1. About this policy

ACA Health Benefits Fund Limited (ACA Health) is committed to maintaining the privacy of individuals whose personal information it collects in accordance with the Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth) (the Privacy Act). The APPs govern the way in which ACA Health collect, use, disclose, store, secure and dispose personal information.

A copy of this policy may be obtained from ACA Health’s website. If you require a copy of this privacy policy in another form, you may contact ACA Health at any time. ACA Health’s contact details are set out below.

2. What kind of personal information is collected and held by ACA Health?

The kind and extent of personal information collected and held about you depends on your relationship with ACA Health, including whether you are a current or former member, a person insured under a policy, an applicant, an eligible prospective member, a claimant, a provider, a supplier contact, an employee or a person making and enquiry or complaint.

The personal information ACA Health collects and holds about you may include:

• your name, address, contact details, date of birth, gender and relationship or family details
• your employer or eligibility information relevant to ACA Health’s restricted-access membership rules
• policy, membership, cover, contribution, rebate, levy, waiting-period and transfer-certificate information
• bank account, payment and limited credit-card information required to administer contributions or payments
• Medicare, concession-card, government-rebate and other government-related identifier information where lawfully required
• health information, treatment details, provider information, claims, benefits and complaints
• records of communications and interactions with ACA Health
• website, device, security and system log information where relevant to service delivery, security or compliance
• employment, contractor, director, supplier and professional information where relevant to ACA Health operations

Health information and some other categories are sensitive information under the Privacy Act and receive additional protection.

3. How does ACA Health collect and hold personal information?

3.1 Collection

Where practicable, ACA Health collects personal information directly from you including through applications, claims, enquiries, telephone calls, email, websites, forms and interactions with staff.

ACA Health may also collect information from:

• another person insured under the same policy, where authorised or reasonably necessary;
• a former or receiving private health insurer, including through transfer certificates;
• hospitals, medical and allied health providers and claims intermediaries;
• employers or participating organisations for restricted-access eligibility and communications;
• government bodies, regulators and agencies;
• service providers, advisers, brokers, auditors and other authorised sources;
• publicly available sources where lawful and appropriate.

If you provide us with personal information about another person, you should ensure that you are authorised to do so and, where practicable, let that person know of this policy and why we are collecting their information.

3.2 Holding and data locations

Your personal information may be held in electronic systems, secure cloud or hosted services, email and document repositories, backups, and limited paper records. Material systems are operated by service providers on ACA Health’s behalf and may involve offshore storage or processing.

4. Why does ACA Health collect, hold, use and disclose personal information?

ACA Health collects, holds, uses and discloses personal information to provide and administer private health insurance and related services, comply with law and manage the business. Purposes may include:

• assessing eligibility, applications for membership;
• administrating policies, cover, contributions, rebates, levies, waiting periods and transfers;
• assessing claims, calculating and paying benefits, detecting fraud and recovering incorrect payments;
• communicating with members and insured persons and responding to enquiries and complaints;
• conducting audit, assurance, actuarial, risk, compliance, security, training, quality and business-improvement activities;
• managing service providers, legal rights, insurance, disputes and regulatory obligations;
• developing, evaluating and improving products, services, systems and member experience;
• performing any other purpose permitted or required by law or for which consent has been obtained.

ACA Health may from time to time use sensitive information to identify whether insured persons are suitable for particular products and services. For example, ACA Health may use health information to identify whether a person is a suitable candidate for a health management or chronic-disease management program offered, or made available, through ACA Health. Participation in such programs is completely voluntary.

ACA Health does not collect, use or disclose more personal information than is reasonably necessary for an authorised purpose.

5. Anonymity and pseudonyms

You may deal with ACA Health anonymously or by using a pseudonym where this is lawful and practicable, for example for a general enquiry. However, ACA Health needs to verify identity to provide insurance, process a claim, access a policy, correct information, manage a complaint or comply with law.

6. To whom does ACA Health usually disclose personal information?

6.1 Collection

ACA Health may disclose  personal information, where authorised and reasonably necessary, to:

• hospitals, medical, allied health and health-management providers;
• other private health insurers in connection with a transfer;
• government agencies and regulators, including the Australian Prudential Regulation Authority, the Department of Health, Disability and Ageing, Australian Tax Office, Service Australia, Medicare Australia, Office of the Australian Information Commissioner and Commonwealth Ombudsman, where applicable;
• information technology, claims, communications, mailing, printing, storage, payment, professional and other service providers;
• auditors, actuaries, consultants, legal advisers, insurers and investigators;
• debt-recovery or enforcement parties where required to protect ACA Health’s lawful rights;
• courts, tribunals, law-enforcement bodies or other parties, where required by law.

