Privacy and Confidentiality Policy

Purpose and Scope

The purpose of this policy is to ensure that the management of participants' personal information meets all relevant legislative and regulatory requirements. This policy and procedure apply to current and potential participants, their carers, and family members.

Risk

Individuals with disabilities are more vulnerable to exploitation and abuse than others in the community. As a result, workers with access to participant information automatically occupy risk-assessed roles under the NDIS Commission.

The primary risk to privacy and confidentiality stems from the collection, storage, and sharing of participant information. Unauthorized access may expose participants to risk. This policy addresses these issues by implementing safe storage and access measures to protect participants from abuse and exploitation.

There is a risk that information may be shared inadvertently and without the intention to cause harm. Information might be unintentionally disclosed due to careless use of tablet- or phone-based software, shared with a participant's supporters against their wishes, or disclosed to peers under the assumption that the information is publicly known. Cultural assumptions surrounding information sharing are diverse and change rapidly. Social media platforms may allow participants to be identified.

To minimize these risks, the following measures should be implemented:

• Raise staff awareness of privacy and confidentiality.
• Ensure consent is obtained before gathering data (including audio and photographic data).
• Ensure that consent is specific to the use of data and remains current.
• Encourage participants to provide feedback and submit complaints about the use of their information.
• These measures are addressed in this policy.

Policy Statement

Find Plan NDIS Plan Management is committed to protecting the privacy and confidentiality of participant information in accordance with applicable legislative and regulatory requirements. We recognize our responsibility to handle personal information securely and responsibly, ensuring the protection of participant privacy and confidentiality at all times.

Principles

The following principles guide our approach to managing participant information:

• a) Compliance with relevant legislation, including the Privacy Act 1988, the Australian Privacy Principles, and the NDIS Quality and Safeguards Framework.
• b) Collecting personal information only when necessary for providing our services and collecting it lawfully and fairly.
• c) Ensuring that participants, carers, and family members are informed of the purpose for which their personal information is being collected and how it will be used, stored, and disclosed.
• d) Obtaining consent from participants, carers, or family members before collecting, using, or disclosing their personal information, unless required or permitted by law.
• e) Providing access to participants, carers, and family members to view, update, or correct their personal information, in accordance with relevant legislation.
• f) Implementing appropriate security measures to protect personal information from unauthorized access, disclosure, modification, or destruction.
• g) Retaining personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law.
• h) Ensuring that staff members are trained and aware of their obligations regarding privacy and confidentiality.

Procedures

To support these principles, Find Plan NDIS Plan Management will implement the following procedures:

• a) Regularly review and update our privacy policies and procedures to ensure their ongoing effectiveness and compliance with legislative and regulatory requirements.
• b) Provide training to staff members on privacy and confidentiality, including their responsibilities under relevant legislation and the consequences of non-compliance.
• c) Establish and maintain secure systems and processes for collecting, storing, and managing personal information.
• d) Monitor and audit compliance with our privacy policies and procedures and take appropriate action in response to any breaches or non-compliance.
• e) Encourage feedback and complaints from participants, carers, and family members regarding our handling of personal information and address any concerns promptly and appropriately.

By adhering to this policy and its associated procedures, Find Plan NDIS Plan Management aims to foster a culture of privacy and confidentiality and ensure the ongoing protection of participant information.

Roles and Responsibilities

Find Plan NDIS Plan Management, staff, and service partners share responsibility for the protection of participant information and adherence to this policy. Their roles and responsibilities are as follows:

a) Management

• Ensure that policies and procedures related to privacy and confidentiality are developed, implemented, and maintained.
• Provide necessary resources and support for the effective implementation of privacy and confidentiality measures.
• Monitor and review the effectiveness of privacy and confidentiality policies and procedures, making adjustments as necessary.
• Ensure that all staff members receive appropriate training on privacy and confidentiality requirements.

b) Staff Members

• Adhere to privacy and confidentiality policies and procedures at all times.
• Attend required training sessions and remain informed of their obligations under relevant legislation and company policies.
• Report any breaches of privacy or confidentiality to management as soon as possible.
• Consult with management on any issues related to privacy and confidentiality, seeking guidance when necessary.

c) Service Partners

• Comply with privacy and confidentiality policies and procedures as outlined in their agreements with Find Plan NDIS Plan Management.
• Report any breaches of privacy or confidentiality to Find Plan NDIS Plan Management as soon as possible.

