Privacy and confidentiality

Purpose

Personal information is information in any form that can identify a living person. The Privacy Act 1988 (Cth) regulates how organisations collect, hold, use and disclose personal information, and how you can access and correct that information.

This policy sets out how Vitality Community Care respects and protects the personal and sensitive information of participants, and their dignity and right to privacy. It has been developed in accordance with the Privacy Act 1988, the Australian Privacy Principles and all applicable state and territory legislation, and applies to all records containing personal or sensitive information — hard copy or electronic — as well as any interviews or discussions of a sensitive personal nature.

Scope

This policy applies to:

• All Vitality Community Care staff — permanent or casual employees, contractors, consultants and volunteers.
• All participants receiving NDIS services and supports, including their families and support networks.

It covers all personal information collected by Vitality Community Care, including information collected through our website, social media and from other service providers.

Key definitions

Personal information

A broad range of information, or an opinion, that could identify an individual — for example your name, signature, address, phone number, date of birth, photographs, IP addresses, biometric information, credit information or location information from a mobile device.

Sensitive information

Information or an opinion about matters such as racial or ethnic origin, political opinions, religious or philosophical beliefs, professional or trade association membership, sexual orientation, criminal record, health information, genetic information or biometric data.

Confidentiality

Protecting the secrecy and privacy of information collected from individuals and organisations.

Data breach

A data breach happens when personal information is accessed or disclosed without authorisation, or is lost — for example when a device holding personal information is stolen, a database is hacked, or information is sent to the wrong person. An eligible data breach occurs when the breach is likely to result in serious harm to an individual and the organisation has been unable to prevent that risk with remedial action.

Our commitment

Vitality Community Care is committed to providing high-quality support and services that respect the dignity and privacy of each participant. We ensure that:

• Consistent processes and practices are in place that respect and protect the personal privacy and dignity of each participant.
• Each participant is advised of confidentiality policies using the language, mode of communication and terms they are most likely to understand.
• Each participant understands and agrees to what personal information will be collected and why, including recorded material in audio and/or visual format.

We comply with the Privacy Act 1988, the NDIS Quality and Safeguarding Framework, all applicable state or territory legislation, and the Australian Privacy Principles. Before any audio or visual material is recorded, participants give written permission using the Participant Consent Form. We also protect the privacy of our staff’s personal information, following the Fair Work Ombudsman’s Workplace Privacy Best Practice Guide.

Collecting your information

During intake, initial assessment and throughout service delivery, participants are informed of the types of information that will be collected, how their privacy will be safeguarded, and their rights. The Participant Handbook and Service Agreement in your Welcome Pack also explain these rights.

We only collect information that is reasonably necessary for, or directly related to, our services — and only with your consent. We may collect it from you, your representative, or a third party such as a referring provider, through:

• Paper-based and electronic forms (including online forms)
• Face-to-face meetings
• Telephone, email and fax communications
• Our website and social media accounts

The kinds of personal information we collect and hold include:

• Name, address and contact details
• Photographs, video and audio recordings (with written consent)
• Personal circumstances (e.g. marital status, age, gender, occupation, accommodation)
• Identity details (e.g. date of birth, country of birth)
• Background (e.g. languages spoken, cultural background)
• Government identifiers (e.g. NDIS Number, Centrelink Reference Number)

We may also collect sensitive information, including racial or ethnic origin, health information (medical history, disability or injury), and information about supports you receive from other providers.

How we use and disclose it

We collect and hold personal information for purposes relating to our responsibilities under your Service Agreement, including:

• Intake and referral processes
• Support planning and reviews
• Delivering services and supports
• Internal and external audits
• Complaints handling
• Incident management and investigation
• Management of correspondence

We use and disclose personal information for the primary purpose for which it was collected, and only use it for secondary purposes where the Privacy Act allows — for example where disclosure is required or authorised by the National Disability Insurance Scheme Act 2013. We may disclose your information to relevant parties such as the NDIA, state or territory agencies, regulatory bodies or other service providers — with your consent, or where we are legally required or permitted to do so.

Handling your information

All staff are responsible for handling personal information with care. When handling your information, our staff must:

• Keep information accurate, complete and up to date, and let you review or correct it
• Protect it from misuse, loss, unauthorised access, modification or disclosure
• Keep hard-copy participant records in a locked filing cabinet and password-protect all electronic files
• Destroy or permanently de-identify information that is no longer needed, with the Privacy Officer’s authorisation
• Obtain your consent before referring you to another provider or sharing information with government agencies
• Let you opt out of NDIS information sharing during audits

The confidentiality of participant records is maintained by the staff directly involved in providing your services, and records are only shared with your consent — or that of your advocate, guardian or legal representative. If you feel your right to privacy is not being protected, we encourage you to raise it with us — see our Feedback and Complaints page.

Access and correction

You have the right under the Privacy Act to access the personal information we hold about you, and to request corrections if you believe it is inaccurate, out of date, incomplete, irrelevant or misleading. The Privacy Act sets out limited circumstances in which we may decline access or correction (for example, where required by law or a court order).

To access or correct your information, contact our Privacy Officer:

Data security

Access to personal information is restricted to authorised Vitality Community Care staff and contractors. Electronic and paper records are protected in line with our Information Management Policy and Procedure, and we regularly conduct internal audits to ensure we adhere to our protective and computer security policies.

Data breach management

We deal promptly with any accidental or unauthorised disclosure of personal information, following the OAIC’s data breach notification guide. Under the Notifiable Data Breaches scheme, we must notify affected individuals and the Office of the Australian Information Commissioner (OAIC) if a breach is likely to cause serious harm.

Our Data Breach Response Team, led by the Privacy Officer, follows a documented Data Breach Response Plan:

• Assess and identify — quickly investigate any suspected breach (within 30 days) to determine whether it is likely to result in serious harm
• Remediate — take immediate steps to reduce potential harm, such as recovering information, isolating affected systems or ceasing unauthorised access
• Notify — promptly inform affected individuals and the OAIC of any eligible breach, including what happened, the kinds of information involved and recommended steps
• Improve — review what was learned, update policies, provide additional training and record outcomes in our Continuous Improvement Plan

If you think a data breach may affect your personal information and you have not been notified, contact the Privacy Officer on 0422 037 453 or muhsin.ahmed@vitalitycommunitycare.com.au.

Complaints and contact

If you have a question, concern or complaint about how your personal information has been handled, please contact us first and give us a reasonable period to respond (30 days). You can use our Feedback and Complaints form, call 1300 395 852, or contact the Privacy Officer directly.

If we do not respond, or you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au/privacy/privacy-complaints.

Policy details

Key references: Privacy Act 1988 (Cth) · Australian Privacy Principles · National Disability Insurance Scheme Act 2013 (Cth) · NDIS Practice Standards and Quality Indicators (November 2021) · Freedom of Information Act 1982 (Cth) · Privacy and Data Protection Act 2014 (VIC) · Health Records Act 2001 (VIC).