Privacy and Information Management Policy

Privacy and Dignity
Outcome: Each participant accesses supports that respect and protect their dignity and right to privacy. To achieve this outcome, the following indicators should be demonstrated:‍

1. Consistent processes and practices are in place that respect and protect the personal privacy and dignity of each participant.
2. Each participant is advised of confidentiality policies using the language, mode of communication and terms that the participant is most likely to understand
3. Each participant understands and agrees to what personal information will be collected and why, including recorded material in audio and/or visual format.

Information Management
Outcome: Management of each participant’s information ensures that it is identifiable, accurately recorded, current and confidential. Each participant’s information is easily accessible to the participant and appropriately utilised by relevant workers. To achieve this outcome, the following indicators should be demonstrated:

1. Each participant’s consent is obtained to collect, use and retain their information or to disclose their information (including assessments) to other parties, including details of the purpose of collection, use and disclosure. Each participant is informed in what circumstances the information could be disclosed, including that the information could be provided without their consent if required or authorised by law. ‍
2. Each participant is informed of how their information is stored and used, and when and how each participant can access or correct their information, and withdraw or amend their prior consent. ‍
3. An information management system is maintained that is relevant and proportionate to the size and scale of the organisation and records each participant’s information in an accurate and timely manner. ‍
4. Documents are stored with appropriate use, access, transfer, storage, security, retrieval, retention, destruction and disposal processes relevant and proportionate to the scope and complexity of supports delivered.

1. Privacy Consent Form
2. Privacy Consent Form (Easy Read) ‍
3. Incident Management Policy
4. Incident Report Form
5. Feedback and Complaints Policy

1. The Directors of Great Disability Support PTY LTD are responsible for the development and review of this policy. The Directors of Great Disability Support PTY LTD ensure this Policy remains compliant with all applicable laws, regulations and standards.
2. Key Management Personnel play a vital role in ensuring the effective implementation of this Policy throughout Great Disability Support PTY LTD. It is the responsibility of all Key Management Personnel to not only assist Workers in understanding and complying with this policy but also to comply with it themselves. By leading by example, they demonstrate the importance of adherence to the policy and foster a culture of compliance within the organisation.
3. ‍Workers are responsible for understanding the contents of this policy and complying with all procedures applicable to them.

5.1. Protection of Sensitive Information

1. As part of Great Disability Support PTY LTD’s Privacy and Information Management Policy, we carefully manage sensitive information to protect the privacy and dignity of our participants.
2. Great Disability Support PTY LTD only collects sensitive information where it is reasonably necessary for our functions or activities. This could include health and medical information and information relating to disability and support requirements. This will only be done under two circumstances:
   1) The individual has given explicit consent.
   2) Great Disability Support PTY LTD is required or authorised by law, including applicable privacy legislation, to do so.
   ‍
3. Great Disability Support PTY LTD is committed to treating all Participants with dignity and respect. We take all reasonable measures to protect the privacy and dignity of each participant, particularly when handling their sensitive information.

5.2. Obtaining Participant consent

1. During intake, or when consent is otherwise required, the responsible Great Disability Support PTY LTD Worker must explain, in the language, communication method and terms the Participant is most likely to understand, what information will be collected, why it is needed, how it will be used and stored, who it may be disclosed to, and when it may be disclosed without consent because it is required or authorised by law.
2. The Worker must take reasonable steps to address communication needs, support questions and allow sufficient time for the Participant to consider the information.
3. The Participant may use an interpreter, advocate or other chosen supporter if they wish.
4. Consent may be provided in writing or verbally. All consent must be recorded using the Privacy Consent Form. Where consent is provided verbally, the Worker receiving the consent must complete the form and record the date, how the consent was provided, the scope and purpose of the consent, any representative involved, and the Worker’s name. The Participant may withdraw or amend consent, subject to any collection, use, retention or disclosure required or authorised by law.  

5.3. Informing Participants about their information

1. Participants are informed about the collection, storage, use and disclosure of their information during intake, or as soon as practicable after collection. Updated information is provided when relevant practices materially change, consent is reviewed or amended, or the Participant requests it.
2. Communications must protect the Participant’s privacy and confidentiality and be provided in a way that reasonably responds to the Participant’s communication needs.
3. Participants may request access to or correction of their information, or withdraw or amend consent, by contacting Great Disability Support PTY LTD verbally, in writing, by email or through the contact methods published on the Great Disability Support PTY LTD website and service documents.
4. A Participant may involve a nominee, advocate or other chosen supporter where the Participant wishes and authorises their involvement.
5. Privacy complaints may be made to Great Disability Support Pty Ltd through the same contact methods and will be handled under the Feedback and Complaints Policy. A person may contact the NDIS Quality and Safeguards Commission at any time about NDIS supports or services. For a privacy complaint to the Office of the Australian Information Commissioner, the person must first complain to Great Disability Support Pty Ltd. If no response is received within 30 days, or the person is dissatisfied with the response, they may lodge a complaint with the Office of the Australian Information Commissioner.
6. This Policy will be available free of charge on the Great Disability Support PTY LTD website and, upon request, in a reasonably accessible form.

