CBHS HEALTH FUND LIMITED PRIVACY POLICY

Transcription

1 1. Policy Statement CBHS Health Fund Limited ABN (CBHS) is committed to maintaining the privacy of individuals whose information we collect in accordance with the Australian Privacy Principles set out in the Privacy Act 1988 (Cth) and other applicable privacy legislation including the Health Records and Information Privacy Act 2002 (NSW). This Privacy Policy explains how CBHS manages the personal and health information (personal information) that we collect, use and disclose. CBHS can be contacted if you have any questions about the management of your personal information or would like to access or correct the personal information we hold about you. In this Privacy Policy, "we" and "us" refers to CBHS and "you" refers to any individual about whom we collect personal information. 2. What sort of personal information does CBHS collect and hold? Members and prospective members The personal information collected and held by CBHS about you depends on your interactions with CBHS (including whether you are an existing or former member of CBHS; a prospective member of CBHS; or have only made enquiries about CBHS' products and services). The personal information that CBHS collects and holds about you may include: your name, address and contact details; your date of birth, gender and marital status; information about your family members and domestic relationships (including your relationship to any person insured or proposed to be insured under the same policy as you); your employer and/or details of your connection, or a family member's connection, to the CBA Group (including a CBA Group staff number) for the purpose of assessing your eligibility to be a member of CBHS; your relationship to other persons insured by CBHS (where this is relevant to assessing your eligibility to be a member of CBHS). If you have, have previously had, or have applied for private health insurance with CBHS, CBHS may collect and hold additional personal information about you including: your bank account details, credit card details and other payment information; the type of insurance cover you have or have previously had (whether with CBHS or any other private health insurer); your Medicare number; your income and other information relevant to your eligibility for government rebates and incentives for private health insurance; health information (including information concerning health services you have received, the provider and relevant dates for services); your eligibility for benefits from the Department of Veterans Affairs; Public Document 1 Last Updated May 2016

2 your claims history; your interactions with CBHS (including call logs and recordings); and information regarding products and services that you enquire about or purchase from CBHS. We do not use your Medicare number (or other government identifiers) to identify you. Certain information which CBHS may collect about you is "sensitive information" for the purposes of the Privacy Act. This includes health information, such as your medical history and information about medical procedures, hospital attendances and allied health treatment you may have received. Prospective employees/applicants We collect personal information when recruiting personnel, such as your name, contact details, qualifications and work history (this may include prospective employees and contractors as well as individuals who have nominated as a director of CBHS). Generally, we will collect this information directly from you or from information about you that is publicly available, for example, from public registers or social media. We may also collect personal information from third parties in ways which you would expect or are specifically advised of (for example, from recruitment agencies or referees you have nominated). Before offering you a position, we may collect additional details such as your tax file number and superannuation information. This Privacy Policy does not apply to CBHS' employee records. Such information is protected under internal CBHS policies namely the Ethics and Clean Desk Policies. It is also incumbent on all employees when they join CBHS to observe confidentiality of information as expressed in contracts of employment. Other individuals CBHS may collect personal information about other individuals who are not members of CBHS. This includes individual service providers and contractors to CBHS; other individuals who interact with CBHS on a commercial basis; and healthcare professionals who provide services to our members. The kinds of personal information we collect will depend on the capacity in which you are dealing with CBHS. Generally, it would include your name, contact details, professional details and information regarding our interactions and transactions with you. Visitors to our website The way in which we handle the personal information of visitors to our website is discussed below under the heading "How is personal information handled when using the CBHS website?" 3. How does CBHS collect personal information? CBHS collects your personal information in a number of different ways. Where possible, CBHS collects your personal information directly from you. For example, CBHS may collect personal information from you: in person when you visit a CBHS Office; when you interact with us by phone or ; when you provide information in writing (such as by completing CBHS forms); via the CBHS website or via online or mobile member services. Where possible, we collect your personal information directly from you. However, there are a number of circumstances where we collect information about you from other sources. Public Document 2 Last Updated May 2016

