• Primary Sense™ Extractor accesses personal information on collection for the purpose of generating a unique code but does not extract that personal information from the practice.
• Only the minimum data set required to inform the creation of reports and alerts available via Primary Sense™  Desktop is collected.
• Data from patients that have not been inactivated/deceased are extracted.

• Stored in Primary Sense™in a database located in Microsoft Azure in Australia.
• Microsoft Azure is a secure cloud- based infrastructure platform with industry standard security in place.

The Microsoft Azure database holding the data is only accessed by:

• authorised and trained Gold Coast PHN staff
• authorised and trained contracted staff

Primary Sense ™ uses industry standard database and business intelligence tools

• This is controlled by IP Firewall.
• All data accessed is inherently de-identified

By the Practice:

• Access is obtained via login for authorised users using the Primary Sense Desktop™ or Primary Sense™ website applications.
• GCPHN staff accessing the data to support Quality Improvement activities have signed confidentiality agreements with GCPHN and participating practices.

Patient data is only re-identified to the authorised user via Primary Sense within the Practice location/s.

• Data is analysed to support the identification of health risk factors and best practice care.

Population Health Planning (Secondary use of data)

• De- identified, aggregated data may be used for: needs assessment, population health planning, service planning and project evaluation.

Patient consent

• Patients’ have the option to withdraw from sharing their information and this can be recorded in Primary Sense™.

Aggregate level data for secondary purposes is shared via electronic transfer with:

• Department of Health
• Contractors working with GCPHN

Partners working collaboratively with GCPHN

• The Primary Sense ™ Database is secured with appropriate Firewall rules.

GCPHN Staff security

• Via website or Primary Sense™ applications and via controlled API methods / Stored Procedures.
• Via database and Business Intelligence tools at Gold Coast PHN premises.

Practice staff security:

Practice staff only have access to their own patient data from within their practice

• If a patient withdraws consent to share their information, data will be deleted within one week.
• If a patient becomes deceased, data is retained for 5 years, then deleted.
• If a practice withdraws consent, all data is deleted within a week.
• If a patient becomes inactive at a practice, all data is deleted (except patient ID which is retained for the purpose of meaningful use to link to another practice where consent has been obtained).

Data is deleted after 5 years or as required by external governing frameworks