Privacy and Information Management Policy

Introduction

Purpose

The purpose of the Privacy and Information Management Policy for Disability and Mental Health Care Pty Ltd, an NDIS service provider, is to establish clear guidelines for collecting, using, storing, disclosing, and disposing of participants' information, protecting their right to privacy. It aligns with the Privacy and Dignity and Information Management NDIS Practice Standards, the Australian Privacy Principles, and relevant laws.

Scope

This Policy is applicable to all Workers affiliated with Disability and Mental Health Care Pty Ltd. It is the responsibility of every individual, regardless of their employment status, to fully comprehend and comply with the commitments outlined in this policy. All Workers must acknowledge that they have read, understood and will comply with the contents of this Policy.

NDIS Indicators (Objectives)

Privacy and Dignity

Outcome: Each participant accesses supports that respect and protect their dignity and right to privacy. To achieve this outcome, the following indicators should be demonstrated:

• Consistent processes and practices are in place that respect and protect the personal privacy and dignity of each participant.
• Management of each participant's information ensures that it is identifiable, accurately recorded, current and confidential. Each participant's information is easily accessible to the participant and appropriately utilised by relevant workers.
• Each participant understands and agrees to what personal information will be collected and why, including recorded material in audio and/or visual format.

Information Management

Outcome: Management of each participant's information ensures that it is identifiable, accurately recorded, current and confidential. Each participant's information is easily accessible to the participant and appropriately utilised by relevant workers. To achieve this outcome, the following indicators should be demonstrated:

• Each participant's consent is obtained to collect, use and retain their information or to disclose their information (including assessments) to other parties, including details of the purpose of collection, use and disclosure. Each participant is informed in what circumstances the information could be disclosed, including that the information could be provided without their consent if required or authorised by law.
• Each participant is informed of how their information is stored and used, and when and how each participant can access or correct their information, and withdraw or amend their prior consent.
• An information management system is maintained that is relevant and proportionate to the size and scale of the organisation and records each participant's information in an accurate and timely manner.
• Documents are stored with appropriate use, access, transfer, storage, security, retrieval, retention, destruction and disposal processes relevant and proportionate to the scope and complexity of supports delivered.

Policy Statement

At Disability and Mental Health Care Pty Ltd, we are deeply committed to safeguarding our Participants' right to privacy while ensuring accurate, reliable, and accessible management of their information. We believe that every Participant's personal data should be treated with utmost respect and confidentiality. This policy guides our practices towards these commitments, underpinning our organisational principles of respect for Participant autonomy, transparency, and accountability. It establishes the standards for our dedicated workforce to handle information appropriately, respecting each Participant's privacy and dignity.

Relevant legislation

All relevant legislation to this Policy is outlined in the Legislation Register.

Related documents

• Privacy Consent Form
• Privacy Consent Form (Easy Read)
• Incident Management Policy
• Incident Report Form
• Feedback and Complaints Policy
• Risk Management Register

Responsibilities and Roles

Supriya Thapa is responsible for the development and review of this policy. It is expected that Supriya Thapa ensures this Policy remains compliant with all applicable laws, regulations and standards.

Key Management Personnel play a vital role in ensuring the effective implementation of this Policy throughout Disability and Mental Health Care Pty Ltd. It is the responsibility of all Key Management Personnel to not only assist Workers in understanding and complying with this policy but also to comply with it themselves. By leading by example, they demonstrate the importance of adherence to the policy and foster a culture of compliance within the organisation.

Workers are responsible for understanding the contents of this policy and complying with all procedures applicable to them.

Definitions

Disability and Mental Health Care Pty Ltd means Disability and Mental Health Care Pty Ltd ABN 19658578575.

Key Management Personnel means Supriya Thapa and other key management personnel involved in Disability and Mental Health Care Pty Ltd from time to time.

Director means Supriya Thapa.

Worker means a permanent, fixed term or casual member of staff, a contractor or volunteer employed or otherwise engaged by Disability and Mental Health Care Pty Ltd and includes the Director.

Personal information means any data or viewpoint about an identifiable individual or one who can be reasonably identified, regardless of the veracity of such information or if it is recorded in a physical form.

Sensitive information means a category of personal information that usually receives a higher degree of privacy protection. This encompasses details related to health, genetic makeup, racial or ethnic background, political viewpoints, association with a political group, religious or philosophical beliefs, affiliation to a professional or trade association or union, sexual orientation or behaviour, criminal history, and certain kinds of biometric information.

Procedures

Protection of Sensitive Information

As part of Disability and Mental Health Care Pty Ltd's Privacy and Information Management Policy, we carefully manage sensitive information to protect the privacy and dignity of our participants.

