Are your registrar percentage summaries at risk of breaching privacy laws?

Under the NTCER, practices are required to supply a percentage summary at whatever interval has been agreed to in the employment agreement between the registrar and the practice. Importantly, the requirement to provide a summary does not negate a practice’s duty to maintain confidentiality and observe privacy laws.

Imagine you provided an MBS summary to a registrar that was taken and left on a park bench? Who is at fault? The practice or the registrar?

One could argue a clinician has similar privacy constraints that they must operate in as the practice entity itself.

Importantly, in this ficticious scenario, while the document might have been left by an employee and they may well be found to be at fault, the provision of this information in an identifiable format outside of the privacy law constraints remains something for the practice to manage at all times.

As such, while the NTCER requires that payment summaries of percentages be provided to registrars we recommend that you have a look at the format these summaries are provided in.

At the very least payment summaries should follow the following structure:

• Registrar name
• Agreed Registrar Percentage
• Percentage Calculation Period – from /to
• Total Billings/Receipts generated for the period (in aggregate only)
• Registrars agreed percentage for the period
• Less salary already paid throughout the same period (including leave)
• Total % payable = (Registrars agreed percentage for the period (-) less salary already paid throughout the same period (including leave)

Your registrar summaries should never contain:

• Patient Particulars – names, Medicare numbers, individual item numbers billed to that patient

What about item number categories?

You could provide summaries in item number categories, but again you should avoid providing anything in a format that could be easily reconstructed by the registrar to correlate item numbers to patient names.

What training instruction/ policy should be in place regarding privacy?

Your practice will likely have the following in place:

• Privacy policy
• Employment contracts requiring employees to adhere to practice/ entity policies that exist now, may be altered throughout their employment or come into existence after their start date
• Signed agreements to state that the employee has read and understood the privacy regulations, policies and constraints placed upon them in their capacity as an employee
• An induction/ orientation that includes a session on privacy that explicitly steps out the privacy regulations of the practice and they as clinicians are legally required to abide by