3 If you are insured under a policy that insures more than one person (e.g. a 'family' or 'couples' policy) we may collect your personal information (including sensitive information) from another person covered by the policy or from a person authorised to provide this information on your behalf. If you provide CBHS with information about another person covered under the same policy as you (for example, your spouse or partner or a dependant capable of making decisions in relation to personal information), you must first obtain their consent to do so. Where you receive health services or make a claim, we may collect information about those services directly from the health services provider (e.g. a hospital, medical or allied health provider) or from Medicare. If you were previously a member of another private health insurer, we may collect personal information about you from that other private health insurer (for example, information relevant to waiting periods or to request a transfer certificate). As a restricted access private health insurer serving employees of the CBA Group, CBHS collects limited personal information (for example, basic contact details) of persons eligible to be insured by CBHS directly from the CBA Group in order to inform eligible persons of the availability of CBHS' products and services. CBHS may also collect your personal information from third parties, such as online comparison sites (including Compare the Market and iselect), business affiliates, business partners or from member referrals. 4. How does CBHS hold personal information and for how long? Your personal information is stored primarily in electronic form in CBHS' information technology systems. Information stored in CBHS' information technology systems is stored locally at our premises. Copies of your personal information may be made and stored in a remote, secure location in Australia. Such copies are used to meet legal, regulatory and business continuity needs. Certain information is collected and held in paper-based documents, which is converted to electronic form and the original paper-based documents securely destroyed. Information which is temporarily retained in paper-based form is held securely at our premises or by third party mail processing facilities in Australia. We maintain physical security over our paper and electronic data stores (such security systems at our premises). We also maintain computer and network security. For example, we use firewalls and other security systems such as user identifiers and passwords to control access to our information technology systems. Where CBHS no longer needs your personal information, and retention is not required by law, CBHS will take all reasonable and practical steps to destroy or de-identify your personal information in a secure manner in accordance with our document retention policy. 5. Can you deal with CBHS anonymously or by using a pseudonym? You have the option of not identifying yourself, or using a pseudonym, when dealing with CBHS (for example, when making a general enquiry). However, it is usually not practicable for CBHS to deal with you anonymously or using a pseudonym on an ongoing basis (for example, as a policy holder). If we do not collect personal information about you, we may be unable provide you with goods and services (including private health insurance cover). Public Document 3 Last Updated May 2016

4 6. What are the purposes for which CBHS collects, holds, uses and discloses your personal information? Products and Services CBHS collects, holds, uses and discloses personal information (including sensitive information) in order to provide, administer and market its products and services. This includes: determining your eligibility for membership with CBHS; administering and processing health insurance claims and payments; administering waiting periods for benefits; collecting and processing contributions and premiums; responding to eligibility checks from hospitals and other medical providers; managing, evaluating, developing and improving CBHS' insurance products and related health services; conducting quality assurance activities; providing or arranging for associated services to be provided such as dental services, eye care services, allied services such as physiotherapy or other insurance or health related services; conducting health management programs, chronic disease management programs and services that may help you improve your health and wellbeing; administering government rebate and incentive programs; complying with laws and regulations; resolving any legal and/or commercial complaints or issues; conducting member surveys, research, analysis and providing online member services; and marketing activities including the use of service providers such as Facebook and Google to communicate with you and the public about our products and services. Specialised Health Programs CBHS develops specialised health programs and initiatives (with the assistance of third parties) from time to time. These programs are designed to assist members with day to day health and wellbeing issues such as diet and exercise as well as management of illness and disease. CBHS may use sensitive information to identify whether you are suitable for those specialised health programs. For example, CBHS may use health information to identify whether you are a suitable candidate for a chronic disease management program offered, or made available, by CBHS. We will seek your consent to participate in such programs. You are not obliged to join any of these programs, but if you choose to do so, CBHS may use personal and sensitive information previously collected from you so that you get the most benefit from these programs. You may, at any time, opt-out of the opportunity to participate in any health management program, chronic disease management program, hospital-substitute treatment program or similar program (including opting-out from being contacted by a third party provider) by contacting CBHS using the contact details set out below. 7. How does CBHS disclose personal information? CBHS will only disclose your personal information in order to provide and administer its products and services. CBHS will not sell or rent your personal information to any third party. Public Document 4 Last Updated May 2016

5 The types of organisations to whom your personal information may be disclosed include: hospitals and health service providers from whom you have sought, or from whom you intend to seek, treatment; providers of specialised health programs (for example, providers who offer health management and chronic disease management programs on behalf of CBHS); organisations who provide contracted services to CBHS including processing of incoming paper mail (where forms and correspondence are sorted and scanned into electronic records) and third-party mailing, and SMS services; government agencies (such as the Australian Tax Office, Medicare Australia, the Australian Prudential Regulation Authority, the Private Health Insurance Ombudsman and the Department of Health); other private health insurers, when you transfer to or from another private health insurer; third party advisers and service providers to CBHS (such as auditors, actuaries, consultants and legal advisers). Family or Couples Health Cover If you are insured under a private health insurance policy which covers more than one person (e.g. a 'family' or 'couples' policy), you should make yourself aware of the privacy settings applicable to your policy. Information concerning health services received, claims made and benefits paid ('claims history') in respect of each person insured under the same policy is accessible to the policy holder, except where the insured person has notified CBHS by phone or in writing that he or she requires a particular claim to be marked as "private". CBHS may, in its discretion, decline to disclose the claims history of a person insured under the same policy where it cannot be satisfied that such disclosure reflects the current intention of the insured person. In that circumstance, CBHS may seek clarification from the insured person. It is important to consider the privacy settings applicable to your policy where there are changes in the relationships amongst persons insured under the policy (for example, as children and young people mature or if partners separate). In that circumstance, you should contact CBHS to discuss the privacy settings applicable to your policy or discuss whether different insurance arrangements are appropriate to your circumstances. 8. Is my personal information used or disclosed for direct marketing? CBHS may contact you from time-to-time to provide you with information about products and services we offer. We may contact you via mail, , phone or SMS. You may request at any time not to receive direct marketing communications from CBHS by completing an unsubscribe request online, by contacting CBHS at help@cbhs.com.au or by calling CBHS will give effect to the request as soon as reasonably practicable and, in any case, within 30 days of the request being made to CBHS. CBHS will not use or disclose sensitive information about you for the purpose of direct marketing without your consent. Public Document 5 Last Updated May 2016