Review and Monitoring

Find Plan NDIS Plan Management is committed to ensuring the ongoing effectiveness of our privacy and confidentiality policies and procedures. To achieve this, we will:

• a) Regularly review and update our policies and procedures to ensure they remain compliant with relevant legislation and regulatory requirements.
• b) Conduct internal audits and assessments to monitor compliance with our privacy and confidentiality policies and procedures.
• c) Address any identified issues or breaches of privacy and confidentiality promptly and effectively, taking corrective action where necessary.
• d) Encourage feedback from participants, carers, family members, and staff on our privacy and confidentiality practices, using this feedback to inform improvements and updates to our policies and procedures.

By maintaining a strong focus on the review and monitoring of our privacy and confidentiality practices, Find Plan NDIS Plan Management aims to provide a secure and compliant environment that protects the privacy of our participants, carers, and family members.

Feedback and Complaints

Find Plan NDIS Plan Management values feedback and encourages participants, carers, family members, and staff to share their concerns, suggestions, or experiences related to our privacy and confidentiality practices. We believe that feedback helps us to continually improve and maintain the highest standards of privacy and confidentiality.

a) Providing Feedback

Participants, carers, family members, and staff can provide feedback through various channels, including email, phone, or our online feedback form. We also welcome feedback during regular meetings or reviews with participants and their families or carers.

b) Complaints Process

If a participant, carer, family member, or staff member has a concern or complaint related to privacy or confidentiality, they should report it to Find Plan NDIS Plan Management management as soon as possible.

All complaints will be treated seriously and handled promptly, fairly, and confidentially, in accordance with our Complaints Policy and Procedure. We will investigate the complaint, take appropriate action to address the issue, and inform the complainant of the outcome.

Policy Updates and Distribution

Find Plan NDIS Plan Management will review and update this Privacy and Confidentiality Policy periodically, or as required by changes in legislation, regulations, or organisational needs. All updates will be communicated to staff, service partners, participants, carers, and family members, as appropriate.

a) Distribution

This policy will be made available on our website and in our office. Staff members and contractors will receive a copy of the policy during their induction process. Participants, carers, and family members will be provided with a copy of the policy upon commencement of services and whenever updates are made.

By implementing and adhering to this Privacy and Confidentiality Policy, Find Plan NDIS Plan Management is committed to ensuring the highest standards of privacy and confidentiality for our participants, carers, family members, and staff.

Record Keeping

Find Plan NDIS Plan Management will maintain accurate and up-to-date records to demonstrate compliance with our Privacy and Confidentiality Policy and relevant legislation.

a) Record Retention

Personal information collected from participants, carers, and family members will be retained only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Records related to privacy and confidentiality training, audits, complaints, and other relevant activities will be retained in accordance with our record retention policy and legislative requirements.

b) Secure Storage and Destruction

All records containing personal information will be stored securely to protect against unauthorised access, disclosure, modification, or destruction. When personal information is no longer needed, it will be securely destroyed or de-identified in accordance with our record retention policy and legislative requirements.

By implementing effective record keeping practices, Find Plan NDIS Plan Management aims to ensure the ongoing protection of participant, carer, family member, and staff privacy and confidentiality, while maintaining compliance with relevant legislation and regulations.

