Privacy and Client Information Policy

Purpose. This policy explains how Willow Community Care collects, uses, stores, shares and disposes of personal and health information about the people it supports and its workforce.

1.Purpose and scope

Willow must handle personal and health information in line with the Privacy Act 1988, the Australian Privacy Principles, the Health Records Act 2001 (Victoria) and its obligations under the NDIS and aged care legislation. This policy applies to all records, whether paper, electronic, photographs or recordings.

2.Collection

Willow will collect only the information it needs to plan and deliver safe support and to meet funding and reporting obligations. Workers must explain to the person, in a way they understand, what is collected and why, and must record consent on the Client Intake and Consent Form. Information will be collected from the person wherever possible, and from family, carers or other services only with consent or where the law allows.

3.Use and disclosure

Information will be used for the purpose it was collected for. Workers must not discuss a client with anyone who does not need to know, including other clients, their own family or social media. Willow will share information without consent only where required by law, to prevent a serious threat to life, health or safety, or under an information sharing scheme for child wellbeing or family violence.

• Family Violence Information Sharing Scheme
• Child Information Sharing Scheme
• Mandatory reports to Child Protection
• Reportable incident notifications to regulators
• Court orders and subpoenas

4.Storage and security

Client records must be kept in the Client Register and Progress Notes systems and not on personal devices, personal email or paper notebooks. Paper records must be locked away when not in use and destroyed by secure shredding when scanned. Workers must lock screens, use their own login and never share passwords.

5.Access and correction

A person will be able to see the information Willow holds about them and to ask for corrections. Requests must be logged in the Feedback and Complaints Register and answered within 30 days. Where access is refused in part, for example to protect another person, the reason will be explained in writing.

6.Retention and disposal

Client records must be kept for seven years after the last service, or until a child client turns 25, whichever is later. Records must be disposed of securely and the disposal recorded. Workforce records are kept in line with the Fair Work Act 2009 and the Willow retention schedule.

7.Breaches

Any lost device, misdirected email, unauthorised access or other suspected breach must be reported to the Quality and Safeguarding Manager on the day it is discovered. Willow will assess the breach, contain it, notify affected people and the Office of the Australian Information Commissioner where the breach is likely to cause serious harm, and record the lessons in the continuous improvement register.