Security, breaches and the NDB scheme

General information, not legal advice. Reviewed by: pending

This page summarises the Australian Privacy Principles on quality, security, access and correction, and the Notifiable Data Breaches scheme, for practices using Refera. It has not yet been reviewed by a lawyer. Refera’s incident timings below are proposals awaiting counsel and practice approval.

Who this page is for: the practice owner or manager who would lead the response if referral information were ever exposed.

APP 10: keep it accurate

Take reasonable steps to keep the information you collect, use and disclose accurate, up to date and complete.

• Refera shows each extracted detail beside the letter’s own words, so staff can check it before marking a referral ready or copying it into the practice system.
• Details Refera cannot find are shown as missing, never guessed.

APP 11: keep it secure, and dispose of it properly

Take reasonable steps to protect information from misuse, interference, loss and unauthorised access, change or disclosure, and destroy or de-identify it when it is no longer needed, unless a law requires you to keep it. State and territory health-records laws can require a practice to keep health records for a minimum period; see Breaches and state law.

• Sign-in: a passkey or an authenticator code at every sign-in, a one-hour idle lock and a 12-hour session limit. See Signing in.
• Access: read-only access to each Microsoft 365 inbox the practice connects, one folder per mailbox; each person has their own account and role.
• Storage: encrypted in transit and at rest in AWS Sydney, with each practice’s data partitioned, server-held keys for the sealed history and no patient content in logs.
• Disposal, honestly stated: closing an account today revokes access and preserves the records. A reviewed deletion and de-identification process, with backup-retention evidence, must be in place before live capture begins.

APP 12: give patients access

Patients ask the practice, not Refera. Refera helps the practice find, read and export the referral information it holds; structured export is free at any time.

APP 13: correct it

Correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. In Refera, a correction is recorded as a new entry with the earlier value kept in the history, never quietly rewritten.

The Notifiable Data Breaches scheme

An eligible data breach is unauthorised access to, unauthorised disclosure of, or loss of personal information that is likely to result in serious harm to someone, where remedial action has not removed that likely harm. Health information is one of the kinds of information more likely to cause serious harm if it is exposed.

• Assess quickly. If you suspect an eligible data breach, make a reasonable and expeditious assessment, and take reasonable steps to finish it within 30 days.
• Notify. If it is an eligible data breach, notify the Office of the Australian Information Commissioner and the people at risk as soon as practicable.
• One notice can cover both. Where the practice and Refera both hold the information, one notification can satisfy both parties’ duties. The practice ordinarily speaks to patients, because it has the relationship, with Refera’s evidence and support.

If something goes wrong

What Refera does. Under its draft breach response plan, Refera would contain the incident, preserve evidence and work out what information and people are affected. The proposed target is initial notice to an affected practice within 24 hours of Refera becoming aware of a suspected incident affecting that practice’s data, then regular updates. Counsel and the practice approve the final deadline in the data processing agreement.

What your practice does.

1. Tell Refera straight away about a suspected misdirected email, unauthorised access or a lost or compromised device or account. Email [email protected] with the subject Security and no patient details; Refera moves follow-up to a restricted channel.
2. Remove access for anyone who should no longer have it.
3. Follow your own breach response plan, including who decides on patient-care impact.
4. Keep a record of what you knew, when, and what you decided.

Related

• Breaches and state law - state health-records law and My Health Record.
• Handling health information: what your practice must do
• What Refera does and doesn’t do with your data
• Security posture

Administrative process-state only - Refera performs no clinical triage.