Privacy policy

We collect information about patients we provide services to, and referrers we work with, so that we can provide a high-quality medical imaging service. The information we collect provides valuable insight into a patient’s health status and allows our personnel to provide the best possible treatment or diagnosis from the imaging performed.

This privacy statement explains how we manage the health information we collect about people, including our patients and referrers, in order to meet our mission of providing quality imaging services of a consistently high standard in a caring and professional environment. We take a patient-focused approach to delivering services and to managing personal and health information. We are committed to ensuring that we use and share it in accordance with the law and the expectations of our patients and referrers.

We may update this privacy notice from time to time, to reflect changes to privacy law or our practice operations. 

We need to collect and create personal and health information about patients, referrers, and other individuals so we can deliver health services and manage our practice.

You have a choice about whether you provide us with the information we request, but we may not be able to properly provide you with the services you require and/or facilitate payment without the necessary information.

If you have any concerns about providing us with certain information, talk to us about it, we can help you understand why we are requesting it.

We may collect information from you either directly, or from others.

Patients – how we collect your information 

We collect health information from you directly, when you interact with us during consultations, or contact us through our website. We receive health information about you from your healthcare provider when they refer you to us for imaging services. We may also collect health information about you from other third parties, such as your family, your authorised representative, other healthcare providers or insurers, and will seek your authorisation where necessary. 

Referrers – how we collect your information 

We collect personal referrer information from you as part of establishing our professional relationship with you, and then on an ongoing basis when you provide referrals and receive images and reports. We mostly collect this information from you directly but may also collect information from third parties such as your practice manager or professional body.

Patients – the information we collect or create about you

We may collect the following information about you:

• General information – your name, contact details, NHI number, date of birth, gender, ethnicity and residency status, information about your carer/guardian/support person (where relevant), appointment preferences, insurance, or ACC claim identifiers.
• Other provider information – your primary healthcare provider, your referrer, other health professionals involved in your care, your health insurer or funder (where appropriate).
• Relevant medical history – including medical conditions, weight, height, allergies, medications, surgical notes, consultation notes, previous images, or other diagnostics tests (such as blood test results).

Health information we create about you: 

• Ultrasounds and other imaging scans and accompanying notes.
• Interaction information – communications with you (including any feedback you give us), your healthcare provider/referrer or your family.
• Payment information – invoices, payment records and details.

Referrers – the information we collect or create about you

We may collect or create the following information about you:

• General information – your name, contact details, qualification information, professional registration number, HealthLink details, details of the practice you work at (where relevant).
• Clinical information – information about your treatment of the patients you refer to us, for reporting purposes.
• Interaction information – communications with you (including any feedback you give us).
• Payment information – bank account and related billing information.

We will only use or share personal and health information as appropriate and in accordance with privacy laws.

Patients – how we use and share your information

As a patient, we use and sometimes share the health information we hold about you to meet our goal of delivering high quality imaging services. We make sure that your information is used and shared only in ways that support this outcome. Where we need to use your information for wider purposes, such as medical research or statistical analysis, we anonymise it first. 

We will use your health information to:

• Understand your needs, so we can deliver the right services in a safe way;
• Assess the urgency of appointments;
• Diagnose and treat medical conditions, including administering medications;
• Report back to your referring healthcare provider;
• Contact you about your care and treatment;
• Respond to any concerns you raise about our services;
• Work with ACC or your health insurer to manage claim approval and payment, including debt recovery action where necessary;
• Meet our legislative reporting obligations, including to the Ministry of Health;
• Conduct medical research and statistical analysis (with anonymised information).

Referrers – how we use and share your information

• We may disclose information about you to your patients or colleagues (for example, to your accounts department for the purpose of facilitating payment). If required, or permitted by law, we may also share information about you with third parties such as your professional body, the Medical Council of NZ, the Police and/or the Health and Disability Commissioner.

The health system depends on responsible and legitimate sharing of health information to ensure that health providers have the information they need to provide the right care and treatment to their patients.

