Privacy, Dignity & Confidentiality Policy

The purpose of this policy is to ensure that Care In Disability Services Australia Pty Ltd protects the privacy, confidentiality and dignity of participants, employees, contractors, volunteers and other individuals whose personal information is collected or managed by the organisation.

This policy applies to:

• All directors and management
• Employees and support workers
• Contractors and agency workers
• Volunteers and students
• Participants and their authorised representatives
• Any person who collects, accesses, uses, stores or manages personal information on behalf of Care In Disability Services Australia Pty Ltd.

This policy applies to personal information in all formats, including:

• Electronic records
• Paper records
• Emails and electronic communications
• Photographs, videos and audio recordings
• Participant files and progress notes
• Health and support-related information

We are committed to ensuring that personal information is:

• Collected only when reasonably necessary
• Collected fairly and lawfully
• Used only for legitimate and authorised purposes
• Disclosed only with appropriate consent or where permitted or required by law
• Kept accurate, relevant and up to date
• Protected from misuse, loss, unauthorised access, modification or disclosure
• Accessible only to authorised persons who require the information to perform their role

Participants have the right to:

• Privacy and confidentiality
• Be treated with dignity and respect
• Understand how their personal information is collected and used
• Exercise choice and control over their information where possible
• Provide or withdraw consent, subject to legal and safety requirements
• Request access to and correction of their personal information
• Raise concerns or complaints about privacy without fear of disadvantage or discrimination

4.1 Collection of Personal Information

Personal information will only be collected where reasonably necessary to provide safe, appropriate and individualised services or to meet legal, regulatory or operational requirements. Information may include:

• Name and contact details
• Date of birth
• Emergency contact details
• Details of nominees, guardians or authorised representatives
• Health and medical information relevant to service delivery
• NDIS and funding information
• Support needs, goals and preferences
• Communication requirements

Where possible, information will be collected directly from the individual. Information may be collected from another person or organisation where the individual has provided consent, the person is legally authorised to provide the information, collection is required or authorised by law, or collection directly from the individual is unreasonable or impracticable.

4.2 Consent

Where consent is required, workers will ensure that consent is obtained before collecting, using or disclosing personal information. Consent must be informed, voluntary and documented where appropriate. Participants may withdraw or change their consent at any time. The organisation will explain any impact this may have on the safe or effective delivery of services.

4.3 Use of Personal Information

Personal information will only be used for purposes related to:

• Providing safe and individualised supports
• Understanding participant needs, goals and preferences
• Coordinating services
• Communicating with relevant persons or organisations
• Administration and invoicing
• Incident and complaint management
• Meeting legal, regulatory and NDIS obligations

Workers must not access or use personal information for personal reasons or for purposes unrelated to their authorised duties.

4.4 Disclosure of Personal Information

Personal information will only be disclosed:

• With the individual's consent
• To authorised representatives or nominees
• Where reasonably necessary for the provision or coordination of supports
• Where required or authorised by law
• Where necessary to respond to an emergency or serious risk to life, health or safety

Information will only be shared with relevant persons or organisations and only the minimum information necessary for the purpose will be disclosed.

4.5 Privacy, Dignity and Confidentiality

Workers must respect participant privacy and dignity at all times. Workers must:

• Discuss personal information privately and discreetly
• Avoid discussing participant information in public places
• Only access information required for their role
• Protect participant records from unauthorised access
• Respect personal space, belongings and private communications
• Support participants to make decisions about their personal information
• Respect cultural, personal and individual preferences

Confidential information must not be shared with family members, friends, other participants or unauthorised persons.

4.6 Storage and Security

Personal information will be protected using reasonable physical, administrative and electronic safeguards. These may include:

• Password-protected electronic systems
• Restricted access to participant records
• Secure storage of paper records
• Confidentiality obligations for workers
• Secure handling of electronic communications
• Appropriate record retention and disposal processes

4.7 Access and Correction

Individuals may request access to personal information held by the organisation and may request correction of information that is inaccurate, incomplete or out of date. The organisation may request proof of identity before releasing personal information. Requests will be managed within a reasonable timeframe and in accordance with applicable legal requirements.

To make an access or correction request, please contact us.

4.8 Privacy Breaches

Any suspected or actual privacy breach, including loss, theft, unauthorised access or disclosure of personal information, must be reported immediately to management. Care In Disability Services Australia Pty Ltd will:

1. 1Contain the breach where possible
2. 2Assess the nature and seriousness of the breach
3. 3Take reasonable steps to reduce the risk of harm
4. 4Investigate the circumstances
5. 5Notify affected individuals and relevant authorities where required
6. 6Review systems and procedures to reduce the likelihood of future breaches

4.9 Privacy Complaints

Individuals may raise concerns or complaints about privacy or confidentiality. All privacy complaints will be:

• Taken seriously
• Handled respectfully and confidentially
• Assessed fairly
• Addressed as promptly as reasonably practicable
• Managed in accordance with the organisation's Complaints Management Policy and Procedure

No person will be disadvantaged for making a privacy complaint. To raise a privacy concern, please contact us.

Management is responsible for:

• Ensuring appropriate privacy and confidentiality systems are in place
• Ensuring workers understand their privacy obligations
• Responding to privacy breaches and complaints
• Maintaining appropriate records and information security

Workers are responsible for:

• Complying with this policy and procedure
• Maintaining confidentiality
• Only accessing information required for their role
• Reporting suspected privacy breaches immediately
• Respecting participant privacy, dignity, choice and control

This policy is informed by:

1. 1Privacy Act 1988 (Cth)
2. 2Australian Privacy Principles
3. 3National Disability Insurance Scheme Act 2013
4. 4NDIS Practice Standards and Quality Indicators
5. 5NDIS Quality and Safeguards Commission

This policy should be read in conjunction with:

• Consent Policy and Procedure
• Participant Rights and Responsibilities Policy
• Data Breach Management Policy and Procedure
• Information Management and Record Keeping Policy
• Records Retention and Secure Disposal Procedure
• Complaints Management and Resolution Policy and Procedure
• Incident Management Policy and Procedure
• Risk Management Policy and Procedure
• Access and Correction of Personal Information Procedure
• Employee, Contractor and Volunteer Code of Conduct
• NDIS Participant Service Agreement