Disability and Mental Health Care Pty Ltd only collects sensitive information where it is reasonably necessary for our functions or activities. This could include health and medical information and information relating to disability and support requirements. This will only be done under two circumstances:

• The individual has given explicit consent.
• Disability and Mental Health Care Pty Ltd is required or authorised by law, including applicable privacy legislation, to do so.

Disability and Mental Health Care Pty Ltd is committed to treating all Participants with dignity and respect. We take all reasonable measures to protect the privacy and dignity of each participant, particularly when handling their sensitive information.

Obtaining Participant consent

Workers must, in a respectful, clear, and honest manner, explain to the Participant the purpose and potential use of their data, and who it may be disclosed to, including instances where information could be shared without consent, as per legal requirements.

Workers should use plain language, active listening, and encourage questions to ensure the Participant fully understands.

Consideration must be given to any potential communication barriers and efforts made to address these, for instance by offering interpreter services or legal aid.

Workers must document the Participant's consent using the Privacy Consent Form, ensuring all details are fully understood and agreed upon by the Participant.

Informing Participants about their information

Workers must inform Participants about their data storage and usage. This should be done when providing the Privacy Consent Form during the initial intake process, and periodically thereafter, or when changes are made to the data storage or usage.

Communications should respect the privacy and confidentiality of the Participant.

Workers should provide information on how Participants can contact Disability and Mental Health Care Pty Ltd to access or correct their data, lodge a complaint, or amend their prior consent.

If the Participant wishes, Workers should encourage their engagement with family, friends, or chosen community in this process.

If a Participant has a complaint about how Disability and Mental Health Care Pty Ltd has collected or handled their personal information, it will be managed in accordance with the Disability and Mental Health Care Pty Ltd Feedback and Complaints Policy.

Information collected and stored

The personal information Disability and Mental Health Care Pty Ltd collects and securely stores includes:

• Participant details, including name, contact details, gender, date of birth, marital status, disability and support needs.
• Identifiers, such as numbers used by the government or other organisations for identification.
• Service details, such as information about provided services and delivery methods.
• Medical information, including health and medical details relevant to service provision.
• Financial information, including billing details and information about funded services under the NDIS or otherwise.
• Interaction records, including records of conversations and interactions with our workers.

Disability and Mental Health Care Pty Ltd may collect personal information in the form of recorded material such as audio and/or visual format.

Information collection methods

Disability and Mental Health Care Pty Ltd collects personal information through various means to ensure the effective delivery of our services. These methods include:

• Information provided through forms, website or online interactions (if applicable).
• Information gathered when individuals correspond with us, for example via letters, faxes, emails, or telephone calls.
• Personal data collected through forms filled out in person or received via mail.
• Information collected directly during face-to-face interactions.
• Information obtained from referring third parties, such as the National Disability Insurance Scheme or a support coordinator.
• Personal information collected from participants during events and forums.
• Personal information received from third-party funding and Government agencies.

Purpose of personal information collection

As an NDIS service provider, Disability and Mental Health Care Pty Ltd collects personal information to manage, provide, and enhance our services. This data collection enables us to:

• Understand and evaluate Participants' specific needs, preferences, and goals to customise Participant support plans.
• Answer Participant inquiries, administer services, process payments, and provide tailored supports as per the Participants' NDIS plans.
• Keep Participants updated about their plans, our services, and any changes or updates, including information about disability supports and the NDIS.
• Carry out quality assurance activities including surveys, research, and analysis, resolve complaints, and continually refine our services to meet the NDIS Practice Standards and Quality Indicators.
• Adhere to legal, regulatory, and reporting obligations, including incident reporting, record keeping, and providing reports to funding and government agencies.
• Inform individuals about our activities and promote Disability and Mental Health Care Pty Ltd, including through events and forums. Where consent is provided, we may send marketing communications.
• Perform research and statistical analysis relevant to our services, and invite individuals to participate in these activities, which contribute to the evaluation and enhancement of our services.
• If applicable, manage and improve user experience on our website using "cookies" to personalise webpage content, track visits, and tailor advertising. Users can manage cookies through their browser settings.

Third party disclosures

Disability and Mental Health Care Pty Ltd may share personal data with certain third parties including:

• the NDIS Commission;
• funding providers;
• regulatory bodies such as the National Disability Insurance Agency and Medicare;
• individuals acting on the subject's behalf;
• law enforcement;
• courts;
• financial institutions for payment processing; and
• external service providers.

