sets out how Darling Downs Health handles personal information and how we deal with enquiries or complaints from individuals about compliance with the IP Act and QPPs.
This policy applies to the Darling Downs Hospital and Health Board, all permanent, temporary and casual employees, and all organisations and individuals acting as their agents (including visiting medical officers, other partners, contractors, consultants, and volunteers) working within and for Darling Downs Health, and to the personal information it collects, stores, manages, uses and discloses in the provision of healthcare and related functions.
The IP Act and QPPs set the rules for how Queensland government agencies – including Darling Downs Health – handle personal information. These rules include a requirement, under QPP 1, that every agency have a QPP privacy policy.
The definition of ‘personal information’ is set out in the ‘definitions’ at section 7 of this policy. Darling Downs Health collects personal information required to support the delivery of high-quality care in the provision of public sector health services.
Darling Downs Health may also collect sensitive information. The definition of ‘sensitive information’ is set out in the ‘definitions’ at section 7 of this policy. Generally, Darling Downs Health will only collect sensitive information directly from the individual it is about or with their consent, or otherwise consistently with its obligations under the IP Act.
This personal and sensitive information may be collected in different ways, including:
The kind of personal and sensitive information collected from individuals may include:
Darling Downs Health uses and discloses personal and sensitive information for the purpose for which the personal information was collected. Personal information may also be used or disclosed for secondary or alternative purposes, as permitted under the IP Act.
We collect, use and disclose your information for various purposes, including:
Access and correction rights are contained within the Right to Information Act 2009 (RTI Act). All persons have the right to request access and corrections to their personal information, where they believe it is inaccurate, incomplete, or out of date.
Requests for access or corrections to personal information are managed by the Darling Downs Health Information Access Unit, who can be contacted by phone (07) 4616 6780 or email ddinfoaccess@health.qld.gov.au.
For more information about requests for access and correction of personal information see Your health record | Darling Downs Health.
Darling Downs Health will generally disclose personal information overseas only when necessary to address a complaint or application – for example, where a complainant or applicant is overseas. We may use online or ‘cloud’ service providers to provide services and limited personal information may be given to these service providers to enable them to authenticate users that access their services and to provide technical support. This personal information may be stored in the ‘cloud’, which means that it may reside on a cloud service provider’s server, which may be situated outside Australia.
Where Darling Downs Health discloses personal information overseas, this will usually occur with agreement, where authorised or required by law, or otherwise consistently with the obligations under the IP Act.
Where practical, people can deal with Darling Downs Health anonymously or by using a pseudonym.
Complaints about services provided by Darling Downs Health can be made anonymously or by using a pseudonym but, depending on the nature of the complaint, may not be able to be actioned and / or a response provided without a person’s identity (e.g. where a complaint relates to a particular individual’s file).
Darling Downs Health holds personal information securely and takes reasonable steps to protect it from misuse, interference, loss, unauthorised access, modification or disclosure. Darling Downs Health complies with relevant Queensland government Information Standards and security protocols to protect personal information and ensure it can be accessed by authorised staff members only.
Where permitted by the Public Records Act 2023 (Qld), Darling Downs Health will destroy or deidentify unsolicited personal information or personal information no longer required for any of its functions in accordance with the obligations under the QPPs, if it is lawful and reasonable to do so.
In the event that processes and/or systems containing personal information are compromised, Darling Downs Health will respond in accordance with its policies and procedures, relevant to the breach.
You can make a complaint about the handling of your personal information, in writing, to:
Consumer Liaison Service – consumer_liaison_DDHHS@health.qld.gov.au
For staff – darling_downs_human_resources@health.qld.gov.au
A privacy complaint can only be made on behalf of another person if they have provided the authorisation to do so, they are a minor / child and the complainant is their parent or guardian, they lack capacity and their guardian is acting on their behalf or has other legal authority to act for them.
Privacy complaints about Darling Downs Health must be made in writing, within 12 months of becoming aware of the act or practice that is alleged to constitute a breach of the IP Act. Complaints made on behalf of someone else must include the appropriate authority.
Darling Downs Health will respond to the privacy complaint within 45 business days, which can be extended by requesting a further specified period from the complainant.
The Health Service Chief Executive is responsible for the organisation-wide oversight of this policy.
| Term | Definition |
|---|---|
| Personal information | Personal information means information or an opinion about an identified individual or an individual who is reasonably identifiable from the information or opinion –
(Section 12 of the IP Act) |
| Sensitive information | Sensitive information for an individual means the following:
(Schedule 5 (Dictionary) of the IP Act) |