Data Breach Response Plan

In the event of a data breach involving personal information, Find Plan NDIS Plan Management is committed to responding quickly and effectively to minimise any potential harm to participants, carers, family members, staff, and the organisation.

a) Identifying and Reporting Data Breaches

Staff members and contractors must immediately report any suspected or actual data breaches to their supervisor or Find Plan NDIS Plan Management management. Management will assess the situation to determine if a data breach has occurred and whether it is likely to result in serious harm to any affected individuals.

b) Containing and Assessing Data Breaches

Upon identification of a data breach, Find Plan NDIS Plan Management will take immediate steps to contain the breach and prevent any further unauthorised access, disclosure, or loss of personal information. Management will conduct a thorough assessment of the data breach to determine the cause, extent, and potential impact on affected individuals.

c) Notification and Reporting

If a data breach is likely to result in serious harm to any affected individuals, Find Plan NDIS Plan Management will notify the individuals and the relevant regulatory authorities as required by the Privacy Act 1988 and other applicable laws including the Office of the Australian Information Commissioner (OAIC). Notification will include information about the breach, the type of personal information involved, and steps that individuals can take to protect themselves from potential harm.

d) Review and Improvement

Following a data breach, Find Plan NDIS Plan Management will review the incident and its response to identify any areas for improvement in our privacy and confidentiality policies, procedures, and practices. We will implement any necessary changes to prevent similar breaches from occurring in the future and to continually enhance our privacy and confidentiality protections.

By having a robust data breach response plan in place, Find Plan NDIS Plan Management demonstrates our commitment to protecting the privacy and confidentiality of our participants, carers, family members, staff, and the organisation as a whole.

Third-Party Service Providers

Find Plan NDIS Plan Management may engage third-party service providers to assist in delivering our services or conducting our business operations. In such cases, we will ensure that these providers handle personal information in a manner consistent with our Privacy and Confidentiality Policy and relevant legislation.

a) Selection and Contracting

When selecting third-party service providers, Find Plan NDIS Plan Management will consider their privacy and confidentiality practices, as well as their ability to comply with relevant legislation and regulations. We will include appropriate clauses in our contracts with third-party providers to ensure that they comply with our Privacy and Confidentiality Policy and applicable laws when handling personal information on our behalf.

b) Monitoring and Compliance

Find Plan NDIS Plan Management will monitor the privacy and confidentiality practices of third-party service providers through regular audits, reviews, and assessments. In the event of non-compliance or a data breach involving a third-party provider, we will work with the provider to address the issue and take appropriate corrective action, which may include terminating the contract if necessary.

Cross-Border Disclosure of Personal Information

Find Plan NDIS Plan Management recognizes that in some cases, personal information may be transferred, accessed, or stored outside of Australia. We are committed to ensuring that such cross-border disclosures comply with relevant legislation and maintain the privacy and confidentiality of participant, carer, family member, and staff information.

a) Compliance with Legislation

Find Plan NDIS Plan Management will ensure that any cross-border disclosure of personal information complies with the Australian Privacy Principles, the Privacy Act 1988, and any other applicable laws or regulations. We will take reasonable steps to ensure that overseas recipients of personal information handle the information in a manner consistent with our Privacy and Confidentiality Policy and relevant legislation.

b) Consent and Notification

When collecting personal information that may be subject to cross-border disclosure, Find Plan NDIS Plan Management will inform participants, carers, family members, and staff of this possibility and obtain their consent, where required by law. We will also provide information about the countries in which the data may be transferred, accessed, or stored, and any potential risks associated with such cross-border disclosures.

By implementing these measures, Find Plan NDIS Plan Management aims to maintain the highest standards of privacy and confidentiality when transferring, accessing, or storing personal information across international borders.

Technology and Data Security

Find Plan NDIS Plan Management is committed to using technology responsibly and securely to protect personal information. We will implement appropriate technical and organisational measures to safeguard personal information from unauthorised access, disclosure, modification, or destruction.

a) Information Security

Find Plan NDIS Plan Management will maintain up-to-date and effective security measures, including firewalls, encryption, and access controls, to protect personal information stored in electronic and physical formats. We will regularly review and update our security measures to address emerging risks and to ensure ongoing protection of personal information.

b) Device and Network Security

Staff members and contractors must use secure devices and networks when accessing, storing, or transmitting personal information. Devices used for work purposes, such as laptops, tablets, and smartphones, must be password-protected and have up-to-date antivirus and security software installed. Staff members and contractors should only access personal information through secure networks, such as encrypted Wi-Fi connections or virtual private networks (VPNs).

c) Secure Communications

Find Plan NDIS Plan Management will use secure communication methods, such as encrypted email, to transmit personal information. Staff members and contractors must exercise caution when discussing personal information over the phone, in person, or through other communication channels, ensuring that such conversations are not overheard or intercepted by unauthorised individuals.

