Clinic demands my address and phone number - can I refuse? [Australia]

Why would email get lost, intercepted, or misdirected (compared to SMS)?

Email is not a very secure means of communicating. Generally emails are encrypted between each relay, but at them, they sit there until it’s encrypted again for the next hop. Email in general is not super secure unless you set up some form of encryption, like openpgp for example. The clinic also can’t necessarily determine if you’ve have the account one day, or whether it’s been compromised the next.

If you use email in a browser, that’s a whole new set of potential attack vectors (MiTM for example). Healthcare providers pay out the nose for secure messaging and email services (so your specialist can transmit results/findings to your GP for example). Which requires both parties to have specialised paid software.

In my experience, they don't seem to verify or identify a patient by address. Even if I give them a fake one, they accept it. If they ever need to send something later, they'll just confirm the address with you again. So I'd rather give them somewhere to send it, like a PO box, when they actually need it.

I would caution anyone about providing false information to healthcare providers. They may not necessarily immediately work it out but if your information is checked against a third party (certain medications are checked against a database or governing body if they’re scheduled/have high abuse potential) and found not to match, issues may arise. Like important medication scripts being cancelled. Still got that medication? You now possess a controlled substance without legal justification. This one of a myriad of reasons this is a bad idea.

In your experience, do they share a patient's address, phone number, and medical info with any third party? Or does it stay within that practice permanently?

I don’t live in the capitalism funhole that is the US as a disclaimer. From my understanding, not without your permission (I.e. a GP suggest you see a specialist, you accept, they then coordinate and potentially, with your consent, send the referral). The only exception I can think of is providing information to law enforcement if you break the law at the practice (e.g. threaten staff, become violent etc). Breaching confidentiality is a big deal in the healthcare profession.

Generally they’ll retain your records while you’re an active patient and a minimum time after. When you become inactive, you can request a copy of your patient summary information. Though here I believe after a certain time, lacking any instruction, they’re obligated to de-identify and destroy patient records.

::: spoiler Long version

Medical records should not be kept forever. Under Australian privacy law, you have an obligation to destroy or permanently de-identify information collected for a specific purpose when you no longer need it for that purpose. Maintaining confidentiality is paramount when you destroy any medical records. Legislation in some states and territories requires you to keep a register of health records that are destroyed. This is good practice in any event.

You may also be compelled by law to provide documents to a third party. This might be through a legal document such as a summons or subpoena, a notice of non-party disclosure, or a warrant from police.

https://avant.org.au/resources/medical-records-the-essentials

From a medical indemnity providers site. Aka lawyers for doctors. :::