<div><div>1. Policy Statement CHT is committed to protecting the privacy of job applicants and will meet its obligations under the Privacy Act 2020 and Health Information Privacy Code 2020. CHT will take care to exercise its information gathering powers appropriately. Privacy is everyone’s responsibility and when dealing with personal and health information it should be treated with the same care and respect as if it were our own. This policy explains how CHT will collect, store, use and share information gathered about people for the purposes of providing health care. It relates to all personal information, whether that be resident, staff or other stakeholders. CHT is mindful that information collected and used by it is inviolable and under the Privacy Act 2020 and Health Information Privacy Code 2020 can only be disclosed in very limited circumstances. Any such information gathering must be approved according to CHT’s internal authorisation process. That process, and other related activities will be regularly reviewed to ensure compliance with the law, CHT’s internal policies, and CHT’s risk management requirements. 2. Privacy Principles There are 13 Privacy principles within the Privacy Act 2020 which govern how CHT can collect, store, use and share information. Principle 1 - Purpose for collection of personal information CHT will only collect personal information necessary for the purposes connected with CHTs activities and functions. This principle is about data minimisation. Resident information may be collected to provide care, support administrative purposes, enable training and monitor quality of care. Information on staff may be collected for purposes including determining suitability, work performance, workplace health, safety and wellbeing, as well as workforce planning and administration. Principle 2 - Source of personal information - collect it from the individual CHT will ensure, as much as is practicable, that personal information will be collected directly from the person it is about because collecting information from the person concerned means they know what is going on and have some control over their information. It is important to ensure when taking photographs of a resident’s wound for example that the resident is aware and consents to this. Principle 3 - Collection of information from subject CHT will be open about why it is collecting personal information and what it will do with it so that the people involved understand the reasons why CHT is collecting their information. CHT will ensure when collecting personal information, e.g. CHT’s Admission Agreement, it will take reasonable steps to make sure that the person knows: • why it’s being collected • who will receive it • whether giving it is compulsory or voluntary • what will happen if the information isn’t provided. However, at times there may be good reasons for not letting a person know about the collection – for example, if it would undermine the purpose of the collection to protect law enforcement investigations, or it’s just not possible to tell the person. When compiling unit newsletters consideration needs to be given to the purpose of the newsletter and how much personal information about the residents mentioned in the newsletter should be shared. Principle 4 - Manner of collection CHT will ensure that personal information is collected in a way that is lawful and seen as fair and reasonable in the circumstances. What is fair will depend on the circumstances like the individual concerned (age and capacity) and the natural sensitivity of the information. An example of this is the ways in which personal information is collected for those residents with dementia. What is fair also depends on the circumstances, such as the purpose for collection, the degree to which the collection intrudes on privacy, and the time and place it was collected. Principle 5 - Storage and security of information CHT will ensure there are safeguards in place that are reasonable in the circumstances to prevent loss, misuse or disclosure of personal information e.g. When bulk emailing residents’ families care needs to be taken that the individual email addresses of each family member are not displayed for other residents’ family members to view. If CHT has a serious privacy breach that is where it is reasonable to believe the breach has caused or is likely to cause serious harm to any of the affected people then CHT’s Privacy Officer is to be notified and who will in turn notify the Office of the Privacy Commissioner as soon as possible (within 72 hours). Principle 6 - Access to personal information People have a right to ask for access to their own personal information. CHT will generally provide access to the personal information it holds about someone if the person in question asks to see it. People can only ask for information about themselves. The Privacy Act does not allow a person to request information about another person, unless that person is acting on the other person’s behalf and has written permission. There is a potential privacy breach if written permission has not been obtained and personal information is shared. Principle 7 - Correction of personal information A person has a right to ask CHT to correct information about them if they think it is wrong. If CHT does not agree that the information needs correcting, an individual can ask that an agency attach a statement of correction to its records, and the agency should take reasonable steps to do so. Principle 8 - Accuracy of personal information CHT will check before using or disclosing personal information that it is accurate, up to date, complete, relevant and not misleading. Principle 9 - Retention of personal information CHT will not keep personal information for longer than it is required for the purpose it may lawfully be used. For more information on this refer to Qua.01. Pol CHT Quality Management System Policy. Principle 10 - Limits on use of personal information CHT can generally only use personal information for the purpose it was collected, and there are limits on using personal information for different purposes. An example of this could be where a third party such as a marketing research company asks CHT to provide personal information about the residents in our care CHT will consider whether other uses are allowed, such as use that is directly related to the original purpose, or if the person in question gives their permission for their information to be used in a different way. Principle 11 - Disclosure of personal information CHT may generally only disclose personal information for the purpose for which it was originally collected or obtained. CHT will consider whether other reasons for disclosure are allowed, such as disclosure for a directly related purpose, or if the person in question gives their permission for the disclosure. Principle 12 - Disclosure outside New Zealand CHT may only disclose personal information to another organisation outside New Zealand if it checks that the receiving organisation: • is subject to the Privacy Act because they do business in New Zealand • will adequately protect the information • is subject to privacy laws that provide comparable safeguards to the Privacy Act If none of the above criteria apply, CHT may only make a cross-border disclosure with the permission of the person concerned. The person must be expressly informed that their information may not be given the same protection as provided by the New Zealand Privacy Act. Principle 13 - Unique identifiers CHT will only assign unique identifiers to people when it is necessary for its functions such as VCare codes. CHT will not assign a unique identifier to a person if that unique identifier has already been given to that person by another organisation. CHT will also take reasonable steps to protect unique identifiers from misuse and make sure they verify someone’s identity before assigning a unique identifier. CHT Privacy Officer Circumstances where issues of privacy are unclear should be referred to CHTs Privacy Officer who will provide advice and guidance.<div style="margin: 0px; padding: 0px; text-indent: -24px;"> </div></div></div>