Social, Email and Privacy Policies

Social Media Policy

Current as of: January 2026

This Social Media Policy is to provide information on how we manage our privacy and security on social media platforms. This policy is adapted from and in accordance with RACGP standards and AHPRA guidelines.

Summary

When using social media, health practitioners should remember that the National Law, their National Board’s code of ethics and professional conduct (the Code of conduct) and the Guidelines for advertising regulated health services (the Advertising guidelines) apply. Registered health practitioners should only post information that is not in breach of these obligations by:

Complying with professional obligations.
Complying with confidentiality and privacy obligations (such as by not discussing patients or posting pictures of procedures, case studies, patients, or sensitive material which may enable patients to be identified without having obtained consent in appropriate situations), presenting information in an unbiased, evidence-based context, and
Not making unsubstantiated claims.

Additional information may be available from professional bodies and/or employers, which aims to support health practitioners’ use of social media. However, the legal, ethical, and professional obligations that registered health practitioners must adhere to are set out in the National Boards’ respective Code of conduct and the Advertising guidelines.

About the National Boards and AHPRA

The 14 National Boards regulating registered health practitioners in Australia are responsible for registering practitioners and students (except for in psychology, which has provisional psychologists), setting the standards that practitioners must meet, and managing notifications (complaints) about the health, conduct or performance of practitioners.

The Australian Health Practitioner Regulation Agency (AHPRA) works in partnership with the National Boards to implement the National Registration and Accreditation Scheme, under the Health Practitioner Regulation National Law, as in force in each state and territory (the National Law). The core role of the National Boards and AHPRA is to protect the public.

Introduction

The use of social media is expanding rapidly. Individuals and organizations are embracing user-generated content, such as social networking, personal websites, discussion forums and message boards, blogs and microblogs.

Whether an online activity can be viewed by the public or is limited to a specific group of people, our practice maintains professional standards and is aware of the implications of our actions, in all professional circumstances. We are aware that information circulated on social media may end up in the public domain, and remain there, irrespective of the intent at the time of posting.

Context A key objective of the National Registration and Accreditation Scheme and of the National Boards is to protect the public. The National Law and codes and guidelines developed by National Boards are relevant when considering social media.

This policy explains how the National Law and the following existing codes and guidelines relate to social media:

Section 133 of the National Law which establishes obligations about advertising by registered health practitioners and the Advertising guidelines, and
The relevant National Board’s Code of conduct.

Our practice is aware of our ethical and regulatory responsibilities when we are interacting online, just as when we interact in person. This social media policy provides guidance to our practice team members on understanding our responsibilities and obligations when using and communicating on social media. This social media policy is adapted from and in accordance with RACGP standards and AHPRA guidelines.

Definition of social media

‘Social media’ describes the online and mobile tools that people use to share opinions, information, experiences, images, and video or audio clips and includes websites and applications used for social networking. Common sources of social media include, but are not limited to, social networking sites such as Facebook and LinkedIn, blogs (personal, professional and those published anonymously), WOMO, True Local and microblogs such as Twitter, content-sharing websites such as YouTube and Instagram, and discussion forums and message boards.

Policy enforcement

Regardless of whether social media is used for business related activity or for personal reasons, the following standards apply to members of our practice team, including general practitioners. Practitioners and team members are legally responsible for their postings online. Practitioners and team members may be subject to liability and disciplinary action including termination of employment or contract if their posts are found to be in breach of this policy.

Obligations in relation to social media

In using social media, just as with all aspects of professional behaviour, health practitioners and all practice staff should be aware of their obligations under the National Law, their Board’s Code of conduct, the Advertising guidelines and other relevant legislation, such as privacy legislation.

Professional obligations

The Code of conduct contains guidance about the required standards of professional behaviour, which apply to registered health practitioners whether they are interacting in person or online. The Code of conduct also articulates standards of professional conduct in relation to privacy and confidentiality of patient information, including when using social media. For example, posting unauthorized photographs of patients in any medium is a breach of the patient’s privacy and confidentiality, including on a personal Facebook site or group even if the privacy settings are set at the highest setting (such as for a closed, ‘invisible’ group).

Obligations in relation to advertising

Section 133 of the National Law imposes limits on how health services delivered by registered health practitioners can be advertised. These limits apply to all forms of advertising, including through social media and on the internet. For example, the National Law prohibits the use of testimonials in advertising. The Advertising guidelines provide guidance about how the legal restrictions on advertising under the National Law and other relevant legislation apply to social media.

Policy review statement

This privacy policy will be reviewed regularly to ensure it is in accordance with any changes that may occur.

Brunswick Medical Centre On Lygon

Email Policy

Current as of: 26/11/2025

Introduction

This email policy is to provide information on how we manage our privacy and security via email communications. This email policy is adapted from and in accordance with RACGP 5^th Edition standards and AHPRA guidelines.

General practices are increasingly receiving requests from patients, other clinicians and third parties for health information to be sent to them electronically because it is an easily accessible method of communicating. The Australian Privacy Principles published by the Office of the Australian Information Commissioner state that: “Health information is regarded as one of the most sensitive types of personal information.

