Loading...
Loading...
Sidebar Text
This Policy and Procedure have been structured to communicate to workers the correct and appropriate means for the security of confidential information, ensuring that sensitive data is handled responsibly, access is appropriately managed, and privacy is maintained in compliance with legal and organisational standards.
It aims to protect the rights of individuals, safeguard organisational information, and build trust by preventing unauthorised disclosure or misuse of confidential data. This Policy and Procedure helps mitigate risks associated with data breaches, ensuring compliance with legal obligations and maintaining the organisation’s reputation.
This Policy and Procedure extend to all CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD‘s workers, and failure to abide by this will result in strict disciplinary action. It must be reviewed in conjunction with the Records and Information Management Policy and Procedure. This Policy and Procedure meets relevant laws, regulations, and standards.
This Policy and Procedure also applies to remote staff working in administrative service delivery and internal operations from remote locations. While the NDIS Practice Standards do not prescribe specific approval requirements for remote work arrangements, any offshore access to NDIA systems remains subject to NDIA authorisation, where applicable.
Confidentiality – The state of keeping or being kept secret or private, professionals should not share personal details about someone with others unless that person has provided consent, or it is necessary.
Health Information – Data related to a person’s medical history, including symptoms, diagnoses, procedures, and outcomes.
Personal Information – Any information relating to an individual.
Privacy – The state of something being free from public attention.
Sensitive Information – Sensitive information relating to the business, staff or participants that should not be shared with others unless consent is provided or absolutely necessary.
▪ Approve, endorse, and ensure the development and regular review of the Privacy and Confidentiality Policy.
▪ Oversee its alignment with legal, regulatory, and organisational requirements (e.g., GDPR, Data Protection Act 2018).
▪ Set a clear tone from the top by promoting a culture of privacy, confidentiality, and ethical handling of sensitive information.
▪ Take full accountability for the organisation’s adherence to privacy laws and standards.
▪ Ensure adequate resources—such as training, tools, and systems—are in place to support the policy’s effective implementation.
▪ Invest in secure technologies and infrastructure for protecting confidential data.
▪ Monitor and manage risks related to data privacy and confidentiality, including responding to breaches or incidents.
▪ Support investigations and corrective actions when breaches occur, ensuring transparency and compliance.
▪ Ensure clear communication of the policy and its importance to all levels of the organisation.
▪ Regularly review reports on privacy compliance, breaches, or risks and make informed decisions to address any gaps.
▪ Ensure the organisation meets its legal obligations to safeguard personal and sensitive data.
▪ Lead by example in upholding confidentiality, demonstrating the highest standards of professional conduct.
Management
• Develop and regularly update the Privacy and Confidentiality Policy and Procedure.
• Communicate the policy clearly to all staff, ensuring everyone understands their obligations.
• Provide training to workers on handling sensitive information, data privacy laws (e.g., GDPR in the UK), and confidentiality protocols.
• Promote awareness of the consequences of breaching confidentiality.
• Control access to sensitive or confidential data. Ensure only authorised individuals can access specific information, based on their roles.
• Ensure that any remote staff handling administrative functions or internal operations are subject to the same privacy controls and access restrictions. Where remote access to NDIA systems is required from offshore locations, confirm NDIA authorisation is obtained and documented.
• Implement secure systems (e.g., password protection, encryption) for managing data and documents.
• Monitor compliance with the policy and conduct regular audits to identify any breaches or vulnerabilities.
• Establish systems to log access to sensitive data to track and detect unauthorised use.
• Create a clear process for reporting and addressing breaches of confidentiality or privacy incidents.
• Investigate breaches promptly and take corrective action, including disciplinary measures where necessary.
• Ensure the organisation complies with relevant privacy laws and data protection regulations (e.g., GDPR, Data Protection Act 2018).
• Maintain accountability for any legal liabilities resulting from breaches or mishandling of private information.
• Set guidelines for how long sensitive information is retained.
