Acceptable Use & Information Security Policy

The purpose of this Policy is to ensure the secure, responsible, and lawful use of the Doctor On Call Healthcare Management System (HMS). It establishes the standards of behaviour expected from all authorized users to protect the confidentiality, integrity, and availability of personal information processed through the HMS. Compliance with this Policy is a condition of continued access to and use of the HMS.

Scope

This Policy applies to all authorised users of the HMS, including:

• healthcare practitioners;
• nurses;
• pharmacists;
• reception and administrative staff;
• practice managers;
• authorised Doctor On Call personnel;
• contractors and consultants; and
• any other individual granted authorised access to the HMS.

Definitions

For the purposes of this Policy:

Authorized User means an individual who has been granted permission to access the HMS.

Personal Information has the meaning assigned under the Data Protection Act, 2024.

Healthcare Management System (HMS) means the electronic healthcare management platform operated by Doctor On Call.

Acknowledgement

By accessing and using the Healthcare Management System, users acknowledge that they have read, understood, and agree to comply with this Acceptable Use and Information Security Policy. Continued access to the HMS is conditional upon compliance with this Policy.

User Responsibilities

All users are responsible for protecting the confidentiality, integrity, and security of the HMS and the personal information it contains.

Users must:

• use the HMS only for authorized healthcare and business purposes;
• comply with applicable laws, professional obligations, and Doctor On Call policies;
• protect the confidentiality of patient and organizational information;
• report suspected privacy and security incidents in accordance with this Policy;
• ensure information entered into the HMS is accurate, complete, and up to date;
• log out or lock their session when leaving a workstation unattended; and
• take reasonable care to prevent unauthorized access to the HMS.

Acceptable and Prohibited Use

Users must only use the HMS to perform duties that fall within their authorised role and responsibilities.

Acceptable use includes:

• registering patients;
• scheduling appointments;
• documenting clinical consultations;
• prescribing or dispensing medication where authorized;
• reviewing patient records necessary for providing care;
• processing referrals;
• performing authorized administrative functions; and
• generating authorized reports.

Users must not:

• access patient or staff records without a legitimate business or clinical need;
• use another person's account or allow another person to use their account;
• share passwords or authentication credentials;
• attempt to bypass security controls;
• deliberately alter, delete, or falsify records without authorization;
• download, copy, photograph, print, or otherwise remove personal information except where authorized;
• install unauthorized software or hardware;
• introduce malicious software into the HMS or connected systems;
• attempt to test, scan, exploit, or compromise the security of the HMS;
• use the HMS for personal, commercial, political, or unlawful purposes; or
• engage in any activity that may compromise the confidentiality, integrity, or availability of the HMS.

Information Protection and Security Responsibilities

Users are responsible for protecting the confidentiality, integrity, and security of personal information when accessing or using the HMS.

Users must:

• access only the personal information necessary to perform their authorized duties;
• ensure that personal information is viewed only by authorized persons;
• verify an individual's identity before disclosing personal information;
• avoid discussing confidential information in public or unsecured environments;
• ensure that printed records are handled, stored, and disposed of securely;
• comply with the Healthcare Management System Privacy Notice and all applicable privacy legislation;
• use only authorized devices where required by organizational policy;
• keep devices physically secure and lock workstations or devices whenever they are unattended;
• install approved software updates and ensure that antivirus and other security controls remain enabled;
• avoid storing personal information on unauthorized local devices, removable media, or personal storage services;
• verify recipients before sending personal information electronically;
• use only approved communication channels when sharing personal information;
• avoid sending confidential information through unauthorized platforms or applications;
• exercise caution when opening email attachments, clicking links, or responding to unsolicited communications;
• keep usernames, passwords, and other authentication credentials confidential;
• use strong passwords in accordance with organizational requirements;
• change passwords when instructed or immediately if compromise is suspected;
• never share authentication credentials with another person; and
• immediately report lost or stolen devices, suspected credential compromise, phishing attempts, or any other event that may compromise the security of personal information or the HMS.

Users are responsible for all activities performed using their assigned accounts.

Incident Reporting

All users have a responsibility to report actual or suspected privacy or security incidents without undue delay. Examples of reportable incidents include:

• suspected unauthorized access to personal information;
• accidental disclosure of personal information;
• lost or stolen devices;
• compromised passwords;
• malware or ransomware incidents;
• suspicious system activity; or
• any event that may result in a personal data breach.

Incidents must be reported using the appropriate HMS Helpdesk function:

• Submit Privacy Complaint for suspected privacy policy violations or other internal privacy concerns.
• Report Personal Data Breach for actual or suspected personal data breaches.

Prompt reporting enables Doctor On Call to investigate, contain, and respond appropriately.

Audit and Monitoring

Doctor On Call monitors and audits the use of the Healthcare Management System (HMS) to protect the confidentiality, integrity, and availability of personal information processed through it. The HMS maintains audit logs that record user activities, including system access, authentication events, the creation, viewing, modification, and deletion of records, and other security-relevant actions.

Audit logs are used to detect and investigate unauthorised access or misuse, respond to security and privacy incidents, demonstrate compliance with applicable legal and regulatory requirements, maintain the security and reliability of the HMS, and support the continuous improvement of system performance and operational effectiveness.

Policy Review

Doctor On Call reserves the right to amend this Policy to reflect changes in legislation, technology, organisational requirements, or information security best practices.

Users may be required to acknowledge updated versions of this Policy before continuing to use the HMS.

Non-Compliance

Non-compliance with this Policy may constitute a breach of organisational policy, contractual obligations, professional responsibilities, or applicable law.

Failure to comply with this Policy may result in:

• suspension or removal of HMS access;
• disciplinary action;
• termination of employment or contractual arrangements;
• referral to professional regulatory bodies where appropriate;
• civil proceedings; and/or
• criminal prosecution where permitted by law.

Doctor On Call reserves the right to investigate all suspected violations of this Policy.

Contact Information