Privacy at the Australian Centre for the Prevention of Cervical Cancer

The management and staff of VCS Foundation Ltd., trading as the Australian Centre for the Prevention of Cervical Cancer (ACPCC), understand the importance of protecting the privacy and confidentiality of all personal information and health information that is held by the organisation. The ACPCC collects a range of personal information and health information about individuals. The ACPCC may collect this information from the individual or from another person dealing with that individual, such as their healthcare practitioner. The type of information that ACPCC collects and the way in which it may use and disclose that information varies according to the services, activities and programs that the ACPCC provides or undertakes in relation to an individual.

The ACPCC has strict privacy and confidentiality practices in place and all staff are required to abide by these. A Disciplinary Policy and Procedure is in place to ensure staff comply with these practices. All persons who may observe personal information or health information held by the ACPCC are required to sign a confidentiality statement annually.

This policy details how the ACPCC manages and uses the personal information and health information it holds in relation to the services, activities and programs of its three pillars (or divisions) which are the following:

VCS Pathology – a laboratory committed to excellence in cervical cytology, Human Papillomavirus (HPV) testing, sexual transmitted infection testing, respiratory (including SARS-CoV-2) testing, histopathology and other related nucleic acid testing.
Population Health – supporting population health programs by delivering and managing population health registry systems and services and by providing specialist expertise in epidemiology, research and evaluation, health policy, health information management, reporting and statistics.
Digital Health – advancing population health management through innovative and connected technology solutions and services.

All personal information and health information is stored on the premises of the ACPCC or in cloud-based storage in Australia. Backup tapes of the information system and some slides are stored in a secure facility off-site. Where services are contracted out, contractors must comply with ACPCC privacy and confidentiality requirements if any personal information is provided to them.

How is personal information and health information collected?

VCS Pathology collects personal information and health information directly from individuals and also from other persons involved in the care or treatment of an individual, such as their health care practitioner that orders their pathology test. Where an individual offers information directly to the ACPCC, this may also be entered on the individual’s health record.

VCS Population Health supports a range of population health programs and initiatives, such as cancer screening and immunisation follow-up services, clinical trials and targeted projects, that improve the health and well-being of communities by providing systems and services for the collection, storage, analysis and reporting of data. VCS Population Health collects personal information and health information directly from individuals, their nominated representatives and from other persons involved in the care or treatment of individuals, such as health care practitioners, laboratories or health care facilities. This information assists in maintaining accurate and up to date health records for program and project participants. VCS Population Health also receives personal information and health information from other public health organisations such the bodies which operate the National Cancer Screening Register and the Victorian Cancer Registry, for the purposes of providing data and reports to support cancer screening activities and programs. For some projects, data is collected by our stakeholders and other parties with which we interact and held within ACPCC systems.

VCS Digital Health does not collect personal information directly from any individual. However, it may assist VCS Pathology or VCS Population Health to collect personal information for each of them, or it may collect personal information from either of them.

If we interact or transact with an individual in circumstances other than those described above, we will ordinarily collect personal information directly from the individual; we may also collect such information from other parties with which we interact in relation to the relevant activity.

If the ACPCC receives unsolicited personal information or health information, we will deal appropriately with such information including considering whether we could have otherwise lawfully collected the information. If we determine we could not have otherwise lawfully collected the information, we will destroy the information or ensure the information is de-identified if it is lawful and reasonable to do so.

If you do not provide, or we are unable to collect, the personal whether we could have otherwise lawfully collected the information or health information we require, we may be unable to provide our services to you, you may be unable to participate in our activities or programs, or we may be unable to work or transact with you.

What personal information and health information do we hold?

The ACPCC collects and holds personal information and health information which is necessary for and related to the performance of its work and activities.

The type of personal information and health information that the ACPCC collects and holds about an individual will vary according to the service we provide to the individual, the activity or program the individual might participate in or our relationship with that individual. The type of information the ACPCC collects and holds includes the following:

Name (current and previous), date of birth, gender/sex, current and previous addresses, telephone numbers, e-mail addresses.
Cultural and linguistic diversity status, Aboriginal and Torres Strait Islander (ATSI) status.
Medicare Number.
The results of all pathology and screening tests performed by VCS Pathology for individuals undergoing those tests.
In the case of cervical screening tests reported by VCS Pathology, VCS Pathology may obtain associated colposcopy, histopathology and other relevant pathology results from health practitioners and other laboratories from the National Cancer Screening Register or the Compass Register.
Other medical and health information, including clinical information provided by the health care practitioner ordering a pathology or screening test and clinical information provided by an individual. This may include a description of current or previous symptoms, health status, family history, health conditions, treatments and other test results.
Information relating to our VCS Population Health projects in screening and immunisation which is specific to our projects and services. This may relate to screening invitations, screening test results, healthcare provider information, demographics, family contacts, treatment results and outcomes.

