Privacy

Page last updated: 01 December 2017

The National Cervical Screening Program has been operating since 1991.

If you participate in cervical screening, your personal information is collected by healthcare providers including pathologists for the purpose of conducting cervical screening tests. This information has and continues to be shared with state and territory cervical screening program registers, which acts as a safety net for people who participate in screening.

The National Cancer Screening Register (NCSR) has commenced operation, and will start receiving information from healthcare providers including pathologists in order to provide the national safety net function similar to that which has been performed for many years by state and territory governments.

The National Cancer Screening Register is operated by the Commonwealth. The Commonwealth is authorised to collect and disclose information for these purposes through the National Cancer Screening Register Act 2016, and has obligations through this Act and the Privacy Act 1988 to protect your personal information, including who has access to it and how it is handled.

National Cancer Screening Register Privacy Policy

1. About this policy

The National Cancer Screening Register (the Register) is a national electronic infrastructure for the collection, storage, analysis and reporting of cancer screening program data for the National Cervical Screening Program.

The Register aims to create better healthcare services for our community in relation to cervical cancer by supporting the early detection of changes that may lead to cervical cancer through screening, as well as facilitating clinical decision making about cervical cancer.

This Privacy Policy describes why, when, and how we collect, use and disclose your information to operate the Register.

The Australian Government Department of Health (Health) is the custodian of the information in the Register and has contracted Telstra Corporation Limited (Contracted Service Provider) to build and operate the Register. When this Privacy Policy mentions us, we or our, it refers to Health and the Contracted Service Provider who takes actions on behalf of Health.

2. Privacy

We have obligations in relation to personal information about individuals (you, your).

We are bound by the Privacy Act 1988 (Cth) (the Privacy Act), including the Australian Privacy Principles (APPs), and the National Cancer Screening Register Act 2016 (the NCSR Act). These Acts regulate how we collect, record, use, store and disclose information we hold about you and to whom it can be released.

When we collect personal information about you, we have obligations under the Privacy Act to notify you or your personal representative (if you have one) about a number of matters, including why we are collecting the information. We generally provide this notification by having Privacy Notices on our paper-based forms, electronic messages and correspondence to you and online portals.

Privacy Impact Assessment

In December 2016, a Privacy Impact Assessment (PIA) for the Register was conducted for Health to assess the Register’s impact on the privacy of individuals and made recommendations for managing, minimising or eliminating that impact. The PIA recommended that Health develop a privacy policy for the Register.

3. Collection, use and disclosure of personal information

Collecting your personal information

Individual participants

We collect information about you for the purposes of the Register. We collect personal information so that we can id
entify you and administer the functions of the Register.

We collect information about you which is related to cervical screening, such as:

  • your history of screening, for example, the date of your last cervical screening test
  • your history of assessment and diagnosis and any test results, for example, if your biopsy results for cervical screening are positive, or if lesions or other abnormality were found as a result of a colposcopy
  • information about your vaccination status for human papillomavirus
  • key information about you such as your address, contact details, date of birth, gender, Medicare number, individual healthcare identifier and information about any assistance you require due to a medical condition or disability.
We collect personal information about you from various sources such as the Department of Human Services (DHS) (for example, Medicare claims information showing that you have undertaken cervical screening), the Department of Veterans’ Affairs (DVA) (for example individual DVA numbers), healthcare providers (for example, results of abnormal tests) and State and Territory health departments. We may also collect personal information directly from you, your personal representative or a third party.

We also collect sensitive information such as your status as an Aboriginal or Torres Strait Islander and racial or ethnic origin to assist in improving the delivery of our cancer screening programs. You do not have to disclose these statuses to us. Your access to cervical screening will not be affected if you choose not to provide this information.

We may collect other information relevant to the purposes of the Register if they are prescribed under the NCSR Act.

Table 1 at Appendix A summarises the types of information we collect, the sources of data and the purposes of the collection of information.

Personal representatives

A personal representative may be appointed to act on your behalf in relation to the Register (refer to Part 4 – Your participation in the Register). Your personal representative will be able to elect to receive correspondence (invitation to screen, reminders or follow–ups) on your behalf, or obtain information about cervical screening, including your screening test results, on your behalf.

If you are a personal representative of an individual in the Register, we collect information about you to confirm your identity and administer the functions of the Register on behalf of the person you represent.