5.4. Information collected and stored

1. The personal information Great Disability Support PTY LTD collects and securely store includes:
   1) Participant Details including Name, contact details, gender, date of birth, marital status, disability and support needs.
   2) Identifiers such as Numbers used by the government or other organisations for identification.
   3) Service Details such as Information about provided services and delivery methods.
   4) Medical Information including Health and medical details relevant to service provision.
   5) Financial Information including Billing details and information about funded services under NDIS or otherwise.
   6) Interaction Records including Records of conversations and interactions with our workers.
2. Great Disability Support Pty Ltd may collect photographs, video, audio or other recorded material where it is relevant to its functions or activities. The Participant will be informed of the purpose, intended use and any proposed disclosure, and their consent will be obtained and recorded before collection, unless the collection is otherwise required or authorised by law.

5.5. Information collection methods

Great Disability Support PTY LTD collects personal information through various means to ensure the effective delivery of our services. These methods include:

1. Information collected through forms or interactions on the Great Disability Support PTY LTD website. ‍
2. Information gathered when individuals correspond with us, for example via letters, faxes, emails, or telephone calls. ‍
3. Personal data collected through forms filled out in-person or received via mail. ‍
4. Information collected directly during face-to-face interactions. ‍
5. Information obtained from referring third parties, such as the National Disability Insurance Scheme or a support coordinator. ‍
6. Personal information collected from participants during events and forums. ‍
7. Personal information received from third party funding and Government Agencies.

5.6. Purpose of personal information collection

‍As an NDIS service provider, Great Disability Support PTY LTD collects personal information to manage, provide, and enhance our services. This data collection enables us to:

1. Understand and evaluate Participants' specific needs, preferences, and goals to customise Participant Support plans.
2. Answer Participant inquiries, administer services, process payments, and provide tailored supports as per the Participants' NDIS plans.
3. Keep Participants updated about their plans, our services, and any changes or updates, including information about disability supports and the NDIS.
4. Carry out quality assurance activities including surveys, research, and analysis, resolve complaints, and continually refine our services to meet the NDIS Practice Standards and Quality Indicators.
5. Adhere to legal, regulatory, and reporting obligations, including incident reporting, record keeping, and providing reports to funding and government agencies.
6. Communicate with individuals about Great Disability Support PTY LTD services and activities. Marketing communications will only be sent where permitted by law and will include a simple method of opting out.
7. Invite individuals to participate voluntarily in consultation, surveys, advisory groups or other service-evaluation activities that contribute to the evaluation and improvement of Great Disability Support Pty Ltd’s services. Participation is voluntary and declining to participate will not affect access to services. Consent must be obtained before personal information is collected, used or disclosed for these activities.
8. Operate and improve the Great Disability Support PTY LTD website. Any cookies, analytics or similar technologies used will be described accurately in the applicable website privacy or cookie notice.
   

5.7. Third party disclosures

Where relevant and legally permitted, Great Disability Support PTY LTD may disclose personal information to:

1. the NDIS Quality and Safeguards Commission;
2. the National Disability Insurance Agency, plan managers and other funding bodies;
3. health, emergency or other service providers involved in the Participant’s supports;
4. authorised nominees, guardians, advocates, representatives or chosen supporters;
5. 5law-enforcement bodies or courts;
6. financial institutions and payment-processing providers;
7. professional advisers, auditors and insurers; and
8. information technology, administrative and other service providers that require the information to perform services for Great Disability Support PTY LTD.

Great Disability Support PTY LTD will use or disclose personal information only for the purpose for which it was collected, with consent, where the individual would reasonably expect a related use or disclosure, or where the use or disclosure is otherwise required or authorised by law. Only information reasonably necessary for the relevant purpose will be shared.

5.8. Maintaining the Information Management System

1. Workers responsible for handling information must ensure information is entered into the Great Disability Support PTY LTD document management system accurately and in a timely manner.
2. Management will take reasonable and proportionate steps to keep information current and accurate, including updating information when advised of changes and addressing inaccuracies identified through participant reviews, file reviews, internal audits, incidents, complaints or other routine oversight.

