Draft: Internet, Email, and Electronic Devices

Page edited and expanded on for clarity.

Electronic communication

At GPDocs Model Practice electronic communication is used primarily for clinical support and practice business. It must meet our legal obligations for patient confidentiality and privacy and the practice's expectations for respect and courtesy. Any electronic communication with patients is recorded in the patient record.

See MCNZ: Statement on use of the internet and electronic communication

Internet

We expect all staff to use the internet responsibly and try to keep the practice's IT systems safe and virus-free. Internet use is generally limited to activities that support patient care. Staff should check with the practice manager regarding any specific practice guidelines for personal use during work hours. Inappropriate use of the internet may lead to disciplinary action.

Do not transfer patient information from the practice network onto electronic data storage devices (such as CDs and USB flash drives), unless the practice manager gives their permission.

Email

Staff are expected to respond to practice emails promptly, and to observe good email practice.

When communicating with patients, we use ManageMyHealth instead of email if possible, so that the message is automatically captured. We do not assume that receiving an email from a patient means they consent to receiving future information by email. We check with patients before sending them sensitive information via email.

Staff should not use the work email account for personal emails.

Mobile phones and other personal devices

We ask staff to consider their environment and use good judgement when using mobile phones and other personal devices to ensure minimal impact on practice work, other staff, and patients.

• Personal use of mobile phones should be kept to a minimum, for important or urgent communications only.
• Only use a mobile phone at reception or other public area of the practice if it is for on-call purposes, or for multi-factor authentification.

  Using multi-factor authentication (sometimes two-factor authentication or TFA) means that you need to provide two or more things, your password and something else, before you can log into an account. With MFA, even if someone works out your password they won't be able to access your account without the second thing.

  Depending on the app you use, authentication may be provided by:

  • a question that only you know the answer to
  • a code or once-only password sent to your email or phone
  • fingerprint, facial, retina or other physical recognition.

  See CertNZ guidance on multi-factor authentication

• Ideally, keep personal mobile phones away from work areas and on silent for calls, texts, and other notifications to avoid distractions.
• Use break areas and break times to use personal phones or other devices.
• Be aware of security and privacy settings on personal devices and social media sites.
• Use headphones when listening to music or other audio content, and only do so away from patient areas.

We use the practice mobile phone to text details of appointments and test result summaries, but use other ways to communicate more in-depth or sensitive information to patients.

Personal devices should not be used to communicate patient information, take voice recordings, or create images.

See also: Photos, Filming, and Recording

Social media

Staff should be careful not to blur the boundaries between personal and professional use of social media, upholding the Code of Conduct, Confidentiality, and Privacy policies at all times.

Staff operate under the assumption that all information published on social media may become public, regardless of privacy settings. Patient information could be inadvertently revealed and shared once posted.

Personal accounts should not be in use while staff are working, and outside of these times staff should not:

• use practice equipment/devices to access personal accounts
• post photos from within the practice, or any content that shows the practice environment, without permission from the practice manager
• post anything personal that might undermine patient-clinician relationships or public trust in the medical profession
• initiate or engage in online discussions that might have a negative impact on patients, the practice, or colleagues
• present personal opinions as those of the practice
• use the practice logo or branding for non-work-related activities.

Inappropriate use of electronic communication may be considered serious misconduct and could result in disciplinary action.