POLICY ON MANAGEMENT OF PERSONAL & HEALTH INFORMATION
Victorian Cytology Service (VCS) has been contracted by the Commonwealth to establish and manage the National HPV Vaccination Program Register (HPV Register) on the Commonwealth’s behalf. The Register was established under legislation passed in 2007.
The HPV Register is a confidential database that collects information (including sensitive personal and health information) about HPV vaccinations given in Australia.
The management and staff of VCS appreciate that sensitive personal and health information is held by the organisation. The organisation has strict confidentiality and privacy practices in place and all staff are required to abide by these. Any third party who may potentially have access to the Register will be required to sign a confidentiality statement.
All personal information is managed from the premises of VCS or its authorised subcontractors. In accordance with prudent business practice, backup tapes of the information system on which the HPV Register is located are stored in a secure facility off-site. Where any services associated with the HPV Register are subcontracted and the subcontractor may have access to personal information, VCS will ensure that the subcontractor is required to abide by strict privacy requirements in relation to that information.
How personal information is collected?
Personal information held on the HPV Register is collected by VCS from the doctor or nurse who provided the vaccination (Immunisation Provider), unless an individual elects not to have their immunisation details recorded on the Register (see Opt-off process below). Information about HPV vaccinations given in schools will be provided by state and territory governments for inclusion on the Register.
What personal information is held?
VCS will only collect and hold personal information about an individual which is relevant or related to the performance of its role in maintaining the HPV Register.
The personal information held on the Register may include the name, date of birth, indigenous status, current addresses, contact telephone number, and Medicare Number of an individual receiving a vaccination as well as the name, address and Medicare Provider Number of the health care practitioner who administered the vaccination.
In the case of children*, the name of a parent or guardian may also be recorded.
The HPV Vaccination history is the only health information recorded on the Register. This information may include details about when and where the HPV vaccine was administered and what HPV vaccine was administered.
* A child, for the purposes of the HPV Register is:
<14 yrs in NSW
<16 yrs in SA and NT
<18 yrs in other States and territories
How personal information is used?
The personal and health information held about an individual vaccinated on the HPV Register is used for the following purposes:
i) Providing an Immunisation Completion Statement when the course of vaccinations is completed. This is provided to the individual who was vaccinated unless they have elected to Opt-out of correspondence (see Opt-out process below).
ii) Providing an Immunisation History Statement. This is provided to individuals vaccinated through the schools program, unless they have elected to Opt-out of correspondence (see Opt-out process below).
iii) Providing a vaccination Reminder Letter to individuals participating in the schools program when a vaccine dose is overdue, unless they have elected to Opt-out of correspondence (see Opt-out process below).
iv) Providing Overdue Dose Reports and Dose Exception Reports to school and community-based immunisation providers.
v) Providing access either by telephone or online (where access is granted) to Medical Practitioners and other immunisation providers to an individual’s Immunisation Record
vi) Providing information to Pap Test and Cervical Cancer Screening Registers operated by the States and Territories.
vii) Information from the Register may be provided to researchers for ethically-approved health research. This will usually involve de-identified information, i.e. summary statistics that do not identify an individual.
To whom is information disclosed?
Personal information about an individual may be disclosed to the following parties:
i) An individual’s Immunisation Provider.
ii) An individual’s Medical Practitioner.
iii) A representative of the individual (e.g. an authorised representative or lawyer), with their written consent.
iv) In the case of children*, to the parent or guardian of the child as recorded on the HPV Register
v) The Department of Health & Ageing upon written request of the Secretary
vi) Pap Test and Cervical Cancer Screening Registers operated by States and Territories.
Opting-Off the Register
An individual, or in the case of a child*, their parent/guardian, may elect not to have their personal and immunisation details recorded on the Register. This is referred to as Opting-off the Register.
To opt-off the Register you should indicate to your Immunisation Provider that your personal details are not to be forwarded to the HPV Register.
If you wish to have your personal information removed from the Register, you should make a request in writing to the Register’s Medical Director. A form is available for this purpose (Register contact details below).
Opting-Out of correspondence
A person, or in the case of a child*, their parent/guardian, may elect not to receive any correspondence, such as completion statements or reminder letters, from the Register. This is referred to as Opting-out of correspondence. When a person opts-out of correspondence, personal details and vaccination history are still recorded on the Register and the usual correspondence to Immunisation Providers and Medical Practitioners will still occur. However, the individual will not receive any of the correspondence described above.
To opt-out of correspondence, you need to advise us by telephone or by completing the relevant form (Register contact details below).
HOW AN INDIVIDUAL OBTAINS ACCESS TO THEIR OWN PERSONAL INFORMATION
The Register will provide an individual with access to their own personal and health information at no cost.
The following section describes how a person should proceed.
i) A request for access to personal information may be in writing or by telephone (subject to rules around release of personal information) (contact details below).
ii) The person should provide sufficient identification so that the authenticity of the request can be assessed by Registry staff. The Register will endeavour to respond to any request for access within 10 working days of receipt of the request.
HOW TO MAKE A COMPLAINT REGARDING YOUR PRIVACY?
If you wish to make a complaint about the Register’s activities with regard to your privacy then this should be done in writing to the Register, or to the Privacy Commissioner.
Contact details for the Register are:
The Federal Privacy Commissioner can be contacted at: