Purpose

• This policy ensures that personal information is protected and handled in accordance with relevant legislation and disposal guidelines.
• We acknowledge an individual’s right to privacy while recognising the necessity of collecting, maintaining, and administering personal information to provide a safe working environment and a high standard of care.
• Maintaining confidentiality is a fundamental aspect of this policy.
• All staff have a legal duty to respect client rights to privacy and confidentiality regarding their personal and health information, including its use and disclosure.

Policy Statement

• We are committed to full compliance with state-based privacy legislation.
• Clients will be provided with information regarding the privacy of their personal data during their first visit, and where possible, in their preferred language.
• Clients have the right to request access to their personal records, which will be processed in accordance with the Personal Information Protection Act 2004.
• All cosmetic injectors must obtain and document a client’s consent before sharing personal information internally or externally and before commencing any treatment. Adults are assumed to have the capacity to consent unless proven otherwise. Personal information may be shared with other agencies, services, or health providers only if the client provides voluntary and informed consent (written or verbal).
• Personal information may also be disclosed if required by law, such as in emergencies or disaster situations.
• Staff must not, without lawful authority, destroy or damage any personal records that are legally required to be maintained.
• Personal information will be securely retained and disposed of in accordance with appropriate retention and disposal guidelines.

Retention and Disposal

• Client records must be retained and disposed of following Tasmanian legislation and the Personal Information Protection Act 2004.
• All records are stored securely within an encrypted system. The use of medical history, consent, or other physical forms is not endorsed.
• The required retention period for client records is seven years. Requests for document destruction must be reviewed by the Medical Advisory Committee before action is taken.

Procedure for Consent to Share Client Information

• When a client first engages with the service and is registered within the client management system, consent to share information internally must be obtained.
• Clients should be informed about the nature and implications of sharing their information, and once consent is given, it must be documented within the encrypted system.

For the full Patient Privacy / Records Security Policy, please contact info@heartaestheticshobart.com.au.