Anonymity and Pseudonymity

Find Plan NDIS Plan Management acknowledges the right of individuals to remain anonymous or use a pseudonym when dealing with our organisation, wherever it is lawful and practicable.

a) Anonymity

Where possible and appropriate, Find Plan NDIS Plan Management will allow individuals to interact with our organization without having to provide personal information. We recognise that there may be circumstances in which it is not possible for individuals to remain anonymous, such as when accessing certain services or participating in specific activities that require personal information.

b) Pseudonymity

Find Plan NDIS Plan Management will allow individuals to use a pseudonym when interacting with our organisation, provided that it does not create any legal or practical issues. We understand that some individuals may prefer to use a pseudonym for privacy reasons or personal preferences and will accommodate such requests when possible.

Openness and Transparency

Find Plan NDIS Plan Management is committed to being open and transparent about our privacy and confidentiality practices, ensuring that individuals have access to accurate and up-to-date information about how we handle personal information.

a) Privacy Policy Availability

Our Privacy and Confidentiality Policy will be readily available on our website and in our office for individuals to access at any time. We will provide copies of our policy to staff members and contractors during their induction process and to participants, carers, and family members upon commencement of services or upon request.

b) Communication and Updates

Find Plan NDIS Plan Management will regularly communicate with staff, contractors, participants, carers, and family members about any updates or changes to our privacy and confidentiality practices, ensuring that they remain informed and aware of their rights and obligations. We will use various communication channels, such as email, newsletters, and meetings, to share updates and promote a culture of privacy and confidentiality within our organisation.

By maintaining openness and transparency in our privacy and confidentiality practices, Find Plan NDIS Plan Management aims to build trust and confidence among our participants, carers, family members, staff, and the wider community.

Continuous Improvement

Find Plan NDIS Plan Management is committed to continually improving our privacy and confidentiality practices to ensure the highest standards of protection for personal information and compliance with relevant legislation.

a) Monitoring and Evaluation

We will regularly monitor and evaluate our privacy and confidentiality practices, policies, and procedures to identify areas for improvement and ensure ongoing compliance with applicable laws and regulations. This may include conducting internal audits, reviewing staff training and awareness initiatives, and seeking feedback from participants, carers, family members, and staff.

b) Implementing Changes

Find Plan NDIS Plan Management will take appropriate action to address any identified areas for improvement, including updating our policies, procedures, or practices, enhancing staff training and awareness initiatives, or implementing new security measures. We will communicate any changes to our privacy and confidentiality practices to staff, contractors, participants, carers, and family members, ensuring that they remain informed and aware of their rights and obligations.

By maintaining a focus on continuous improvement, Find Plan NDIS Plan Management demonstrates our ongoing commitment to protecting the privacy and confidentiality of our participants, carers, family members, staff, and the organisation as a whole.

Version Control and Policy History

Find Plan NDIS Plan Management will maintain version control of our Privacy and Confidentiality Policy, ensuring that the most current version is available to staff, contractors, participants, carers, and family members.

a) Version Control

Each version of the policy will include a version number, date of issue, and brief description of any changes or updates made.

b) Policy History

Find Plan NDIS Plan Management will maintain a record of policy history, including previous versions of our Privacy and Confidentiality Policy, as well as documentation related to policy reviews, updates, or amendments. This policy history will be stored securely and made available to staff, contractors, participants, carers, and family members upon request.