For this reason, the Privacy Act 1988 (Privacy Act) provides extra protections around its handling”. http://www.oaic.gov.au/privacy/privacy-act/health-and-medical-research The Privacy Act defines health information as:

information or an opinion about:
1. the health or a disability (at any time) of an individual; or
2. an individual’s expressed wishes about the future provision of health services to him or her; or
3. a health service provided, or to be provided, to an individual; that is also personal information; or
other personal information collected to provide, or in providing, a health service; or
other personal information about an individual collected in connection with the donation, or intended donation, by the individual of his or her body parts, organs or body substances; or
genetic information about an individual in a form that is, or could be, predictive of the health of the individual or a genetic relative of the individual.

Rationale

As all health information is sensitive by nature, all communication of health information, including via electronic means, must adequately protect the patient’s privacy. Our practice takes reasonable steps to make our communication of health information adequately safe and secure. GPs, health providers and patients should be aware of the risks associated with using email in the healthcare environment.

Policy

Our practice considers our obligations under the Privacy Act before we use or disclose any health information. The Privacy Act does not prescribe how a healthcare organization should communicate health information. Any method of communication may be used as long as the organization takes reasonable steps to protect the information transmitted and the privacy of the patient. A failure to take reasonable steps to protect health information may constitute a breach of the Australian Privacy Principles and may result in action taken against the organization by the Australian Privacy Commissioner. What amounts to reasonable steps will depend on the nature of the information and the potential harm that could be caused by unauthorized access to it. The RACGP has developed a matrix is to assist practices in determining the level of security required in order to use email in general practice for communication.

Our practice reserves the right to check an individual’s email accounts as a precaution to fraud, viruses, workplace harassment or breaches of confidence by members of the practice team. Inappropriate use of the email facility will be fully investigated and may be grounds for dismissal.

Email configuration

Communication of clinical information to and from healthcare providers, are completed from within the practice’s clinical software using a secure clinical messaging system such as medical objects. The use of a practice’s clinical software means that a record of communication is automatically retained in the patient’s medical record.

Protection against spam:

Use a spam filtering program.

Encryption of patient information:

Use server to server encryption such as SSL or TLS.

Email use education

General protection

If any information held in our email accounts are relied on, you will download and follow download procedure as per practice policy. You will import into relevant patient file to ensure contents are backed up with the rest of our data.
Do not download or open any email attachments where the sender is not known to you.
Email use that breaches ethical behaviours and/or violates copyright is prohibited.
Do not send or forward unsolicited email messages, including the sending of ‘junk mail’ or other advertising material (email spam).
Do not use email for broadcast messages on personal, political or non-business matters.

Protection against spam

Do not reply to spam mail.
Never try to unsubscribe from spam sites.
Remain vigilant: do not provide confidential information to an email (especially by return email) no matter how credible the sender’s email seems (e.g. apparent emails from your bank).
Use a spam filtering program.

Encryption of patient information

All email communications should be treated as confidential.
When sending patient information or other confidential data by email, it is best practice to use encryption.
Be aware that encrypted files are not automatically checked for viruses. They have to be saved, decrypted and then scanned for viruses before being opened.

Protection against the theft of information

There are significant risks if providing confidential information by email: only do so via the internet when the site displays a security lock on the task bar and with an https in the web address.
Do not inform people of your email password.
Be aware of phishing scams requesting logon or personal information (these may be via email or telephone).

Email disclaimer

The practice uses an email disclaimer notice on outgoing emails that are affiliated with the practice stating:

Please consider the environment before printing this e-mail.
Any personal or sensitive information contained in this e-mail and attachments must be handled in accordance with the Information Privacy Act 2000 (Victoria), the Health Records Act 2001 and the Privacy Act 1988 (Commonwealth), as applicable.
This e-mail, including all attachments, is confidential. If you are not the intended recipient, any use, disclosure or copying of this e-mail is unauthorised. If you are not the intended recipient of this e-mail, please immediately notify Brunswick Medical Centre On Lygon, info@bmcol.com.au or telephone (03)9117 7787 and then delete this e-mail.
Any personal comments contained within this e-mail are those of the sender and do not necessarily represent the views of Brunswick Medical Centre On Lygon.

Brunswick Medical Centre On Lygon has attempted to make this e-mail and any attachments free from viruses but cannot provide an assurance that this e-mail or any attachments are free of viruses and accepts no liability.
“DISCLAIMER: Please Note that any electronic communication could be intercepted or read by someone other than the intended recipient and it is at your discretion for proceeding with electronic communication. This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the system manager.

This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.”

Email correspondence

Email correspondence sent to our website/email address, are retained as required by the Public Records Act 2002 and other relevant legislation. Email messages may also be monitored by our information technology staff for system trouble-shooting and maintenance purpose. Your email address details will not be added to a mailing list (unless you so request) or disclosed to a third party unless required by law.

Policy review statement

This privacy policy will be reviewed regularly to ensure it is in accordance with any changes that may occur.

