This document describes the privacy policy of Spencer Health for the management of clients’ personal information. The psychological service provided is bound by the legal requirements of the Australian Privacy Principles set out in the Privacy Act 1988 (Cth). Client information Client files are held in:

• Online practice management software (Halaxy and Cliniko)
• Archived paper files are stored offsite in locked storage
• Assessment proforma are stored for 1 year in a locked filing cabinet, and then archived to an offsite secure storage facility.

All of these are accessible only to authorised employees. The information on each file includes personal information such as name, address, contact phone numbers, medical history, and other personal information collected as part of providing the psychological service.

How clients' personal information is collected:

A client's personal information is collected in a number of ways during psychological consultation with your health professional at Spencer Health, including when the client provides information directly to the organization based clinician, using hardcopy forms, correspondence via email, when the client interacts directly with employees of Spencer Health such as the receptionist, and when other health practitioners provide personal information to Spencer Health via referrals, correspondence and medical reports. Consequence of not providing personal information If the client does not wish for their personal information to be collected in a way anticipated by this Privacy Policy, Spener Health may not be in a position to provide the psychological service to the client. In some circumstances, clients may request to be anonymous or to use a pseudonym, unless it is impracticable for Spencer Health to deal with the client or if Spencer Health is required or authorised by law to deal with identified individuals.

Purpose of holding personal information:

A client’s personal information is gathered and used for the purpose of providing psychological services, which includes assessing, diagnosing and treating a client’s presenting issue. The personal information is retained in order to document what happens during sessions, and enables the psychologist to provide a relevant and informed psychological service. Disclosure of personal information Clients’ personal information will remain confidential except when:

1. it is subpoenaed by a court, or disclosure is otherwise required or authorised by law; or
2. failure to disclose the information would in the reasonable belief of the Spencer Health place a client or another person at serious risk to life, health or safety; or
3. the client’s prior approval has been obtained to:
4. a) provide a written report to another agency or professional, e.g., a GP or a lawyer; or
5. b) discuss the material with another person, such as a parent, guardian, person holding parental responsibility, employer, health provider or third-party funder, where appropriate consent has been obtained; or
6. c) disclose the information in another way; or
7. d) disclose to another professional or agency (e.g. your GP) and disclosure of your personal information to that third party is for a purpose which is directly related to the primary purpose for which your personal information was collected;
8. e) where the client is a child or young person, communicate with or disclose relevant information to a parent, guardian or person holding parental responsibility, where appropriate consent has been obtained or where disclosure is otherwise authorised or required by law. Spencer Health will manage information sharing in accordance with relevant Court Orders, the Privacy Act 1988 (Cth), professional obligations and the child's best interests.

A client's personal information is not disclosed to overseas recipients, unless the client consents or such disclosure is otherwise required by law. Clients' personal information will not be used, sold, rented or disclosed for any other purpose. In the event that unauthorised access, disclosure or loss of a client’s personal information occurs Spencer Health will activate its data breach plan and use all reasonable endeavours to minimise any risk of consequential serious harm. Requests for access and correction to client information. At any stage clients may request to see and correct the personal information about them kept on file. The psychologist may discuss the contents with them and/or give them a copy, subject to the exceptions in the Privacy Act 1988 (Cth). If satisfied that personal information is inaccurate, out of date or incomplete, reasonable steps will be taken in the circumstances to ensure that this information is corrected.

All requests by clients for access to or correction of personal information held about them should be lodged with the Clinical Services Manager, Twinkle Garg twinkle@spencerhealth.com.au. These requests will be responded to in writing within 30 days, and an appointment will be made if necessary for clarification purposes.

Privacy and Confidentiality in Separated Families

Spencer Health recognises that family structures vary and that parents or caregivers may be separated, divorced or subject to Parenting Orders or other Court Orders. We are committed to managing personal and health information in accordance with the Privacy Act 1988 (Cth), our professional and ethical obligations, and the best interests of the child. This section should be read in conjunction with Spencer Health's policies relating to parental consent, family circumstances and clinician handover.

Child as the Client

Where services are provided to a child or young person, the child is the client of Spencer Health.

Clinical records are maintained in the child's name and information is managed in a manner that supports the child's wellbeing, safety and therapeutic needs while respecting the legal rights and responsibilities of those holding parental responsibility.

Parental Responsibility and Information Sharing

Where parents share parental responsibility, Spencer Health will generally communicate with both parents regarding significant matters relating to their child's care unless Court Orders or other legal documentation specify otherwise.

Subject to legal requirements and professional judgement, communication may include:

• Appointment confirmations and scheduling information.
• Requests for consent and intake documentation.
• Significant changes to treatment.
• Changes to the treating clinician.
• Assessment recommendations.
• Discharge planning.
• Practice communications relevant to the child's care.
• Billing and administrative information where appropriate.

Spencer Health will not ordinarily rely upon one parent to communicate important organisational information to the other where both hold parental responsibility. Where Spencer Health becomes aware of changes to parental responsibility or family circumstances during treatment, information sharing and communication arrangements will be reviewed and managed in accordance with Spencer Health's clinical policies and applicable legal obligations.

Confidential Information Shared During Therapy

Although parents with parental responsibility have rights relating to their child's healthcare, Spencer Health also recognises that children and young people benefit from having a confidential therapeutic relationship.

The extent of information shared with parents will depend on the individual circumstances of the client, the purpose for which the information is requested, the child's capacity to participate in decision-making, and Spencer Health's legal and ethical obligations. Information disclosed by a child during therapy will not automatically be shared with parents. Clinicians will exercise professional judgement when determining what information should be shared, taking into consideration:

• the child's age and developmental capacity;
• the purpose of the therapeutic relationship;
• the child's safety and wellbeing;
• legal obligations;
• ethical responsibilities; and
• the rights of individuals holding parental responsibility.

Safety Concerns and Court Orders

Where Court Orders, Parenting Orders or other legally enforceable documentation restrict communication or access to information, Spencer Health will comply with those requirements.

Where there are concerns regarding family violence, coercive control, intimidation or other risks to the safety of a child, parent, caregiver or staff member, Spencer Health may limit or modify the way information is shared where permitted or required by law. Decisions will always be guided by the child's safety, professional obligations and applicable legislation.

Requests for Access to Information

Requests by parents or caregivers to access a child's personal or health information will be considered on a case-by-case basis, taking into account:

• parental responsibility;
• any relevant Court Orders or Parenting Orders;
• the Privacy Act 1988 (Cth);
• the child's best interests;
• safety considerations; and
• Spencer Health's legal and ethical obligations.

Where appropriate, Spencer Health may also seek advice from its professional indemnity insurer or relevant professional body before responding to complex requests for access to information.

Parent/Carer Questions or Concerns

Parents and caregivers are encouraged to discuss any questions regarding privacy, confidentiality or information sharing with their treating clinician or the Principal Clinical Psychologist. Spencer Health is committed to working collaboratively with families while ensuring that privacy obligations, professional standards and the wellbeing of the child remain central to all decisions.

Concerns:

If clients have a concern about the management of their personal information, they may inform our leadership team by sending an email to enquiries@spencerhealth.com.au. Upon request they can obtain a copy of the Australian Privacy Principles, which describe their rights and how their personal information should be handled.

Ultimately, if clients wish to lodge a formal complaint about the use of, disclosure of, or access to, their personal information, they may do so with the Office of the Australian Information Commissioner by phone on 1300 363 992, online at http://www.oaic.gov.au/privacy/making-a-privacy-complaint or by post to: Office of the Australian Information Commissioner, GPO Box 5218, Sydney, NSW 2001