We commit to privacy and confidentiality of the Participant’s personal information (including health information). Privacy for Participants may relate to physical environment, possessions, physical needs, personal relationships and personal information.

On admission to the service, Samy Care Services must obtain consent to collect and hold Participant information. Samy Care Services commits to the following:

• Samy Care representative must provide to the Participant, or representative, information on records we hold.
• Information provided must include the Participant’s ability to access their own personal information if they wish.
• Staff must not access Participant files unless required to do so as part of their usual duties working with Participants.
• Any Participant files held manually or electronically have restricted access to appropriate staff.
• Client records are not held in areas or on drives shared with staff or others who are not involved in providing service to the Participant.
• All staff, when first employed, must sign a confidentiality agreement.
• All staff commit to privacy and confidentiality for each Participant when we:
• provide care to a Participant
• provide privacy for the Participant within their home, room or private areas
• discuss a Participant’s care and service requirements
• store a Participant’s personal information, whether this relates to medical needs or general information.

The Director (or their delegate) are responsible for ensuring Samy Care Services complies with the requirements of the Privacy Principles as outlined in the Health Records and Information Privacy Act 2002 (NSW), and, where applicable, the Privacy Act 1988 (Cth) by developing, reviewing and implementing processes and practices that identify:

• How people can consent to their information being collected.
• What information Samy Care Services collects about individuals, and the source of the information.
• Why and how Samy Care Services collects, uses and discloses the information.
• Who will have access to the information; and?
• Risks in relation to the collection, storage, use, disclosure or disposal of and access to personal and health information collected by Samy Care Services.

Samy Care Services will review its privacy and confidentiality arrangements annually, through a Privacy Audit. The Director (or their delegate) must immediately notify the NDIS Commission and/or relevant state government agency if they become aware of a breach or possible breach of privacy legislation.

All staff will receive formal induction and ongoing training in privacy, confidentiality and information management. Staff knowledge and application of confidentiality and privacy principles will be monitored on a day-to- day basis and through annual Performance Reviews. Additional on-the-job and formal training will be provided to staff where required. Staff are responsible for complying with this policy and procedure and their responsibilities in relation to collecting, storing, using, disclosing and disposing of personal and health information, in accordance with this policy and procedure. Prior to collecting information, staff must obtain consent from the participant or their supporter, using the relevant Consent Form where required.

Information must be collected sensitively and within lawful limits and only for a specific purpose. 

Staff must respect people’s choices about being photographed or videoed and ensure images of people are used appropriately. This includes being aware of cultural sensitivities and the need for some images to be treated with special care;

Participants and their supporters must be provided with Samy Care Services ’s Privacy Statement and informed that a copy of the complete policy is available on request. The Privacy Statement is to be prominently displayed and included in Samy Care Services ’s Participant Handbook or website.

Staff will provide information to participants about their privacy and confidentiality in ways that suit participants’ individual communication needs. This includes using the language, mode of communication and terms that the participant is most likely to understand. Methods include providing written information in Easy English, explaining information either face-to-face or over the phone and using interpreters and advocates.

Participant and Supporter Privacy and Confidentiality

Participants and their supporters are responsible for:

• Providing accurate information when requested.
• Maintaining the privacy of any personal or health information provided to them about others, such as contact details.
• Completing all consent and permission forms and returning them to the service in a timely manner.
• Being sensitive and respectful to other people who do not want to be photographed or videoed; and
• Being sensitive and respectful of the privacy of other people in photographs and videos when using and disposing of them.

Samy Care Services will only request and retain personal or health information that is necessary to:

• Assess a potential participant’s eligibility for a service.
• Provide a safe and responsive service.
• Monitor the services provided; and
• Fulfil contractual requirements to provide non identifying data and statistical information to a funding body.

Information Samy Care Services collects includes, but is not limited to:

• Contact details for participants and their supporters.
• Details for emergency contacts and persons authorised to act on behalf participants.
• Participants’ health status and medical records.
• Medication records.
• Service delivery intake, assessment, monitoring and review information.
• Service delivery records, plans and observations.
• External agency information.
• Feedback and complaints.
• Incident reports
• Consent forms.

Information storage

Personal files are kept in a secure filing cabinet in a private room, which is kept locked outside of operational hours. Computerised records are stored safely and secured with a password for access. Personal files are available for viewing upon request.

Information disclosure

Participant personal and health information will only be disclosed:

• For medical treatment or emergency.
• To outside agencies with the participants’ or parent or guardians’ permission.
• With written consent from person/s with lawful authority; or
• When required by Commonwealth Law, or to fulfil legislative obligations such as mandatory reporting.

If a staff member is in a situation where they believe that they need to disclose information about a participant that they ordinarily would not disclose, they should seek the advice of a Director (or their delegate) before making the disclosure.