Patients – when we share your information

We may disclose health information about you to:

• The healthcare provider who referred you to us. If you have self-referred, we will send your imaging results to your nominated GP or healthcare specialist ;
• Other healthcare providers with a legitimate role in your ongoing care, such as other specialists, laboratories, or Te Whatu Ora;
• Your carer, guardian, authorised representative or family/whānau, where you have authorised this or in accordance with the law or accepted medical practice;
• Your health insurer, where you have authorised this as part of your insurance claim process (including applying for prior approval if you are a Southern Cross member);
• Your Primary Health Organisation to facilitate payment and for reporting purposes;
• ACC (or your employer if it is an ACC accredited employer) where your treatment is provided as part of an ACC claim;
• The Ministry of Health or other health agencies as part of statistical reporting or health research activities, in aggregated and anonymised format;
• Breast Screen Aotearoa and/or its local provider where you have participated in its free breast screening programme;
• Our trusted service providers, including data storage providers;
• Government, regulatory or law enforcement agencies (where required or permitted by law (such as Police, Oranga Tamariki and the Health and Disability Commissioner);
• Other third parties where you have given us your permission to do so.

Referrers – when we share your information

We use your information to manage our relationship with you, to support the services we provide to patients, and facilitate payment. We may also use your information to manage complaints or concerns from patients about you or us, for example, if we need to respond to a complaint from the Health and Disability Commissioner.

We are required by law to retain patient health information for at least 10 years from the date we last provide imaging or other health services to you. We retain other personal information, such as referrers, for as long as we have a valid reason to do so.

We store all the health information we hold, including images, on secure data storage platforms, which are hosted both in New Zealand and other countries. Some data is stored using Amazon Web Services (AWS) cloud storage. All data sent to and from AWS is encrypted during transmission and when it is stored. Documents uploaded via Online Appointments are stored temporarily in AWS for the purpose of being virus scanned and uploaded to our information systems. All related paper records we collect or create are scanned and uploaded to this secure platform. In addition, we keep these paper records for a period of time in secure offsite and/or onsite storage.

We take all reasonable steps to protect the personal and health information we hold from loss, misuse or unauthorised access, modification, or disclosure. Access to health information is managed through individual login credentials and audited for appropriate access.

One of the ways we share health information with healthcare providers involved in your care is by providing them with access to the secure online system where we store images. We require each healthcare provider to sign a confidentiality agreement before providing access, and we audit this access on a regular basis.

If you have any concerns about your referring or treating healthcare provider having access to your images via this online system, please contact us and we will remove your images from this system. Please be aware that doing so means that in the event of an emergency, or a referral on to a different healthcare provider, your images will not be available to them via this online system.

You have important rights in relation to your information, and we respect these. You have the right to ask us for a copy of the information we hold about you, or to ask us to correct it if you think it is wrong. We will need to verify your identity before releasing or correcting your information. If you ask someone (like your carer or a family member) to make a request on your behalf, we will need to see written authorisation from you, and we may give you a call to check if we are unsure. Please understand that all these steps are intended to protect your privacy.

We will always seek to be open with you about the personal and health information we hold about you, particularly if we have created it. Sometimes we may hold health information about you that we received from, or created on behalf of, another healthcare provider or agency. If we think that this other healthcare provider or agency would be better placed to manage your request, we may transfer your request to them. If we need to do this, we will tell you as soon as possible.

To make a privacy request, update your information, or tell us about any concerns, please contact us at privacy@rhcnz.com, or make contact directly with the clinic that you last attended.

If you have any concerns about the way we have collected, used, or shared your health information, or you think we have refused a request for information without a good reason, please let us know at privacy@rhcnz.com and we will try our best to resolve them.

If we cannot resolve your concerns to your satisfaction, you can also make a complaint to the Office of the Privacy Commissioner by:

• Completing an online complaint form at www.privacy.org.nz
• Writing to the Office of the Privacy Commissioner, PO Box 10-094, The Terrace, Wellington 6143