MIPS is aware that many of our GP members are working in healthcare practices that participate in the Australian Government’s Practice Incentives Program (PIP). The PIP Quality Improvement (QI) Incentive commenced on 1 August 2019. Some MIPS members have expressed concerns about the contract requirements including the privacy and security of data sent to third party data providers (eg PEN, POLAR).

cyber-cover

The Australian Government has established a framework and guidelines to govern the management of the data and the risks. Practices must ensure they meet the PIP Eligible Data Set Data Governance Framework requirements in addition to the normal management of private information such as secure storage and transmission. Third party software providers will also be expected to store and handle data received appropriately.

Practitioners already have existing professional and legal obligations to ensure the information contained in their patient files is current, accurate, securely stored, and confidential. These responsibilities do not change for general practices participating in the PIP QI Incentive.

MIPS advises all practices participating to:

  • ensure they are aware of the data requirements in the Governance framework including appropriately deidentifying records.
  • Ensure you display a poster advising patients of your practice’s participation in reception and make further information available electronically on request (eg web link or PDF via email).
  • Record ‘opt outs’ should you have patients that do not want to participate (consent to participate is implied so patients are included by default unless they opt out). In the case of POLAR, the poster states “Please let our reception staff know if you do not want your information to be included”.
  • Review and update the practice’s privacy policy to state that de-identified data may be shared with third parties for research and quality improvement.

For more information see the Fact Sheet August 2019 published by the Department of Health: PIP QI Incentive, What practices need to know