These disclosures shall be in line with fulfilling our services, compliance with laws, or due to the subject's explicit authorisation.

Maintaining the Information Management System

Workers responsible for handling information must ensure information is entered into the Disability and Mental Health Care Pty Ltd document management system accurately and in a timely manner.

Regular system audits should be performed by management to ensure information is kept current and accurate.

Document storage and security

Disability and Mental Health Care Pty Ltd ensures the security of personal information via several strategies, including:

• website encryption;
• firewalls and anti-virus software;
• restricted system access with password protection;
• controlled physical access to premises;
• limiting data access to necessary Workers; and
• providing ongoing data security training and policies.

All documents, electronic or paper-based, must be stored in accordance with the following document storage and security procedures. This includes appropriate use, access, transfer, security, retrieval, retention, and disposal.

Storage

All electronic documents must be stored in a cloud-based storage system.

All paper-based documents should be converted into an electronic version and uploaded to a cloud-based storage system; the paper-based documents should be stored in a locked file cabinet or destroyed.

Transfer of documents

Ensure necessary consents have been obtained before transferring any document containing personal or sensitive data.

All confidential documents (physical or digital) should be clearly marked as "Confidential".

For internal document transfers: digital transfers should use secure, approved, company-controlled systems (like an intranet or secure shared drives) and access to the document should be restricted to only those who need it. Physical documents should be transferred directly hand-to-hand wherever possible. If this is not feasible, use internal mail services with a traceable delivery process.

For external document transfers: digital transfers should preferably be encrypted before transmission and use secure, approved methods (like secure email, secure file transfer protocol (SFTP), or encrypted cloud services). The encryption key or password should be shared via a separate, secure communication method. For sending physical documents outside of the organisation, use a reliable courier service that offers secure, traceable delivery. The documents should be packed in tamper-evident packaging.

Information Retention

Upon reaching the end of their defined retention periods, all physical and electronic documents must be disposed of in accordance with our document disposal procedures to guarantee safe and confidential elimination.

Unless mandated differently by legal requirements, all records and personal information of our Participants will be preserved for the following durations:

• For adult Participants: a minimum of seven years after they cease to be Participants of Disability and Mental Health Care Pty Ltd.
• For minor Participants: a minimum of 25 years after they cease to be Participants of Disability and Mental Health Care Pty Ltd.

Disposal of Information

During the disposal process, Workers should abide by the following steps:

• Determine if the documents have reached their designated end of the retention period. Ensure that there are no pending requests or legal obligations for these documents.
• Assign a classification to the documents based on the nature of their contents and the level of confidentiality.
• Unneeded working documents or copies of confidential information should be securely placed in designated bins or sufficiently shredded using cross-cut shredders for optimal security.
• In cases of highly confidential documents, extra measures such as engagement of certified document destruction services may be warranted.
• Documents devoid of confidential content may be suitably recycled.
• Prior to disposing of any electronic media, including computers, hard drives, USB keys, etc., Workers must ensure these devices are properly sanitised.
• Merely deleting a file does not completely erase it from a storage device. Workers should use secure file deletion software that overwrites the data, making it irretrievable.
• If external data destruction services are engaged, it is crucial to ensure that they adhere to the organisation's security standards and furnish a certificate of destruction upon completion of the task.

Incident reporting and management

Privacy incidents, such as unauthorised access, alteration, or destruction of personal information, can arise due to human errors, technical issues, or intentional actions, affecting both electronic and hard-copy data. These incidents must be promptly reported to minimise their impact.

Any privacy incident, whether having a major or minor impact, or even being a near miss with no apparent Participant impact, must be reported to the Incident Manager or other Key Personnel following the Incident Reporting Procedure.

Workers should be proficient in recognising potential privacy incidents and must promptly report all incidents. The emphasis of reporting is not to penalise individuals, but to reduce the potential impact of the incidents.

Disability and Mental Health Care Pty Ltd is committed to notifying relevant authorities within one business day upon recognising a potential privacy incident or receiving an allegation of a possible breach, including:

• the Department of Health and Human Services;
• the NDIS Commission; and
• the Office of the Australian Information Commissioner.

Training

All Workers must undergo regular training to ensure understanding and compliance with the Privacy and Information Management Policy and its associated procedures. Training will be provided upon induction and at regular intervals, as needed or when changes to the procedures are made.

It is important that all Workers adhere to these procedures to protect the rights and safety of our Participants.

Policy review and updates

This Policy is to be amended and updated according to the requirements to comply with the applicable laws and regulations.

Approval Authority	Supriya Thapa
Version	1
Approval Date	August 2025
Review Date	August 2027