Healthcare providers

If you are a healthcare provider, we may also collect information about you from individuals who have nominated you as their healthcare provider, other healthcare providers (eg. pathology providers and specialists), DHS, the National Health Service Directory, NASH Directory and Endpoint Locator Service.

Table 2 at Appendix A summarises the types of information we collect about healthcare providers, the sources of data and the purposes of the collection of information.

Using and disclosing your information

We will only use and disclose information about you for the purposes of the Register or as authorised by the NSCR Act.

Table 3 at Appendix A summarises the types of information we disclose, to whom we disclose that information, the purpose of disclosure and how the information may be used.

Other authorised uses and disclosures include:

  • to a professional disciplinary authority, a child protection officer or an enforcement body if the information will enable or assist in performing or exercising the authority’s, officer’s or body’s functions or powers
  • for court or tribunal proceedings or in accordance with an order of a court or tribunal
  • for a coronial inquiry or in accordance with an order of a coroner
  • for research that complies with the Guidelines made under sections 95 and 95A of the Privacy Act (as applicable)
  • use or disclosure by a state or territory authority where the use or disclosure is required or permitted by that state’s or territory’s law.
Information we collect may also be used or disclosed for quality assurance, to improve the Register and for health promotion and planning purposes.

Unsolicited personal information

In some cases, we may receive unsolicited information about you that is not relevant to the Register’s functions or purposes.

If we do receive personal information in these circumstances, we must determine whether we could have lawfully collected the information. If we could not, we will destroy the information or de-identify it.

4. Your participation in the Register

You or your personal representative may make any of the following requests regarding your participation in the Register:

  • You may nominate a healthcare provider for the cervical program. Your nominated healthcare provider will be advised when you are overdue for follow up action.
  • You may request us to not contact you or send you any correspondence (including an invitation to screen, reminders or follow up) for a selected period of time or not at all.
  • You may request to defer or change the date you are due to undergo a screening test.
  • You may request to use a pseudonym when interacting with the Register.
  • You may choose to not participate in the Register. If you do:
    • We will not collect any results or any personal information about you after the date of your request to not participate in the Register.
    • We will not send you any correspondence (including an invitation to screen, reminders or follow up).
    • Your historical information will be made inaccessible from the date of your request and will only be become accessible again if you decide to participate in the Register at a later stage.
You may also withdraw any request concerning your participation at any time. Your personal representative (if you have one) may make or withdraw a request on your behalf.

To make any of the above requests regarding participation in the Register, you may wish to visit Health’s Cancer Screening website.
When we receive a request from you or your personal representative about your participation in the Register or withdrawal of a previous request, we will give effect to your instruction as soon as practicable.

5. Storage and security of your personal information

We take all reasonable steps to maintain systems and procedures to ensure that the personal information we hold is protected against misuse, interference and loss from unauthorised access, modification or disclosure.
These steps include:

  • ensuring secure storage of personal information in accordance with Australian Government security policies and guidelines, including the Attorney-General Department’s Protective Security Policy Framework and the Department of Defence Information Security Manual
  • granting access to personal information to authorised personnel only
  • monitoring system access and authenticating credentials
  • updating and auditing our storage and data security systems regularly.
Your information in the Register is stored within Australia in secure data storage facilities.
Storage of personal information (and the disposal of information when no longer required) is managed in accordance with the Archives Act 1983 and relevant Records Authorities and General Disposal Authorities.

6. Accidental or unauthorised disclosure of personal information


Information held in the Register may only be used and disclosed in accordance with the NCSR Act.

We have an obligation to comply with the data breach notification requirements in the NCSR Act and the Privacy Act and will take seriously and deal promptly with any potential or actual unauthorised access, use or disclosure of personal information.

Unauthorised use or disclosure of personal information held in, or derived from, the Register is an interference with the privacy of an individual and an offence under the NCSR Act.

This offence has a penalty of imprisonment for two years or 120 penalty units, or both. Exceptions to the penalty apply in certain limited circumstances.

7. Correction of personal information

We will take steps to ensure that the personal information we hold is accurate, up to date and complete. These steps include maintaining and updating personal information when you advise us that your personal information has changed and at other times as necessary.

You can ask us for access to your personal information or to change it. However, the Privacy Act sets out circumstances in which we can decline access to or correction of personal information (e.g. where access is unlawful under the NCSR Act). If we decline your request, we will tell you why.