6 9. How is personal information handled when using the CBHS website? The CBHS website (and related online services, including the Member Service Centre) use 'cookies'. A 'cookie' is a packet of information that allows the website server to identify and interact more effectively with your computer. When you use the website, we send a cookie that gives each computer a unique identification number. Cookies do not identify individuals, although they do enable us to identify your browser type and internet service provider. Your browser may be configured to accept all cookies, reject all cookies or notify the user when a cookie is sent. If you reject all cookies, you may not be able to use the CBHS website or the Member Service Centre. CBHS uses third-party service providers such as Google to undertake demographic analysis of visitors to our website ('Google Analytics'). We collect and use information from cookies and Google Analytics to: better understand how visitors use the CBHS website; link with social networks; serve relevant advertisements that may be of interest; measure the time spent on the website; determine the effectiveness of the navigation options; and record information provided during the visit to streamline subsequent visits. By using this website, you consent to the processing of data about you by Google in the manner described in Google's Privacy Policy and for the purposes set out above. You can opt out of Google Analytics if you disable or refuse the cookie, disable JavaScript, or use the opt-out service provided by Google. CBHS also uses interfaces with social media sites such as Facebook. If you choose to "like" or "share" information from this website through these services, you should review the privacy policy of that service. If you are a member of a social media site, the interfaces may allow the social media site to connect your visits to this site with other personal information 10. How can you can access and correct personal information? You may request access to your personal information at any time. The contact details for CBHS are set out below. CBHS will respond to an access request as soon as practicable and, in any case, within 30 days of the request being made to CBHS. In limited circumstances, we may decline your request to access your personal information in accordance with the Privacy Act. If we do so, we will tell you the reason when we respond to your access request. CBHS will take reasonable steps to ensure that personal information it collects, uses or discloses is accurate, complete, up-to-date and relevant. You can help us do this by keeping us updated about changes to your personal information (such as changes to your contact details) and letting us know if information we hold about you is not accurate or up-to-date. If you believe personal information CBHS holds about you is inaccurate, out-of-date, incomplete, irrelevant or misleading, you may request that we correct your personal information at any time. If we decline to make your requested correction, you may request CBHS associate a statement with your personal information in relation to the requested correction. Public Document 6 Last Updated May 2016

7 In some circumstances, CBHS may charge a fee to cover administrative costs in respect of retrieving your personal information and providing it to you. CBHS will inform you if there are going to be any such costs involved in retrieving your personal information. We will not charge you to make a request to access your personal information. 11. Does CBHS disclose information outside of Australia? CBHS does not typically or routinely disclose personal information to overseas recipients. Unless we have your consent, or an exception under the Australian Privacy Principles applies, we will only disclose your personal information to overseas recipients where we have taken reasonable steps to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to your personal information. 12. How can I make a complaint about privacy? You may contact CBHS via the contact details set out below at any time if you have any questions or concerns about this Privacy Policy or how your personal information has been handled. CBHS views complaints as an opportunity to maintain and enhance member loyalty and approval and to enhance its competitiveness by continuous review and improvement. CBHS has a Member Complaint Handling and Dispute Resolution Policy in place for handling the complaints it receives. A copy of this policy is available to members at You may make a complaint about privacy by contacting the CBHS Privacy Officer using the contact details below. The complaint should first be made in writing. The CBHS Privacy Officer will first consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint. If your complaint requires more detailed consideration or investigation, we may ask you to provide further information about your complaint and the outcome you are seeking. We will then typically gather relevant facts, locate and review relevant documents and speak with individuals involved. CBHS will respond as soon as reasonably practicable and, in any case, within 30 days. In the event that you are not satisfied by CBHS response to your complaint, you may take the complaint to the Private Health Insurance Ombudsman ( PHIO ). PHIO can be contacted by telephone on or a member can complete the Online Complaint Form or write to: Address: phio.info@ombudsman.gov.au Commonwealth Ombudsman GPO Box 442 Canberra ACT 2601 See Public Document 7 Last Updated May 2016

8 You may also make a complaint about privacy to the Office of the Australian Information Commissioner ("OAIC"). OAIC can be contacted by telephone on or a member can write to: Address: enquiries@oaic.gov.au The Office of the Australian Information Commissioner GPO Box 5218 Sydney NSW 2001 See also the OAIC privacy complaint brochure for further details: How are changes to this Privacy Policy made? CBHS may update this Privacy Policy from time to time. CBHS will notify members of such changes by posting an updated version of this Privacy Policy on its website at A free printed copy of this Privacy Policy is available upon request. 14. How can you contact CBHS? CBHS can be contacted using the following contact details: Address: privacy@cbhs.com.au Privacy Officer CBHS Health Fund Limited Locked Bag 5014 Parramatta NSW 2153 Phone: Fax: (02) Public Document 8 Last Updated May 2016