• Ensure secure and proper disposal or anonymisation of information no longer needed.
Worker
✦ Read and familiarise themselves with the Privacy and Confidentiality Policy and Procedure.
✦ Adhere strictly to the rules and guidelines provided.
✦ Handle personal, private, or sensitive information responsibly (e.g., participant, employee, or company data).
✦ Avoid sharing or discussing confidential information inappropriately (e.g., with unauthorised colleagues, in public spaces).
✦ Follow protocols for secure data storage, transfer, and access (e.g., using secure passwords, encryption, and avoiding sharing credentials).
✦ Lock devices, secure documents, and prevent unauthorised access.
✦ Report any breaches, leaks, or unauthorised access of confidential information to management immediately.
✦ Be proactive in identifying risks or lapses in confidentiality.
✦ Uphold confidentiality obligations during and after employment.
✦ Ensure discussions about sensitive matters happen only in appropriate and secure environments.
✦ Avoid unnecessary duplication of sensitive information.
✦ Take care not to leave physical or digital information unattended or exposed.
CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD is committed to protecting the privacy and confidentiality of both workers and participants by adhering to the Records and Information Management Policy and Procedure, alongside this Policy and Procedure. Privacy can only be maintained through the consistent application of proper procedures and safeguards for the storage, organisation, and disposal of sensitive information.
Each participant has the right to determine with whom they share their personal information. To ensure transparency and trust, participants will be advised of confidentiality policies using the language, mode of communication, and terms they are most likely to understand, ensuring clarity and accessibility.
CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD workers are responsible for safeguarding the privacy and security of participants and colleagues. Before any data is collected, participants must be assured that their information will be handled responsibly, securely, and used only for its intended purpose.
The Privacy and Confidentiality Policy and Procedure:
a) outlines the obligations of both CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD’s Management and workers to safeguard confidential information, maintain trust, and prevent breaches;
b) defines what information must be protected and the appropriate methods to ensure its privacy;
i) This Policy and Procedure focuses on ensuring that participant, employee, and business data—such as medical records, financial information, or contact details—are handled securely and ethically.
c) provides clear procedures for reporting and managing any unauthorised access or leaks, ensuring compliance with legal frameworks;
d) promotes ethical conduct in handling private information, fostering trust between the organisation and its stakeholders; and
e) helps the organisation maintain its reputation, avoid legal penalties, and uphold the rights of individuals whose information is processed.
Meanwhile, the Records and Information Policy and Procedure:
a) ensures the systematic management of all records and organisational information;
i) This Policy and Procedure sets clear guidelines for how long records should be retained and provides secure methods for their disposal to prevent information leaks or misuse.
b) covers the entire lifecycle of records, from creation and classification to storage, access, retention, and secure disposal;
i) Unlike the Privacy and Confidentiality Policy and Procedure, which focuses on protecting sensitive data, the Records and Information Policy and Procedure focuses on how information is created, maintained, and disposed of in an organised and secure manner.
c) prioritises the integrity, accuracy, and completeness of information, ensuring that it remains reliable and fit for purpose throughout its lifecycle; and
d) establishes processes to ensure records are well-organised, easily accessible to authorised personnel, and compliant with legal and regulatory standards.
i) CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD ensures compliance with records management requirements while promoting operational efficiency.
The procedures of privacy and confidentiality communicate with the lifecycle of data as follows: they ensure data is protected at every stage—creation, storage, use, sharing, and disposal. This prevents unauthorised access, maintains data integrity, and ensures legal compliance.
a) Create a collection of all forms of participant details, relevant information, and service agreements to ensure they have given both verbal and written consent.
b) Store all information securely per the Records and Information Management Policy and Procedure and limit access.
c) Use the information to update when applicable, communicate this information to staff members and report if necessary.
d) Archive the documents securely once the participant has exited the service as per the Records and Information Management policy and procedure and limit access.
e) Dispose of documents securely as per the Records and Information Management Policy and Procedure once the archive period is complete.