VCS Pathology also collects and holds personal information regarding the healthcare practitioner ordering a pathology test for an individual. This includes the practitioner’s name, address and Medicare Provider Number.

The ACPCC may also collect personal information about individuals in other circumstances, such as if a person applies for a job with the ACPCC, undertakes pre-employment checks or otherwise deals or transacts with the ACPCC. The type of information the ACPCC may collect in those circumstances includes: name, address, date of birth, financial details, health information, employment details and history and telephone numbers. All staff employed with the ACPCC and having access to personal information must have national police checks prior to employment.

At times, and depending on projects, the ACPCC may collect and use other types of personal information and health information which is relevant for that project or to the performance of its work and activities – for example, information provided through consent-based research or other research approved by a Human Research Ethics Committee (HREC). If any additional type of personal information (other than as specified above) will be collected and used for those projects or activities, the individual’s consent for that use and collection will be sought, unless the law permits otherwise.

Given the nature of the services and activities we perform, it is not possible for you to deal with us anonymously or by using a pseudonym.

Storage of historical records

The ACPCC holds an historical copy of the records transferred to the NCSR. This copy only contains records created before the date of transfer. These records are securely stored and protected by the ACPCC.

How is personal and health information used?

The ACPCC uses the personal information and health information it holds about an individual for the following purposes (as applicable):

To provide recommendations for the management of test results (follow up) to health practitioners.
To perform and to assist in reporting a pathology test that has been ordered.
To communicate with health care providers involved in the individual’s care.
To perform the other services we provide and to perform our other activities and programs.
To charge for those services (where appropriate) or to liaise with a third-party payer (for example, Medicare).
For research, to improve our knowledge, particularly of how to better prevent cancer of the cervix in women/people with a cervix. However, no research publication will ever identify an individual without prior written consent from that person. Where small numbers of patient data are used for research purposes, data suppression is routinely applied to prevent inadvertent identification of an individual.
To provide statistical data to the Victorian Government’s Department of Health to support the Victorian Cancer Plan, as required by legislation, in increasing screening participation rates in specific populations or to provide statistical data to other government bodies and agencies for cancer related purposes. No statistical data identifies a person.
To meet our other statutory and regulatory obligations.
To manage our relationship with clients, employees, employment applicants, contractors and service providers.
To support projects and initiatives and fulfil contractual obligations.
To conduct activities related to quality assurance and improvement processes, accreditation and audits, staff education and training and for managing legal and other claims.
To respond to and manage a complaint.

In addition to the above, the ACPCC may also use your information if you have given your express or implied consent for the use for another purpose, or if we are permitted or required to do so by law.

This section provides further details regarding how the ACPCC uses your personal information and health information if you participate in the Compass Trial. More detailed information can be found in the Compass Privacy Statement.

The personal and health information held on the Compass Register is used by the ACPCC for the following purposes:

To provide recommendations for follow up of test results or in relation to health care;
to assist a pathology laboratory in reporting a current cervical screening test or in their decision about whether or not to issue an amended report on a previously reported cervical screening test;
to communicate with health care providers involved in the individual’s care;
to send reminder letters to women who are overdue for screening;
to assist women to receive follow-up care after an abnormal cervical screening test; this may involve communication with the health care practitioner or the woman;
to assist pathology laboratories in measuring the quality of their cervical screening test reporting;
for research to improve our knowledge, particularly about how to achieve and maintain high participation rates in cervical screening and how to prevent cancer of the cervix in women/people with a cervix. However, no research publication will identify an individual person;
to inform funding, management, planning, monitoring and evaluation of our registries and our health and other services.
To conduct activities related to quality assurance and improvement processes, accreditation and audits, staff education and training and for managing legal and other claims.

When and to whom is personal information and health information disclosed?

The ACPCC may disclose your personal information or health information for the purposes set out in the previous section. It may also disclose your personal and health information in the following circumstances:

To your health care practitioner who ordered the pathology test.
To another health care practitioner at your health care practitioner’s request, or where this is considered necessary in relation to the health services we provide.
At your health care practitioner’s request or where we consider it is necessary, to another laboratory when a further opinion is being sought on a pathology specimen or for a pathology test that has been ordered but which is not performed at VCS Pathology.
In accordance with the Health Insurance Act 1973, to Medicare Australia for the purpose of payment for services for bulk-billed tests such as histology, HPV tests, liquid-based cytology and other nucleic tests.
Reporting to the National Cancer Screening Register in accordance with section 13 of the National Cancer Screening Act 2016. Where VCS Pathology is aware that an objection has been lodged to such notification by an individual, then we will not disclose any personal information or health information of that individual for this purpose.
In accordance with Section 9 of the Improving Cancer Outcomes Act 2014, to the Victorian Cancer Registry for individuals who reside in Victoria and who are diagnosed with cancer.
To your representative (e.g. an authorised representative or lawyer), with your written consent.
To our legal advisers and insurers.
To the Victorian Department of Health or to another State or Commonwealth government department or agency in connection with the performance of one or more of its functions.
To the extent required by law or pursuant to any court order. This may include information provided to a Coroner or a Court under a subpoena.
To contractors and other parties that we engage to perform services for us. However, we would require the contractors to comply with relevant privacy laws and this privacy policy.
If you have agreed to participate in a trial, in accordance with your consent given in respect of that trial or as otherwise permitted under the Privacy Act 1988 or other relevant laws.

