We look after your personal information in line with the Hospital and Health Boards Act 2011, Information Privacy Act 2009, Public Health Act 2005, and Mental Health Act 2016. Metro South Health staff have a duty of confidentiality under section 142 Part 7 of the Hospital and Health Boards Act 2011. We are also subject to the Code of Conduct under the Public Sector Act 2022.
Information we collect
When you visit our hospital and health services facilities, we collect your personal information for the purposes of providing you with clinically appropriate treatment and care. Your personal information includes reasonably identifiable and sensitive information about you.
The Queensland Health Information Asset Register provides details regarding information collected for the purpose of better health outcomes for Queenslanders.
Personal Information
Personal information includes sensitive information, or anything that could identify you, or reasonably identify you through multiple pieces of information, such as your name, email address or phone number.
We only collect, use and disclose your personal information when you, or a person you nominate agree that we can. When collecting personal or sensitive information we will take reasonable steps to advise you of what information is being sought and what the purpose is.
CCTV/BWC Footage
When you visit our hospital facilities, we use closed circuit television (CCTV) and Body Worn Camera (BWC) to provide surveillance of public or high-risk areas as part of a security management system.
Our Environmental Health Officers (EHOs) wear BWC when they visit tobacco retailers, vape stores, and other places that supply or make smoking products or personal vaporisers. BWCs are used to make sure that these places and the people who go there follow the rules in the Tobacco and Other Smoking Products Act and Medicines and Poisons Act 2019.
BWCs record both video and audio. The record function can be turned off. The EHOs and/or security officers will tell the people they talk to when they record the interaction.
Website and cookies
Further, when visiting our website, we also collect some information automatically. We keep this information in our internet access logs. We may use cookies to identify your browser when you visit our website, not you. They don't store your personal information. We let third-party service providers use our website cookies so they can send us reports about logs and usage data.
You can manage your cookie preferences through your browser settings.
We collect information about your visit, such as:
- your IP address, browser type and operating system the website you came from
- pages you visit and documents you download
- the time and date of your visit.
How we use your information
We only use your personal information for the purposes for which it was given to us. How we use your personal information depends on the type of information you give us. We may use it to:
- provide you with health and wellbeing services
- make sure you get the right treatment and follow-up care help us decide on applications for services or benefits communicate with you and get your feedback
- do research to improve healthcare practices and outcomes
- respond to consumer or privacy complaints.
We can also share CCTV/BWC videos with police, lawyers, and courts if we need to ensure the safety of staff or other patients/consumers.
Logs and usage data
We use log and usage data to:
- improve your experience on our website understand how people use our site
- gather statistical data
- improve our services
- investigate issues such as service availability.
Emails, messages and feedback
Our website support team reads emails, messages and feedback you send us. We may use the information you give us to maintain and improve our services. This may include sending your information to other business areas in Queensland Health.
We make an effort to reply when you ask a question or give feedback, but we may not reply to every message. Read more about how we treat your feedback.
Links to other websites
Our website has links to other websites or services. Our privacy statement doesn't apply to those third-party websites. We encourage you to read their privacy statements to understand how they handle your data.
How we store information
We store information in different ways, including:
- our document and records management systems
- cloud storage
- browser storage cookies
We only keep information for as long as we need for the purpose we collected it and in accordance with the Public Record Act 2023.
We store all information on Australian data servers and comply with the privacy principles set out in the Information Privacy Act 2009. We will only disclose personal information outside of Australia in limited circumstances as permitted by the Information Privacy Act 2009. For example:
- when you have agreed;
- the disclosure is authorised or required under a law;
- We are satisfied, on reasonable grounds, that the disclosure is necessary to lessen or prevent a serious threat to the life, health, safety or welfare of any individual, or to public health, safety and welfare; or
- if two or more of the following criteria apply:
- the recipient is subject to equivalent privacy obligations
- the disclosure is necessary to perform our function
- the disclosure is for your benefit
- we have taken reasonable steps to protect your personal information.
In an instance where you inform us to correspond with you using web-based email service (e.g. Hotmail or Gmail), we may disclose your personal information outside of Australia as these web-based email service are based in another country.
How we protect your information
We take reasonable steps to ensure the information we hold is accurate, complete, up-to-date and relevant to our functions and activities by checking information with individuals at relevant points of contact with you. We use security measures to protect your personal information from unauthorised access, loss, misuse, alteration, modification and disclosure. We may share your personal information with:
- your GP or a healthcare service to facilitate treatment and care;
- your family, spouse, or guardian, if you've nominated them; or
- another person or group, if you agree we can, or if the law requires us to.
If we share your information, we do it under the privacy legislation and comply with our duty of confidentiality. We don't sell, trade or rent your personal information to third parties for marketing purposes. You can ask us at any time not to share your information.
Your choices and rights
You have certain rights regarding your personal information. You can contact us to access, correct, or update your personal information at any time. If you don't want to get marketing communications from us, you can opt out using the instructions in the communication.
You can contact our information access team to access or correct your personal information by reading more about your right to information.
How to make a privacy complaint?
If you are concerned about the manner in which your personal or health information is handled, then please refer to our online feedback form in the first instance or e-mail MetroSouthPrivacy@health.qld.gov.au.
In circumstances where it is identified as eligible data breach (or suspected eligible data breach), MSH will
- contain the data breach and mitigate harm;
- determine if the breach is an eligible data breach;
- if an eligible data breach, notify the Information Commissioner and particular individuals; and
- maintain an internal register of eligible data breaches.