PenCS software platforms have been designed and structured to ensure the safety, integrity and security of patient data is compliant with the Privacy Act 1988, Privacy Amendment Act 2012 and the Privacy Regulation 2013.

All data leaving the general practices is de-identified and filtered to exclude patients who have withdrawn their permission for the their data to be shared for population health and reporting purposes.

Detailed information on how data is collected in CAT4 can be found here: COLLECTING DATA

Data Security

 Where is the PAT CAT data stored?

Pen CS do not store the data, the data is stored on the PHN's servers. The de-identified data is sent directly from the practice to the PHN server in a zipped file send over securely and encrypted (HTTPS).

Does any identified information leave the general practice?

CAT4 de-identifies the information within the practice before submitting the de-identified extract to PAT CAT. Practices are encouraged to follow the RACGP guidelines on privacy:
"In general, a practice's quality improvement or clinical audit activities for the purpose of seeking to improve the delivery of a particular treatment or service would not be considered a directly related secondary purpose for information use or disclosure. In other words, it is likely the practice would need to seek specific consent for this use of patients' health information for clinical audit activities.
To ensure patients understand and have reasonable expectations of quality improvement activities, practices are encouraged to include information about quality improvement activities and clinical audits in the practice policy on managing health information. Ideally, express consent for these activities will be obtained upon patient registration." http://www.racgp.org.au/your-practice/standards/standards4thedition/practice-management/4-2/confidentiality-and-privacy-of-health-information/

Can I exclude patients that do not wish to have their data shared with the PHN?

Yes. Individual patients can have their data withheld from being submitted. Instructions can be found on the PENCS website. http://help.pencs.com.au/display/CG/Patient+Consent+Withdrawn

Will other practices see my data?

No identifiable information ever leaves the practice. The PHN may do benchmarking comparisons as part of the quality improvement program you can discuss with the PHN how they use the data. Other practices can NOT see your data, only the total for the PHN if at all.

What is de-identified data?

De-identified data means that the information that would identify the patient is removed. Only the age in years, gender and ethnicity remain in the data after de-identification.

Do the CAT Products write back to the Clinical System?

No. No CAT Plus products write back to the practices clinical system, we have read only access to your clinical data.

Does CAT Plus always connect to the Clinical System every time it runs?

No. The CAT Plus runs independently from the clinical system and uses the extracts when you are running queries, the only time a connection is made is when a new snapshot is created, during the data collection.