To access or seek correction of personal information we hold about you, please contact our Privacy Contact Officer whose details are provided in Part 9 - Who is responsible for this policy?
If you believe your clinical details are incorrect in the Register, you should contact your healthcare provider. Your healthcare provider, in turn, can notify us about whether or not the information should be corrected. We will deal with each request regarding incorrect clinical information and notify you of the outcome.

You can also request access to documents containing your own personal information by emailing our FOI and Aged Care Parliamentary Section at foi@health.gov.au. There is no charge under the Freedom of Information Act 1982 for requesting access to your own personal information. More information about making FOI requests is available on our FOI web page or by contacting (02) 6289 1666.

8. Complaints

How we handle complaints

If you have a complaint about the way in which we have handled your personal information, you should write to our Privacy Contact Officer whose details are provided in Part 9 - Who is responsible for this policy?

We will respond promptly to your complaint or request if you provide your contact details. We are committed to quick and fair resolution of any complaints and will ensure your complaint is taken seriously.

We will respond to your privacy concern or complaint within 30 days from the date that we receive it. We will notify you if we cannot respond to you within this timeframe.

Making a privacy complaint

You also have the option of contacting the Office of the Australian Information Commissioner (OAIC) if you wish to make a privacy complaint against us, or if you are not satisfied with how we have handled your complaint.

The Australian Information Commissioner is the statutory office-holder responsible for the regulation of privacy laws in Australia in accordance with the Privacy Act. The OAIC website contains more information about the Privacy Act, including the APPs, and information about how to make a privacy complaint.

Please note that the OAIC generally requires that a complaint first be raised with us before they will investigate the complaint.

9. Who is responsible for this policy?

Our Privacy Contact Officer is responsible for this policy and can help with queries about:

  • how your personal information is collected, held, used or disclosed
  • this Privacy Policy
  • how to obtain access to or seek correction of your personal information
You can contact our Privacy Contact Officer through the following:

Phone: (02) 6289 1555 or freecall 1800 020 103
Online: The online enquiries form at www.health.gov.au
Email: enquiries@health.gov.au
Post: Department of Health
    GPO Box 9848
    CANBERRA ACT 2601

10. Privacy Policy updates

This Privacy Policy will be reviewed regularly and updated as required. This Privacy document is current as at the date specified at the start of this document.

11. Availability of this policy

If you wish to access this Privacy Policy in an alternative format (e.g. hard copy) please contact our Privacy Officer using the contact details provided at Part 9 - Who is responsible for this policy? of this Privacy Policy.

This Privacy Policy is available free of charge.

The Department of Health’s Privacy Policy can be found on the Department’s website.

Appendix A

National Cancer Screening Register

Types of information collected and purposes of collection, use and disclosure

Table 1 - Purposes of collection of individuals’ information

Type of information collected

Data source

Purpose of collection

Your name, address, contact details, date of birth, sex, gender and your healthcare provider

DHS

From you or your personal representative

Your healthcare provider; includes pathology providers and specialists

State and territory governments (e.g. cancer registers and databases)

Ongoing

Verify your participant details to enable data matching

Provide you (or your personal representative) access to the Register so you can update your contact and demographic details directly into the Register, or tell us your preferred method of receiving communication from the Register. For more information on personal representative, refer to Part 3 - Collection, use and disclosure of personal information.

Invite you to cervical screening

Identify if and when you might need a screening test and to invite you to screen, or to determine whether you should not be invited to screen

Send you a reminder for cervical screening

Communicate with your healthcare provider or nominated healthcare provider (if you have one) if follow up action is required as a result of a cervical screening test

Encourage you through your healthcare provider to participate in cervical screening

Collect information from state and territory cancer screening registers/database to exclude people with cancer from being sent screening invitations and other correspondence

Keep a database of records relating to cervical screening and diagnoses

State and territory cervical screening  registers

Initial data migration

Migrate your information to build the Register.

Medicare number

DHS

Ongoing

Verify your participant details to enable data matching

Identify if and when you might need a screening test and to invite you to screen or re-screen, or to determine whether you should not be invited to screen

Keep a database of records relating to cervical screening and diagnoses

State and territory cervical screening

Initial data migration

Migrate your information to build the Register

Medicare enrolment data, including demographic information

DHS

Ongoing

Verify your participant details, including contact information, to enable data matching

Identify if and when you might need a screening test and to invite you to screen or re-screen, or to determine whether you should not be invited to screen

Keep a database of records relating to cervical screening and diagnoses

Medicare claims information, e.g. to determine whether you have undertaken a procedure relating to cervical screening