Privacy Policy

Current as of: January 2026

Introduction

This privacy policy is to provide information to you, our patient, on how your personal information (which includes your health information) is collected and used within our practice, and the circumstances in which we may share it with third parties.

Why and when your consent is necessary

When you register as a patient of our practice, you provide consent for our GPs and practice staff to access and use your personal information so they can provide you with the best possible healthcare. Only staff who need to see your personal information will have access to it. If we need to use your information for anything else, we will seek additional consent from you to do this.

Why do we collect, use, hold and share your personal information?

Our practice will need to collect your personal information to provide healthcare services to you. Our main purpose for collecting, using, holding and sharing your personal information is to manage your health. We also use it for directly related business activities, such as financial claims and payments, practice audits and accreditation, and business processes (e.g. staff training).

What personal information do we collect?

The information we will collect about you includes your:

names, date of birth, addresses, contact details
medical information including medical history, medications, allergies, adverse events, immunisations, social history, family history and risk factors
Medicare number (where available) for identification and claiming purposes
healthcare identifiers
health fund details.

How do we collect your personal information?

Our practice may collect your personal information in several different ways.

When you make your first appointment our practice staff will collect your personal and demographic information via your registration.

During the course of providing medical services, we may collect further personal information. [Information can also be collected through electronic transfer of prescriptions (eTP), My Health Record, e.g. via Shared Health Summary, Event Summary. We may also collect your personal information when you visit our website, send us an email or SMS, telephone us, make an online appointment or communicate with us using social media.
In some circumstances personal information may also be collected from other sources. Often this is because it is not practical or reasonable to collect it from you directly.

This may include information from:

your guardian or responsible person
other involved healthcare providers, such as specialists, allied health professionals, hospitals, community health services and pathology and diagnostic imaging services
Medicare, or the Department of Veterans’ Affairs (as necessary).

When, why and with whom do we share your personal information?

We sometimes share your personal information:

with third parties who work with our practice for business purposes, such as accreditation agencies or information technology providers – these third parties are required to comply with APPs and this policy
with other healthcare providers
when it is required or authorised by law (e.g. court subpoenas)
when it is necessary to lessen or prevent a serious threat to a patient’s life, health or safety or public health or safety, or it is impractical to obtain the patient’s consent
to assist in locating a missing person
to establish, exercise or defend an equitable claim
for the purpose of confidential dispute resolution process
when there is a statutory requirement to share certain personal information (eg some diseases require mandatory notification)
during the course of providing medical services, through eTP, My Health Record (eg via Shared Health Summary, Event Summary).
Only people who need to access your information will be able to do so.

Other than in the course of providing medical services or as otherwise described in this policy, our practice will not share personal information with any third party without your consent.

We will not share your personal information with anyone outside Australia (unless under exceptional circumstances that are permitted by law) without your consent.

Our practice will not use your personal information for marketing any of our goods or services directly to you without your express consent. If you do consent, you may opt out of direct marketing at any time by notifying our practice in writing.

How do we store and protect your personal information?

Your personal information may be stored at our practice in various forms. Medical records are stored electronically, X-rays, CT scans, are given to you where possible or stored in our admin office. Our practice stores all personal information securely. Your personal information is stored in an electronic format on the computer server located on site. All practice personnel have access to different parts of the medical software used according to their needs. Staff do not have access to your medical record. All practice personal have signed confidentiality agreements Access to the computer software program is by individual password known only to the users.

How can you access and correct your personal information at our practice?

You have the right to request access to, and correction of, your personal information. Our practice acknowledges patients may request access to their medical records. We require you to put this request in writing, once a record is requested, we will give/email you a form to complete and give/email back to the practice and our practice will respond within a reasonable time the records will be made available to you within 30 days from the receipt of the signed request from you.

The cost incurred for these records will be $35 administration fee.

Our practice will take reasonable steps to correct your personal information where the information is not accurate or up to date. From time to time, we will ask you to verify that your personal information held by our practice is correct and current.

You may also request that we correct or update your information, and you should make such requests in writing to the privacy office – Olympia Raptis or request can be emailed to info@bmcol.com.au

How can you lodge a privacy-related complaint, and how will the complaint be handled at our practice?

We take complaints and concerns regarding privacy seriously. You should express any privacy concerns you may have in writing. We will then attempt to resolve it in accordance with our resolution procedure.

Please direct complaints to Olympia Raptis (Practice Manager) via the Medical Centre or by email to info@bmcol.com.au

Direct mail to

Brunswick Medical Centre On Lygon

473 – 475 Lygon Street,

Brunswick East 3057

Your complaint will be addressed with you with 2 days of it being received and a follow up plan discussed at that time depending on the necessary investigation.

You may also contact the

Office Victorian Information Commissioner or call 1300006842 Or

Health Complaints Commissioner in Victoria Call 1300 582 113

Privacy and our website

We do not collect any personal details via our website.

Policy review statement

This document is reviewed every year in line with accreditation or if new rules are implemented.