1 – Create/collect

• Primary Sense ™ Extractor – extracts, encrypts and compresses data from the Practice’s clinical/billing database prior to leaving the practice 
• The Extractor accesses personal information on collection for the purpose of generating a unique code but does not extract that personal information from your practice 
• Only the minimum data set required to inform the creation of reports and alerts available via Primary Sense™   – Desktop is collected 
• Data for all patients that have not been inactivated/deceased are extracted  
• A patient ID only is extracted for inactive patients (no data)  
• Each Practice is allocated a unique identifier 
• Patient data is allocated a unique identifier linked to the practice (own identifier)   
• Initial data extraction needs to be completed prior to report generation 
• Time to complete initial extraction will vary on size of practice database  
• Subsequent changes/updates and new information is extracted during the day at regular periods (frequency can vary– depending on preference at the practice)

Primary Sense ™ Dashboard in Microsoft Azure in Australia

2 – Organise/store

The Primary Sense™ dashboard: 

Is a web-based interface.

Supports practices with system administration and quality improvement by outlining aggregated deidentified practice level data including:

• Last data extract
• Last alert patient refresh
• Last ACG patient refresh
• Last report viewed
• Last monitored medication
• Last response date

Supports practices optimal use of data by outlining aggregated deidentified practice level data including:

• Patient Counts including total, RACGP active and total patient IDs
• ACG Patient Counts including total, band 3, 4 & 5 patients
• Medications including medications monitored, GPs prescribing & last monitored request
• Alerts including triggered alerts, alert responses, GPs responding, last alert name & last response date
• Reports including report views, GPs viewing reports, last report name & last report viewed date

• GCPHN on-site access
• GCPHN authorised staff working remotely
• Primary Sense website
• Primary Sense Desktop installed in Practices

The GCPHN Data Access Policy outlines which GCPHN/contracted staff have access to Microsoft Azure Database holding the data and what level of access is permitted. Staff access is logged, monitored and audited

3 – Access

The Microsoft Azure database holding the data is only accessed by:

• authorised and trained Gold Coast PHN staff
• authorised and trained contracted staff
• Access is controlled by Sonic Firewall, IP locking and other security and threat prevention services

At Gold Coast PHN premises and remotely:

The Primary Sense™ Dashboard is only accessed by:

• authorised and trained Gold Coast PHN staff
• authorised and trained Gold Coast PHN contracted staff
• Primary Sense ™ uses industry standard database and business intelligence tools
• All data accessed is inherently de-identified

By the Practice:

• Access is obtained via secure login for authorised users using the Primary Sense Desktop™ or Primary Sense™ website applications
• Confidentiality agreements are in place with all staff accessing the data\
• Access is controlled via API methods / Stored Procedures.
• Patient data is only re-identified to the authorised user via Primary Sense within the Practice location/s
• If Gold Coast PHN Practice Support staff are working with the practice staff on site, and could see identified data, a privacy/confidentiality agreement is signed at the practice by the GCPHN staff member

Elsewhere:

• Authorised user login and controlled access via Primary Sense website

• GCPHN on-site access
• Primary Sense website
• Primary Sense Desktop installed in Practices

4 – Use/share

Patient care (Primary use of data)

• Data is analysed to assess risk of health outcomes, eligibility for proactive care, medication safety alerts and highlights potential interactions or missing treatments
• This information is re-identified at the practice for the clinicians/staff as appropriate and through authorised access
• Primary Sense ™ has the capability to link data between practices that a patient may visit. This will only occur once consent from the patient and the practices is obtained
• Reports and alerts are generated using ACG® tool and Primary Sense ™ Database and displayed at the practice via Primary Sense ™ Desktop through authorised access

Population Health Planning (Secondary use of data)

• De- identified, aggregated data may be used for: needs assessment, population health planning, service planning and project evaluation
• To assess the effectiveness of Practice Support strategies to support quality improvement activities within the general practice

Patient consent

• Patients’ have the option to withdraw from sharing their information and this can be recorded in Primary Sense™

Aggregate level data for secondary purposes is shared via electronic transfer with:

• Department of Health
• Contractors working with GCPHN
• Partners working collaboratively with GCPHN

The Primary Sense™ Dashboard:

Is accessed by authorised GCPHN staff to support system administration including:

• • To assess and monitor the system functionality
  • To support development and review of reports and medication alerts through translation of data through data mapping processes
  • To inform and support system enhancements

5 – Maintain/Secure

• The Primary Sense ™ Database is secured with appropriate Firewall rules and security measures

GCPHN Staff security:

• Via website or Primary Sense™ applications and via controlled API methods / Stored Procedures.
• Via database and Business Intelligence tools at Gold Coast PHN premises.

Practice staff security:

• Practice staff only have access to their own patient data from within their practice

6 – Retention/Disposal

• If a patient withdraws consent to share their information, data will be deleted within one week
• If a practice withdraws consent, all data is deleted within a week
• If a patient becomes deceased, data are retained for 5 years, then deleted
• If a patient becomes inactive at a practice, data are retained for 5 years, then deleted (except patient ID which is retained for the purpose of meaningful use to link to another practice where consent has been obtained)
• Data no longer relevant to patient care are deleted after 5 years or as required by external governing frameworks