DHS

Ongoing

Verify your participant details to enable data matching

Identify if and when you might need a screening test and to invite you to screen or re-screen, or to determine whether you should not be invited to screen

Send you a reminder for cervical screening

Assist with follow up of abnormalities detected in your screening test result

Keep a database of records relating to cervical screening and diagnoses

Screening test results

Your healthcare provider or specialist (e.g. colposcopist)

Pathology providers

Ongoing

Record your clinical history to help support clinical decision making, including maintaining up-to-date information about your screening activity and status to ensure progression along the clinical pathway

Advise your healthcare provider when you are due to undergo cervical screening, or when follow up action may be needed after you have undergone cervical screening

Send you a reminder for cervical screening

Collect, analyse and publish statistics and other information about cervical screening (de-identified data only)

Monitor the effectiveness, quality and safety of cervical screening

Plan, deliver and promote healthcare and services relating to cervical screening

Keep a database of records relating to cervical screening and diagnoses

State and territory cervical screening registers

Initial data migration

Migrate your information to build the Register

Diagnosis of cervical cancer or precursor to cervical cancer

Your healthcare provider or specialist (e.g. colposcopist)

Pathology providers

Ongoing

Record your clinical history to help support clinical decision making, including maintaining up-to-date information about your screening activity and status to ensure progression along the clinical pathway

Advise your healthcare provider when follow up action may be needed after you have undergone cervical screening

Collect, analyse and publish statistics and other information about cervical screening (de-identified data only)

Monitor the effectiveness, quality and safety of cervical screening

Plan, deliver and promote healthcare and services relating to cervical screening

Keep a database of records relating to cervical screening and diagnoses

State and territory cervical screening registers

Initial data migration

Migrate your information to build the Register

Human papillomavirus (HPV) vaccination status (if applicable), including doses of the vaccine administered

National HPV Vaccination Program Register

Monitor the effectiveness, quality and safety of the National HPV Vaccination Program in reducing the incidence of cervical abnormalities and cervical cancer

Collect, analyse and publish statistics and other information about cervical screening (de-identified data only)

Monitor the effectiveness, quality and safety of cervical screening

Keep a database of records relating to cervical screening and diagnoses

Healthcare identifier

Healthcare Identifiers Service Operator

Verify your participant details to enable data matching

Department of Veterans’ Affairs (DVA) number

DHS

DVA

Ongoing

Verify your participant details, including up-to-date contact information, to enable data matching

Identify if and when you might need a screening test and to invite you to screen or re-screen, or to determine whether you should not be invited to screen

Keep a database of records relating to cervical screening and diagnoses

Indigenous status

DHS

From you or your personal representative

From your healthcare provider or specialist (colposcopist)

Pathology providers

Ongoing

Allow accurate measurement of screening participation rates and help the government develop programs that address the barriers to screening participation

Identify the Indigenous status of people accessing health services to help Close the Gap in health outcomes between Indigenous and non-Indigenous Australians (de-identified data)

Collect, analyse and publish statistics and other information about cervical screening (de-identified data only)

Plan, deliver and promote healthcare and services relating to cervical screening

Keep a database of records relating to cervical screening and diagnoses

State and territory cervical screening registers

Initial data migration

Migrate your information to build the Register

Your country of origin and/or your cultural identity, including if you speak another language at home or your preferred language

DHS

From you or your personal representative

From your healthcare provider or specialist (e.g. colposcopist)

Pathology providers

Ongoing

Assist service providers to identify if you require an interpreter or a personal representative when accessing screening services

Allow accurate measurement of screening participation rates and help the government develop programs that address the barriers to screening participation

Collect, analyse and publish statistics and other information about cervical screening (de-identified data only)

Plan, deliver and promote healthcare and services relating to cervical screening

Keep a database of records relating to cervical screening and diagnoses

State and territory cervical screening registers

Initial data migration

Migrate your information to build the Register

If you require an interpreter or assistance to manage medical conditions or disabilities.

From your healthcare provider or specialist (e.g. colposcopist)

Ongoing

Facilitate communication with you through your interpreter

Identify any assistance you may require because of a medical condition or disability

Keep a database of records relating to cervical cancer screening and diagnoses

State and territory cervical screening registers

Initial data migration

Migrate your information to build the Register

Details of your personal representative

 

From you or your personal representative

Ongoing

Communicate with your personal representative in relation to the register.  For more information on personal representative, refer to Part 3 - Collection, use and disclosure of personal information.

