Community Living and Respite Services Inc. (CLRS) Policy No. AD I1 ** Issue No. 6 Issue Date: May 2005, August 2009February 2011Renamed Previously Information Privacy Policy. Revised Date February 2011, Feb 2012, October 2012 Authorised By Policy Sub Committee Information Privacy and Consent Policy It is the policy of Community Living & Respite Services Inc. (CLRS) to manage all personal information in a manner that ensures it is stored safely and securely and can only be accessed by the appropriate personnel. Information from collection to retention shall be managed according to relevant legislation. Procedure 1. Relevant Legislation Information is managed in accordance with: The Victorian Health Records Act 2001 The Commonwealth Privacy Act 1988 The Victorian Information Privacy Act 2000 The Children, Youth and Families Act 2005 The Privacy and Personal Information Protection Act 1998 The Health Records and Information Privacy Act 2002 The Privacy Code of Practice (General) 2003 The Health Records and Information Privacy Code of Practice 2005 The Disability Act 2006 The Disabilities Services Act NSW 1993 And relevant service agreements. 2. Types Information held by CLRS includes: Personal and payroll records Client records Information about carers and guardians. 3. Information Privacy Principles The Information Privacy Principles (IPPs) as set out below are a combination of the ten IPPs from the Victorian Information Privacy Act and the 12 IPPs set out in the NSW Privacy and Personal Information Protection Act 1998. These privacy principles are the standards CLRS will follow when dealing with personal and health information.
Collection of Personal Information Only personal information that is necessary for the performance of care provision shall be collected. When information is collected, the individual will be told who is collecting the information and what it will be used for. The individual will be told whether the collection is required by law, how to access the information and who else usually has access to the information. If the individual does not wish to provide the requested information, the consequences, if any, will be discussed. Use and Disclosure Information collected will be used and disclosed only for the primary purpose, for which it was collected, or a related purpose the person would reasonably expect. If the information is to be used or disclosed for other purposes, consent will be obtained first. Data Quality Personal information will be verified with the individual to ensure it is accurate, complete and up to date. Steps will be taken to ensure that the individual knows who to contact should personal information records need changing. Data Security Reasonable steps will be taken to protect personal information from misuse, loss, unauthorised access, modification or disclosure. Such steps include passwords, screensavers on computers, locked files and offices, warning messages on emails and faxes. Openness Service users are provided with a statement of Your Information It s private, which explains the management of personal information. Access and Correction Individuals have a right to seek access to their personal information and make corrections, as per the Health Records Act 2001. Access and correction is provided for in the Freedom of Information Act 1982. Access will be provided within 45 days of request, unless reasons for refusal according to law apply. Limits to access will apply where there are reasonable grounds that granting access will pose a serious threat to the life or health of the person making the request or any other person. Access may also be limited where this would have an unreasonable impact on the privacy of others or where it relates to existing legal proceedings as per the Health Services Act 2001. Computer systems are password protected with five minute screen savers. Unique Identifiers The use of unique identifiers is limited, and not shared with other agencies, to minimise cross matching of personal information. Anonymity Where appropriate, lawful or feasible, individuals have the option of not identifying themselves. Transborder Data Flows Personal information can be transferred to other places only if the recipient protects privacy under the standards and only with the individual s consent.