The Owner/CEO/Director is committed to ensuring that CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD follows the 1988 (Cth) Privacy Act standards, as well as any other relevant government and territory laws and specifications. All CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD‘s workers must read and comply with the state and federal legislation concerning privacy and confidentiality, including this Policy and Procedure. This includes:
a) Collection/Creation
b) Process
c) Storage
d) Utilisation
e) Disclosure
f) Disposal
CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD only gathers the necessary personal information of participants for the protected and adequate provision of plan management services. All private and confidential information must be stored safely. CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD will only require confidential information to determine potential participants’ suitability for plan management services and to monitor the services provided.
Before collecting personal information from participants or their advocates, CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD‘s workers must clarify why the information is being collected, exactly how it is being stored and used, as well as why CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD requires the information.
Following the information provided in this Policy and Procedure, CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD‘s workers must use a Participant Consent Form to verify and clarify the information stated in this Policy and Procedure. This consent form indicates whether participants have allowed CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD to hold, retain and use vital information of the participant. This information may include the following; however, it is not limited to:
a) Full Name
b) Nationality
c) Date of Birth
d) Preferences
e) Personal Goals
f) Medical Information
g) Referrals
h) Case/Progress Notes
CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD is required to provide workers with consent forms for personal information; that is, any information that can be used to identify an individual, which will be considered respectfully, and no information will be used without consent. Personal information additionally includes but is not limited to the following:
a) Photographs
b) Films
c) Recordings
CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD implements and employs the Privacy and Confidentiality Agreement for participants, their family members, and advocates. This is a document that has information on how CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD abides by all privacy laws whilst protecting participants who are in direct communication with participants. This document must be in the Participant Handbook. Their assigned personnel must do the following:
a) Ensure they have signed their own privacy statement annually and it is kept up to date.
b) Provide written information to participants if requested (such as this Policy and Procedure).
c) Provide verbal information to participants if requested.
d) Understand and comply with participants’ (or their related personnel) communicational requirements, such as overcoming any language barriers.
Personal worker’s data includes a range of information that can identify an individual employee, both directly and indirectly. This encompasses basic personal details such as name, contact information, and identification numbers, as well as employment-related data like job title, salary, attendance, and performance records.
It also covers sensitive information, including health records, training history, and digital data such as login credentials. All personal worker data must be handled with care to ensure privacy and compliance with data protection regulations.
a) Personal Information (Contact, Residence, etc.)
b) Payroll Information
c) Qualifications
d) Contract of Employment
e) Consent Forms
f) Specifics Regarding Qualified Registration
g) Tax Returns
h) Medical Information
i) Results of Background Checks
A participant is entitled to supply, access, update, and use any personal information if necessary to ensure correct information is in the system; they may refuse to disclose some information and have the right to revoke their consent to disclose personal information.
An NDIS-approved quality auditor has the right to request an interview from any participant file that requires assessment. CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD must ensure they are abiding by the standards outlined in the 2018 National Disability Insurance Scheme (Approved Quality Auditors Scheme) Guidelines.
This automatically includes participants in the NDIS Practice Standards audits. However, a participant may refuse to participate in audits with a written notice directed to the Owner/CEO/Director. In such cases, the organisation will respect the participant’s decision and ensure that their rights and preferences are upheld throughout the process.
Worker or participant personal information can only be disclosed in order to comply with legislative responsibilities such as mandatory reporting when required by law. If an individual is in a situation where they are unsure about disclosing another’s personal information, they should communicate and discuss it with the Owner/CEO/Director.
CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD is required to ensure that any foreign participants do not violate any Australian Privacy Principles (APPs); this is under the Privacy Act 1988. This requirement, however, will not apply if the foreign participant is dependent on legislation or a critical system that has the power to protect private and confidential information in an approach significantly equivalent to that delivered by the APPs.