By maintaining version control and policy history, Find Plan NDIS Plan Management ensures transparency and accountability in our privacy and confidentiality practices, while providing easy access to the most current information for all stakeholders.

Training and Awareness

a) Staff and Contractor Training

Find Plan NDIS Plan Management will provide comprehensive privacy and confidentiality training to all staff and contractors during their induction process and on an ongoing basis. The training will cover our Privacy and Confidentiality Policy, relevant legislation and regulations, best practices for handling personal information, and strategies for minimising privacy risks. We will periodically assess and update the training content to ensure its relevance and effectiveness.

b) Participant, Carer, and Family Member Awareness

Find Plan NDIS Plan Management will provide information about our privacy and confidentiality practices to participants, carers, and family members upon commencement of services or upon request. We will also provide resources and support to help them understand their rights and responsibilities in relation to privacy and confidentiality, as well as the steps we take to protect their personal information.

c) Ongoing Awareness and Communication

Find Plan NDIS Plan Management will promote a culture of privacy and confidentiality within our organization by regularly communicating with staff, contractors, participants, carers, and family members about privacy-related matters, including any updates or changes to our policies, procedures, or practices. We will use various communication channels, such as email, newsletters, and meetings, to share updates and maintain ongoing awareness of privacy and confidentiality issues.

By providing comprehensive training and promoting ongoing awareness, Find Plan NDIS Plan Management ensures that all stakeholders are well-informed about their rights and responsibilities in relation to privacy and confidentiality, and are equipped to protect personal information in line with our policy and relevant legislation.

Breaches of Privacy and Confidentiality

Find Plan NDIS Plan Management takes breaches of privacy and confidentiality seriously and is committed to addressing any incidents promptly and effectively to minimise potential harm and ensure compliance with our Privacy and Confidentiality Policy, as well as relevant legislation and regulations.

a) Identifying and Reporting Breaches

Staff, contractors, participants, carers, and family members are required to report any suspected or actual breaches of privacy and confidentiality to the Directors as soon as possible. The Director/s will initiate an investigation to determine the nature, extent, and cause of the breach and will document the findings in a breach report.

b) Containment and Assessment

Upon identifying a breach, Find Plan NDIS Plan Management will take immediate steps to contain the incident, including securing any compromised systems or records, and preventing further unauthorised access or disclosure of personal information. The Director/s will assess the severity of the breach, the potential harm to affected individuals, and any legal or regulatory obligations that may apply.

c) Notification and Remediation

If the breach poses a risk of serious harm to affected individuals or requires notification under relevant legislation, Find Plan NDIS Plan Management will promptly inform the affected individuals and any relevant authorities, such as the Office of the Australian Information Commissioner (OAIC) or the NDIS Quality and Safeguards Commission. We will also implement appropriate remediation measures to address the breach, which may include providing support and assistance to affected individuals, recovering lost or compromised personal information, and implementing changes to our policies, procedures, or practices to prevent future breaches.

d) Review and Improvement

Following a breach, Find Plan NDIS Plan Management will conduct a thorough review of the incident to identify any lessons learned and areas for improvement. We will implement any necessary changes to our privacy and confidentiality practices to enhance our protection of personal information and reduce the risk of future breaches.

By effectively managing breaches of privacy and confidentiality, Find Plan NDIS Plan Management demonstrates our commitment to protecting the personal information of our participants, carers, family members, staff, and the organisation as a whole.

Records Retention and Disposal

Find Plan NDIS Plan Management is committed to ensuring the proper retention and disposal of personal information in accordance with our Privacy and Confidentiality Policy, relevant legislation, and industry best practices.

a) Retention Periods

Find Plan NDIS Plan Management will retain personal information for the minimum period required by law or as necessary to fulfill the purposes for which it was collected. Retention periods may vary depending on the type of information and the specific legal or regulatory requirements that apply.

b) Secure Storage

During the retention period, Find Plan NDIS Plan Management will store personal information securely, using appropriate physical, technical, and administrative safeguards to protect it from unauthorised access, disclosure, alteration, or destruction. Access to personal information will be restricted to authorized staff and contractors who require the information to perform their duties.