 

State and territory cervical screening registers

Initial data migration

Migrate your information to build the Register

Date of death

DHS

Personal representative

 

Verify participant details

Ensure correspondence relating to cervical screening are no longer sent

Collect, analyse and publish statistics and other information about cervical screening (de-identified data only)

Keep a database of records relating to cervical screening and diagnoses

State and territory cervical screening registers

Initial data migration

Migrate your information to build the Register

Requests about your participation in the Register

Withdrawal of a previous request about your participation in the Register

From you or your personal representative

Enable us to record and action your request about participation in the Register. For more information on ways in which you can manage your participation in the Register, refer to Part 4 - Your participation in the Register.

Record your nominated healthcare provider

Determine whether you should not be sent any correspondence or invited to screen for a period of time or not at all

Determine whether to include your screening test results in the Register

Defer or change a date you are due to undergo a screening test

Enable us to use a pseudonym if requested

Determine whether you have withdrawn a request made previously regarding your participation in the Register

Keep a database of records relating to cervical screening and diagnoses

Table 2 – Healthcare providers

Type of information collected

Data source

Purpose of collection, use and disclosure

Your name, address (including practice address), contact details and provider directory data

Individual

Other healthcare providers

DHS

National Health Service Directory

NASH Directory

Endpoint Locator Service

Ongoing

Verify your healthcare provider details to enable data matching

Record you as an individual’s nominated healthcare provider, if applicable

Communicate with you to advise if your patient may need to undergo cervical screening, or when follow up is required as a result of a cervical screening test

Provide advice if your patient has a positive result to enable referral or further examination and to support clinical decision making

Communicate with States and Territories when follow up is required in relation to your patient as a result of a cervical screening test

To record you as a program participant’s nominated healthcare provider

State and territory cervical screening registers

Initial data migration

Migrate your information to build the Register

Healthcare identifier (individual healthcare provider identifier or healthcare provider identifier for organisations)

Healthcare Identifiers Service Operator

Verify your healthcare provider details when you interact with the Register

Table 3 – Types of information disclosed and purposes of disclosure and use by recipient

Type of information used and disclosed

To whom

Purpose of disclosure and use by recipient

Your name, address, contact details, date of birth, sex, gender

Medicare number

Medicare enrolment data, including demographic information

Medicare claims information, e.g. to determine whether you have undertaken a procedure relating to cervical screening

Screening test results

Diagnosis of cervical cancer or precursor to cervical cancer

HPV vaccination status (if applicable), including doses of the vaccine administered*

Healthcare identifiers (individual healthcare identifiers and healthcare provider identifiers)

Healthcare provider details

DVA number

Indigenous status

Your country of origin, your cultural identity, and if you speak another language at home or your preferred language

If you require an interpreter, or assistance to manage medical conditions or disabilities

Details of your personal representative

Requests about your participation in the Register

Withdrawal of a previous request about your participation in the Register

Date of death

You, your personal representative

 

 

 

Your healthcare provider; includes pathology providers

 

 

 

 

 

 

 

 

State and territory authorities or state and territory governments that are participating in the Register

 

 

 

 

 

 

Researchers

 

 

AIHW

 

Governance committees

Provide you as a participant with invitations to undergo screening reminders and follow up services, access to your personal information and cervical screening information

Enable you to manage your participation in the Register

 

Provide your healthcare provider access to your clinical information relating to cervical cancer screening to enable clinical assessment, referral for further examination if you have a positive result and support clinical management

Assist your healthcare provider to discuss screening with you and to manage your participation in screening

Support decisions about clinical recommendations to the test referrer

Provide quality feedback loop for individual healthcare providers

Support pathology providers with laboratory quality assurance activities (pathology providers only)

 

Provide the Health department or agency in the state or territory where you reside (and move to if you relocate) access to your information relating to cervical screening

Share with states and territories to:

  • enable local program policy and service planning, monitoring and evaluation and
  • implement strategies to increase screening participation, access to follow up services and maximise access of under-screened and never-screened groups

For research to support cervical screening research, or other relevant research for public health purposes.  Research subject to meeting the requirements of the National Cancer Screening Register Act 2016.

Enable screening program monitoring, analysis and evaluation

Enable screening program monitoring, analysis and evaluation

* HPV vaccination information – for monitoring and evaluation of effectiveness of HPV vaccine. Share with states and territories for reporting, health service and program promotion activities.

In this section