Participants, their family members, and advocates are accountable for ensuring the correct use of others’ personal information, the return of the consent form, respecting people’s wishes not to be captured on camera, and ensuring the communication of accurate information.
Both the Owner/CEO/Director and workers will only access the personal information if it is necessary to fulfil any responsibilities or services for the CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD. All stakeholders can request access to any information regarding themselves.
Any participant access or modification demands must be presented to the individual of CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD who is responsible for monitoring the participant’s personal information. All workers have the same access to or requests for modification as participants.
The Owner/CEO/Director should be notified immediately, within two business days, for any access or correction of information. The individual responsible for the acceptance status of information will l either accept or reject it with reasoning as to why.
A request for access or correction may be rejected as it would have an unwarranted impact on the privacy and confidentiality of other individuals. The proposal is thoughtless and annoying. It may cause a dangerous threat to any individual’s life or well-being.
All participant requests for access or correction refused by the CEO/ Director must be authorised and documented in the participant’s file. Any workers who have been denied access or correction requests must be approved by the CEO/ Director and recorded in the individual’s file.
CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD’s workers will support participants in accessing an interpreter when needed by identifying language barriers and arranging appropriate interpreting services, such as in-person, telephone, or video interpretation. Workers will ensure timely access to interpreters, enabling clear communication and understanding, while maintaining confidentiality and privacy during the process.
Violations include but are not limited to any actions or failures that compromise the security, confidentiality, or integrity of sensitive information. These violations can occur due to various factors, such as lapses in management oversight, weaknesses in security systems, deliberate misconduct, or technical failures. Violations include but are not limited to:
a) Devices and documents containing private or confidential information are lost or stolen.
b) Unapproved entry by a worker to personal information.
c) Unintentional release of private or confidential information.
d) Hacking of electronic devices.
The impact of such violations can range from economic harm and legal consequences to reputational damage and loss of trust, affecting both the organisation and its stakeholders. It is essential to identify, address, and prevent these violations to ensure compliance and maintain the protection of sensitive data.
The Notifiable Data Breaches (NDB) Scheme is a federal scheme established under the Privacy Act 1988 (Cth). CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD is required to report eligible data breaches to the Office of the Australian Information Commissioner (OAIC). A data breach occurs when personal information held by the organisation is accessed, disclosed, or lost in a way that is unauthorised or unintended.
Data breaches may result from failures in management or security systems, malicious acts, or technical errors. Such incidents can lead to significant economic harm, reputational damage, loss of participant trust, and legal implications for CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD.
All staff must understand and comply with this policy and the related procedures, including reporting suspected breaches immediately to Management to ensure appropriate action is taken in line with the NDB Scheme and any other applicable legal or regulatory obligations.
A Notifiable Data Breach (NDB) occurs when CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD cannot prevent the potential risk of harm through corrective measures. It also occurs when the release or access to private information is not permitted, or data is lost in circumstances in which unauthorised access or release is probable to be present.
Release or loss is expected to affect all individuals involved with the information. Severe damage may include damage to credibility in the form of a breach of information which may result in: loss of trust from stakeholders, penalties, financial consequences, and reputational harm. The three (3) main categories of data breach impact that help identify an NDB are:
a) Physical damage
b) Emotional damage
c) Financial damage
Any suspected or current information breaches must be identified to the Owner/CEO/Director, who is responsible for assessing the action of CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD and if the breach is to be registered under the NDB Scheme. It will not be considered a notifiable data breach if the CEO/ Director of CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD responds promptly to reduce the information violation.