c) Disposal

When personal information is no longer required to be retained, Find Plan NDIS Plan Management will dispose of it securely and in accordance with relevant legislation and industry best practices. This may include securely deleting electronic records, shredding or otherwise permanently destroying physical records, or engaging a secure third-party disposal service.

d) Recordkeeping

Find Plan NDIS Plan Management will maintain records of our retention and disposal activities, including the types of personal information retained or disposed of, the applicable retention periods, and the methods used for secure disposal. These records will be stored securely and made available to staff, contractors, participants, carers, and family members upon request.

By implementing effective records retention and disposal practices, Find Plan NDIS Plan Management ensures the ongoing protection of personal information throughout its lifecycle, while also demonstrating compliance with our Privacy and Confidentiality Policy and relevant legislation.

Compliance with Relevant Legislation and Regulations

Find Plan NDIS Plan Management is committed to ensuring that our Privacy and Confidentiality Policy and practices comply with all relevant legislation and regulations, including but not limited to:

• The Privacy Act 1988 (Cth)
• The Australian Privacy Principles (APPs)
• The National Disability Insurance Scheme Act 2013 (Cth)
• The NDIS Quality and Safeguarding Framework
• Office of the Australian Information Commissioner (OAIC)
• Any applicable state or territory privacy legislation

a) Regular Monitoring and Updates

Find Plan NDIS Plan Management will regularly monitor relevant legislation and regulations to ensure that our Privacy and Confidentiality Policy remains accurate, up-to-date, and compliant with all requirements. We will also promptly implement any necessary updates or amendments to our policy and practices in response to changes in legislation or regulations, or as identified through our internal review processes.

b) Staff Training and Awareness

Find Plan NDIS Plan Management will provide comprehensive training and ongoing support to all staff and contractors to ensure that they understand and comply with relevant legislation and regulations in relation to privacy and confidentiality. We will also make relevant resources and information available to participants, carers, and family members, to help them understand their rights and responsibilities under the law.

c) Compliance Audits and Reporting

Find Plan NDIS Plan Management may conduct periodic compliance audits to assess the effectiveness of our privacy and confidentiality practices and identify any areas for improvement. We will also cooperate fully with any regulatory authorities, such as the Office of the Australian Information Commissioner (OAIC) or the NDIS Quality and Safeguards Commission, in relation to any audits, breaches, investigations, or compliance reporting requirements.

By actively ensuring compliance with relevant legislation and regulations, Find Plan NDIS Plan Management demonstrates our commitment to protecting the privacy and confidentiality of personal information and maintaining the highest standards of professional practice.

Contact Information

If you have any questions or concerns about our Privacy and Confidentiality Policy, or if you wish to make a complaint or provide feedback, please contact Find Plan NDIS Plan Management Managing Director/s on:

Phone: 1300 472 461
We will endeavour to respond to your inquiry or complaint in a timely and professional manner.

Definitions

• Personal information: means information or an opinion about an identified individual or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether the information is recorded in a material form or not.
• Participant: means a person with a disability who has been approved to receive services and supports under the National Disability Insurance Scheme (NDIS).
• Carer: means a person who provides unpaid care and support to a participant.
• Family member: means a person who is related to a participant by blood, marriage, or adoption.
• Staff: means any employee or contractor engaged by Find Plan NDIS Plan Management to provide services and supports to participants under the NDIS.
• Third-party service provider: means any external organization or individual engaged by Find Plan NDIS Plan Management to perform various functions on our behalf, such as IT support, data storage, or other services that involve the processing of personal information.

Policy Amendment Record

Brief Description of Amendment	Authorised
Review and minor grammatical changes to reflect expansion of Board; Expansion on complete policy	Warren Strybosch
Review, removal of Privacy Officer and inclusion of Office of the Australian Information Commissioner (OAIC)	Warren Strybosch
Removal of Training and Awareness - doubled up section. Added Related Resources	Warren Strybosch