ACA Health requires service providers to handle personal information consistently with applicable privacy, security, retention, incident and confidentiality obligations.

6.2 Direct marketing

From time to time, ACA Health may use or disclose your personal information to inform you of products and services which may be of interest to you. Sensitive information will not be used or disclosed for direct marketing without consent. You may opt-out of direct marketing at any time using the contact details set out below.

6.3 Policies covering more than one person

Where a policy covers more than one person, ACA Health applies person-level privacy settings and identity checks to determine who may access information. Claims history, health information and other sensitive information will not be disclosed to another insured person unless authorised, reasonably expected under the policy settings and permitted by law.

If you are insured under a private health insurance policy, which covers more than one person (e.g. a ‘family’ or ‘couples’ policy), you should make yourself aware of the privacy settings applicable to your policy (that is, who amongst the insured persons is able to access your personal information).

Information concerning health services received, claims made, and benefits paid (“claims history”) will be disclosed between persons insured under the same policy except where an insured person has requested their claims history be kept private from other insured persons on the same policy.

The claims history of a dependent child aged under 14 years will generally be available to the adults insured under the policy on whom the child is dependent except where:

• the privacy setting applicable to the policy restricts access to one or more adults; or
• ACA Health, in its discretion, considers such access would be inappropriate.

Privacy preferences should be reviewed when relationships change, children mature, partners separate or an insured person requests additional privacy. ACA Health may restrict access where it is not satisfied that disclosure reflects the current wishes or interests of the individual concerned.

7. How is personal information handled for travel insurance cover?

8. Is ACA Health likely to disclose personal information to overseas recipients?

ACA Health does not routinely disclose personal information to overseas recipients. However, some technology or service-provider arrangements may involve overseas storage, processing, support access or disclosure.

Before an overseas disclosure, ACA Health will assess the arrangement, take reasonable steps required by APP 8 and applicable law, and record the countries in which recipients are likely to be located where practicable

9. How can I access and correct personal information ACA Health holds about me?

9.1 Access

You may request access to your personal information at any time. ACA Health will verify identity and respond within a reasonable period, generally within 30 days.

ACA Health may refuse access where permitted or required by law, including where access would pose serious threat, unreasonably affect another person’s privacy, prejudice an investigation or legal proceeding, reveal commercially sensitive evaluative information, or be unlawful.

Where access is refused, ACA Health will generally provide written reasons and available complaint options.

If ACA Health refuses access to health information on the grounds that the information may damage the health of the person seeking access, it will offer to provide the information to their doctor instead.

9.2 Correction

ACA Health takes reasonable steps to ensure personal information is accurate, up-to-date and complete, relevant and not misleading. You may request correction at any time.

If ACA Health refuses to correct information, it will generally provide reasons, and where requested and reasonable, in relation to the requested correction.

Requests for access to information and correction must:

• be in writing;
• state the individual’s name and address;
• identify the health information in question;
• specify how the individual wishes to access or amend the information and the reasons for the request; and
• include replacement information if the request is to update obsolete information.

ACA Health will provide access to and correct your information in the requested form where reasonable and practicable. Any fee charged will be limited to the reasonable costs of providing access to or correcting the information. We will not charge you simply for making a request.

10. How can I make a complaint about privacy?

Questions, concerns and complaints may be directed to the Privacy Officer using the contact details below. ACA Health will acknowledge, investigate and respond under its complaint-handling process, generally within 30 days or advise if more time is reasonably require. ACA Health’s Complaints Policy and Procedure is published on ACA Health’s website (https://acahealth.com.au/complaints-policy-procedure/).

If you are dissatisfied with ACA Health’s response, you are entitled to make a complaint to the Office of the Australian Information Commissioner or another external dispute-resolution body with jurisdiction. Full contact details for the Office of the Australian Information Commissioner can be found online at http://www.oaic.gov.au/.

11. How are changes to this privacy policy made?

This privacy policy is reviewed at least annually and when a material change affects personal information handling. Approved revisions will be published on ACA Health’s website with an updated effective date

12. How can I contact ACA Health?

Privacy requests and complaints should be marked for the attention of the ACA Health Privacy Officer.

Mail:     

ACA Health Benefits Fund                                                                                                                                            Locked Bag 2014                                                                                                                                                            WAHROONGA NSW 2076

Phone: 1300 368 390

Email:   [email protected]

Web:    acahealth.com.au

10/26 

Appendix A: References & related documents