Should a data breach event occur, CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD follows a methodological process to minimise the damage of the event as well as appropriate input measures to prevent future occurrence. The Owner/CEO/Director or delegate is responsible for managing this incident immediately by following this procedure:
a) All implicated individuals will be informed of the breach of information as promptly as possible by the Owner/CEO/Director or delegate. This event should be documented by CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD in the Incident Register, with information on which efforts were utilised to prevent the situation from occurring again.
b) They must begin with controlling information violation, meaning they must put into effect appropriate measures to minimise which information may be viewed or leaked. This can be done by removing electronic files from the location of the breach into an external hard drive inaccessible to others.
c) They then must formulate a conclusive list/record of which information was breached and discuss or implement measures to minimise any associated or related threats to others. For example, CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD may have to change personal financial or business details to ensure the safety and protection of the organisation and its workers.
d) CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD must then evaluate the overall threat and the possible extenuating circumstances that may arise due to the breach. For example, it may be notifiable to the Australian Information Commissioner or notifiable to Management, workers, or participants of CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD.
e) CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD must then input preventative measures to minimise the risk of recurrence. This may include liaising with an external organisation, such as an IT company, for further assistance.
If required, the Owner/CEO/Director or delegate may liaise with external organisations to minimise the opportunity for reoccurrence, theft, and harm. If the data breach is considered notifiable, then the Owner/CEO/Director or delegate must respond accordingly. The Owner/CEO/Director or delegate is responsible for the following:
a) assessing the risk from infringement;
b) supporting the Human Resources Manager where the worker’s actions caused the infringement;
c) providing media/communications knowledge and helping to communicate with impacted people and deal with media and external stakeholders;
d) acting as Project Manager, coordinating the team and supporting its participants;
e) acting as Senior Worker to introduce privacy knowledge to the team;
f) acting as Team Leader, accountable for guiding the reaction team and reporting to the CEO/ Director (unless they are the same person);
g) legal assistance, identifying legal commitments and providing guidance;
h) supporting information and communication technology (ICT) or forensics, helping to define the cause and effect of infringement involving ICT technologies; and
i) providing information and documents management knowledge, assisting in the review of breach-related safety, tracking checks (e.g., access, authentication, encryption, audit logs) and providing guidance on recording data breach reaction.
CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD will ensure proactive strategies are in place to maintain high service standards, protect participants’ rights, and foster continuous improvement. CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD will subscribe and educate on the following safeguards to ensure that it cooperates completely with the NDIS Practice Standards and Quality Indicators:
a) CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD will collaborate with the Government on the implementation of risk-based reporting mechanisms and ensure that CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD takes reasonable steps to protect all participant records.
b) CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD will subscribe to the Australian Cyber Security Centre (ACSC) alert service at:
i) cyber.gov.au/about-us/register
c) CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD will review its compliance with Essential Eight and rectify any identified gaps. This website helps with knowledgeable online behaviour patterns as well as how to respond to internet threats. CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD can access this information at:
i) https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight
Any breaches must be immediately reported to the NDIS Commission by the Owner/CEO/Director of CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD. Violations of information may also affect reporting obligations beyond the Privacy Act 1988, such as:
a) Government Departments of the Federal, State or Territory
b) The Australian Securities and Investment Commission (ASIC)
c) Australian Reporting and Analysis Centre (AUSTRAC)
d) Australian Tax Office (ATO)
e) Australian Prudential Regulation Authority (APRA)
f) Australian Cyber Security Centre (ACSC)
g) Australian Digital Health Agency (ADHA)
h) Professional and regulatory organisations
i) The financial service sector of CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD including insurance providers
j) The police or other law prosecution organisations
CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD is required to give workers appropriate training regarding their knowledge of systems in place for the confidentiality of company data; this will be done through performance reviews, in conjunction with the Human Resources Policy and Procedure.
If it is found that a worker does not encompass correct knowledge, suppose it is found that a worker does not contain correct understanding, extra training may be given to ensure consistency throughout CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD.
CARING HANDS COMMUNITY SUPPORT SERVICES PTY LTD may make changes to this Policy and Procedure from time to time to improve the effectiveness of its operation. This entire Policy will be reviewed in consultation with people using the service, their families, carers and workers every year. All activities related to service planning, delivery, and evaluation will include workers, participants, and other stakeholders, and their feedback.