5.9. Document storage and securit

1. Great Disability Support PTY LTD ensures the security of personal information via several strategies, including:
   1) website encryption;
   2) firewalls, anti-virus software;
   3) restricted system access with password protection;
   4) controlled physical access to premises;
   5) limiting data access to necessary Workers; and
   6) providing ongoing data security training and policies.
   ‍
2. All documents, electronic or paper-based, must be stored in accordance with the following document storage and security procedures. This includes appropriate use, access, transfer, security, retrieval, retention, and disposal.
   • Storage
     ‍(i) Electronic participant records must be stored only in approved, company-controlled systems. All electronic based documents must be stored in a cloud based storage system.
     (ii) Paper participant records, where required, must be kept secure in locked cabinets and uploaded or securely destroyed where appropriate. Unnecessary duplicate copies should not be retained.
   • Transfer of documents
     ‍(i) Documents containing personal information may be accessed or transferred only by authorised Workers for a legitimate work purpose and where the transfer is covered by the Participant’s consent or is otherwise permitted or required by law.
     (ii) Electronic transfers must use secure methods approved by Great Disability Support Pty Ltd and appropriate to the sensitivity and risk of the information.
     (iii) Physical participant information must be transported only when necessary, in the approved lockable document case, and kept secure and under the control of an authorised Worker while in transit.
   • ‍Information Retention
     (i) Upon reaching the end of their defined retention periods, all physical and electronic documents must be disposed of in accordance with our document disposal procedures to guarantee safe and confidential elimination.
     (ii) Unless a longer retention period is required by law, a court or tribunal order, a funding arrangement, or an active complaint, incident, investigation or legal proceeding:
     
     A. For Adult Participant - Records must be retained for at least seven years after the Participant ceases receiving services from Great Disability Support Pty Ltd.
     B. For Minor Participant - Records relating to a Participant who was under 18 when services ceased must be retained until the Participant turns 25, or for at least seven years after services cease, whichever is later.
     C. Complaint records must be retained for seven years from the date the record is made
     D. Incident records must be retained for seven years from the date the record is made. Records of reportable incidents must be retained for seven years from the date notification is given to the NDIS Quality and Safeguards Commission.
     
     After the applicable retention period expires, information that is no longer required must be securely destroyed or de-identified.
     ‍
   • Disposal of Information
     ‍During the disposal process, Workers should abide by the following steps:
     
     (i) Determine if the documents have reached their designated end of the retention period. Ensure that there are no pending requests or legal obligations for these documents.
     (ii) Assign a classification to the documents based on the nature of their contents and the level of confidentiality.
     (iii) Unneeded working documents or copies of confidential information should be securely placed in designated bins or sufficiently shredded using cross-cut shredders for optimal security.
     (iv) In cases of highly confidential documents, extra measures such as engagement of certified document destruction services may be warranted.
     (v) Documents devoid of confidential content may be suitably recycled.
     (vi) Prior to disposing of any electronic media, including computers, hard drives, USB keys, etc., Workers must ensure these devices are properly sanitised.
     (vii) Merely deleting a file does not completely erase it from a storage device. Workers should use secure file deletion software that overwrites the data, making it irretrievable.
     viii) If external data destruction services are engaged, it is crucial to ensure that they adhere to the organisation's security standards and furnish a certificate of destruction upon completion of the task.
   ‍

5.10. Incident reporting and management

1. Privacy incidents, such as unauthorised access, alteration, or destruction of personal information, can arise due to human errors, technical issues, or intentional actions, affecting both electronic and hard-copy data. These incidents must be promptly reported to minimise their impact.
2. Any privacy incident, whether having a major or minor impact, or even being a near miss with no apparent Participant impact, must be reported to the Incident Manager or other Key Personnel following the Incident Reporting Procedure.
3. Workers should be proficient in recognizing potential privacy incidents and must promptly report all incidents. The emphasis of reporting is not to penalise individuals, but to reduce the potential impact of the incidents.
4. Great Disability Support PTY LTD will promptly contain and assess any suspected privacy or data breach. Where there are reasonable grounds to suspect an eligible data breach, Great Disability Support PTY LTD will conduct a reasonable and expeditious assessment and take all reasonable steps to complete the assessment within 30 days. Where there are reasonable grounds to believe an eligible data breach has occurred, Great Disability Support PTY LTD will notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable. Great Disability Support PTY LTD will notify the NDIS Commission or another authority only where the incident meets that authority’s legal reporting threshold and within the applicable timeframe.

5.11. Training

1. All Workers must receive privacy and information-handling instruction during induction. Further training or updates will be provided where required by the Worker’s role, changes to legislation, systems or procedures, privacy incidents or trends, identified knowledge gaps, or management direction.
2. It is important that all Workers adhere to these procedures to protect the rights and safety of our Participants.