In addition to the above, the ACPCC may also disclose your information in other circumstances and to other persons if you have given your express or implied consent, or if we are permitted or required to do so by law (including under the Privacy Act 1988 and the Health Records Act 2001).

The ACPCC does not disclose or transfer an individual’s personal information or health information to any overseas organisation or person (other than the individual).

My Health Records

If you have chosen to participate in the My Health Record program operated by the Commonwealth Department of Health, your screening test result will be uploaded to your My Health Record by VCS Pathology unless you or your referring health practitioner has requested us not to by writing ‘do not send reports to My Health Record’ on the pathology request form. You may change the access and privacy setting of your My Health Record through the My Health Record system.

You must tell us each time you have a screening test if your preference is not to have your result uploaded to your My Health Record. For more information visit: https://www.myhealthrecord.gov.au/for-you-your-family/howtos/view-pathology-and-diagnostic-imaging-reports

How an individual may obtain access to, or correction of, their personal information

You may request access to the personal information and health information the ACPCC holds about you. We will give you access to your information, unless we have a reason to limit or refuse access under the Privacy Act 1988 (or another relevant law). If we limit or refuse access to your information, we will provide reasons. If we give you access to your information, we will not charge you for that access.

Results of pathology tests are normally provided to the health care practitioner who ordered the test. The best way to get your results is in consultation with your healthcare practitioner so that your practitioner can explain your results in the context of your health care.

You may also request the correction of your personal information or health information we hold if you believe it is inaccurate. We will take reasonable steps to amend your information if we consider the personal information that we hold about you is inaccurate, incomplete or out of date.

The following section describes how you may request access to or correction of your information.

Your request should be in writing (an application form is available from us on request) and be addressed to the Executive Director at the contact details set out below. If you cannot make your request in writing, please contact 03 9250 0300 for assistance with your request.
You should provide sufficient identification so that the authenticity of the request can be satisfactory by the Executive Director of the ACPCC.
Upon lodgement of a request, the Executive Director of the ACPCC will oversee the process whereby your personal information and health information is made available to you, or corrected, subject to the requirements of applicable privacy and health records laws.
Where applicable, the personal information and health information will be provided in printed form to you or alternatively you may visit the VCS Pathology to personally view your records by appointment.
VCS Pathology will ordinarily respond to these requests within 25 working days of receipt of the request.

More detailed information on access to, or correction of, health information relating to the Compass Trial can be found in the Compass Privacy Statement.

How to make a complaint regarding your privacy?

If you have any concerns or complaints about your privacy or the way the ACPCC has handled your personal or health information, please contact us in writing at the address below. We will endeavour to resolve your complaint promptly and will provide a written response to you.

Contact details for the ACPCC (VCS Foundation Limited):

Postal Address:

The Executive Director

Australian Centre for the Prevention of Cervical Cancer

PO Box 178

Carlton South VIC 3053

Email: [email protected]

Telephone: 03-9250-0300

Fax: 03-9349-1949

If we are unable to resolve your complaint satisfactorily, you may wish to direct your complaint to the Health Complaints Commissioner or to the Office of the Australian Information Commissioner.

Contact details for the Victorian Health Complaints Commissioner:

Postal Address:

Health Complaints Commissioner

26^th Floor

570 Bourke Street

Melbourne VIC 3000

Website: www.hcc.vic.gov.au/make-complaint

Telephone: 1800-582-113

The Australian Information Commissioner is the statutory office-holder responsible for the regulation of privacy laws in Australia in accordance with the Privacy Act. The Office of the Australian Information Commissioner (OAIC) website contains more information about the Privacy Act, including the Australian Privacy Principles and information about how to make a privacy complaint.

Who is responsible for this policy?

The ACPCC Director Corporate Services is responsible for this policy and can assist with any queries about:

how your personal information is collected, held, used or disclosed by the ACPCC;
how to obtain access to or request correction of your personal information;
this Privacy Policy.

You can contact our Director Corporate Services through the contact details below:

Postal address:

Australian Centre for the Prevention of Cervical Cancer

Director Corporate Services