Sensitive Information Collection of sensitive information is stringently regulated. This includes information or opinion on political views, religious beliefs, sexual preferences, membership of groups, racial or ethnic origin and criminal records. 4. Consent The key principle about consent is to ensure the service user is fully informed about what they are giving consent to or for. The giving of consent is kept in service users files and recorded on the: Consumer Consent to Share Information Form for the sharing of information, and CLRS Media, Newsletter and Photograph Permission Form or for some programs on the Registration Form for permission to use information/photographs in the media, newsletter or CLRS information. However in some instances, as approved by the Team Leader/General Manager/Chief Executive Officer, verbal consent may be given provided details of who gave the consent, or whether consent was withheld is recorded on the service user s file. Where a person requests services on behalf of someone with a disability, evidence of consent of the person receiving the service should be recorded. If the service user is unable to give consent If the service user is over the age of 18 years, and unable to give their consent due to a disability the following list of authorised representatives may do so: A guardian as appointed or as deemed the administrator or person responsible by the Guardianship and Administrative Act 1986 An agent as appointed under the Medical Treatment Act 1988 Supported Decision-making If a person has a decision-making disability, they may not be able to give be valid consent in terms of all the aspects of consent, however appropriate support should be given to help people to exercise their capacity to give or refuse consent to the greatest possible extent. Appropriate support could be given by a person such as a senior CLRS staff member who knows the person well. In these circumstances the Senior staff member may assist the person to exercise their wishes in a way that a reasonable person would expect. The person s wishes could be ascertained by non verbal communication, evidence of past expressions if wishes or enjoyment of events. This evidence should be documented in the person s progress notes and on any permission forms completed by the staff member to support the person s decision making process. Where the Service user is child under 18 years of age If the service user is a child, the parents of the child may give consent, unless a court order prevents this. Then a guardian as appointed or as deemed the administrator or person responsible
by the Guardianship and Administrative Act 1986 may be authorised to give consent on behalf of the child. If consent is not given If the service user or their representative chooses to withhold consent for the purpose of information sharing there is no consequence for that person in terms of receiving services. In terms of data collection for QDC (VIC) and MDS (NSW) statistical linkages for that person are removed. Medical/Dental Treatment when consent is not able to be given A medical or dental practitioner does not need consent in a emergency when treatment is required to save the person s life, prevent serious damage to the person s health or prevent suffering from significant pain or distress. Consent is not required when treatment required is minor, such as for providing first aid, visual examination of a person mouth, administering a prescribed medication within recommended doses. If the practitioner believes other treatment not covered above is in their best interests, the practitioner can proceed to treat the person. The practitioner must first complete a form under Section 42K of the Guardianship and Administration Act to OAP. Forms can be located at www.publicadvocate.vic.gov..au Frequency of Consent Consent should be given every time a person seeks access to the services provided by CLRS to ensure they are fully informed of their rights and CLRS obligations. Consent Review From 2013 In instances where services are provided over a long period of time, the Coordinator will contact the service user as part of the annual profile update. The Coordinator will ensure that the service user/or their representative remains aware of their rights and CLRS obligations. Service users will be asked to validate their consent has not changed at annual review by countersigning and dating their original consent. Any changes must be recorded in the service user s file. All consent forms will be reviewed fifth yearly or at any time requested by the service user or for the staff who completed the CLRS Media, Newsletter and Photograph Permission Form. 5. Archiving of Information Information no longer in use is archived by the Administration Team Leader to ensure protection from loss, misuse or unauthorised access as per the Archiving and Retention of Records Policy 6. How to make a Complaint about Information Privacy Breaches CLRS encourages individuals to make a complaint to the relevant Coordinator, Team Leader or Manager if there is a concern about information privacy as per the Complaints and Grievance policy.
Breaches of Privacy for DHS service users related to: Inappropriate disclosure of confidential client information Loss or unauthorised disclosure of information Private service users documents not stored according to privacy requirements Are to be reported to DHS on a DHS Critical Incident Report as per the Incident Reporting Policy. Contact details of Privacy Officers. Location CLRS Officer Privacy Contact details General Manager Telephone (03) 5480 2388 PO Box 424, Echuca 3564 Victoria Victorian Health Services Commissioner Health Services Commissioner Complaints and Information Telephone: (03) 8601 5200 Toll Free: 1800 136 066 TTY No. 1300 550 275 E-mail: hsc@health.vic.gov.au 30th Floor 570 Bourke Street Melbourne. 3000 Victoria, Australia NSW Privacy Commissioner Telephone: (02) 8019 1600 E -mail: privacyinfo@privacy.nsw.gov.au Level 11 1 Castlereagh Street Sydney NSW 2000 Commonwealth Office of the Australian Information Commissioner Telephone: Toll Free: 1300 363 992 TTY No. 1800 620 241 TIS Translating and Interpreting Service: 131 450 E-mail: www.oaic.gov.au GPO Box 5218 Sydney NSW 2001 7. Monitoring and Evaluation Security audits are conducted annually to ensure staff are compliant with securing of information.
Complaints are recorded on a Complaints Register and monitored by the Team Leaders, or Board of Management Service users input and comments are sought through the annual service users survey. CLRS is obliged to provide information to the following external agencies: Quarterly Data Collection For funding and service service users Disability Complaints Commissioner For complaints data Office of the Senior Practitioner For Restrictive Intervention Data System