Privacy, Cyber Security and Information Management Policy

Introduction

This policy outlines the procedures for managing and storing information in compliance with the Australian Privacy Act 1988 (Privacy Act) and the Australian Privacy Principles (APPs). It is designed to ensure that all information is handled securely and ethically.

The Privacy Act protects personal information and requires that we comply with the APPs set out in Schedule 1 of the Privacy Act in our handling of personal information.

Under the Privacy Act, ‘personal information’ means ‘information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether the information is recorded in a material form or not’.

Scope

This policy applies to all employees, contractors, and third-party service providers who handle personal, client, or company information.

Policy

National Police Clearance

  • Requirement: All staff must undertake a National Police Clearance prior to commencing employment.
  • Renewal: This clearance must be renewed every three years as a minimum.

Collection of Personal Information

  • Minimal Collection: Only collect personal information necessary for business activities and services.
  • Consent: Ensure that the collection of personal information is conducted with the informed consent of the individual.

Use and Disclosure of Personal Information

  • Primary Purpose: Use personal information only for the primary purposes for which it was collected, unless the individual has consented otherwise.
  • Non-Disclosure: Do not disclose personal information to any third party without the individual’s consent, except as required by law or in situations involving risk of harm.

Information Quality and Integrity

  • Accuracy: Ensure that personal information is accurate, complete, and up-to-date.
  • Review: Regularly review and update personal information to maintain its integrity.

Information Security

  • Storage: Store personal and sensitive information securely to protect against unauthorized access, modification, or disclosure.
  • Access Control: Restrict access to personal information to authorized personnel only.
  • Password Management:
    • All passwords must be stored in a secure password vault.
    • Passwords are shared by the director with necessary team members via the vault.
    • Passwords must never be stored in any other format or location.
  • Device Security:
    • All work must be undertaken on a company laptop specifically allocated for work purposes.This laptop should not be used or accessed by any other person for any reason.
    • Laptops must be secured by a password and locked or shut down whenever not in use by the staff member.

Segmentation and Storage

  • Segmentation: Segment client information and store it securely in designated cloud drives, vaults, and operating systems to prevent accidental crossover of information.
  • Daily File Clearing: Documents downloaded for work purposes, such as email attachments saved to the Practice Management System (PMS), must be cleared from computer files at the end of each day.

Access to Digital Identities

  • Individual Access: Individual staff members must access PRODA, HPOS, and the NDIS portal using their own digital identity.

Handling Patient Information

  • System Storage: Patient details are to be stored solely in the client’s relevant PMS.
  • Consent Forms: Privacy consent forms must be completed and stored within the patient’s records.

Rights of Individuals

  • Access: Individuals have the right to access their personal information, subject to certain exceptions allowed by law.
  • Correction: Individuals have the right to request the correction of their personal information to ensure it is accurate, up-to-date, and complete.

Data Breach Response

  • Breach Procedures: Implement procedures for identifying and responding to data breaches, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.

Use of Artificial Intelligence (AI) Tools

  • The company may use AI services, including chatbots and writing assistants, to help draft, edit or improve generic templates, documents and internal resources. These tools are used only for general, non-identifying content. We never enter patient or client information into any AI service or chatbot, including names, contact details, health information or any other personal or identifying data. All personal information remains within our secure practice and business systems and is handled in line with our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Any AI-assisted content is reviewed by our team before use.

Cyber Insurance

  • Maintenance: The company must maintain up-to-date cyber insurance to manage potential cyber risks.

Compliance and Review

  • Regular Audits: Conduct regular audits to ensure compliance with the Privacy Act and APPs.
  • Policy Review: This policy will be reviewed annually and updated as necessary to ensure ongoing compliance with legal requirements and best practices.

Training and Awareness

  • Education: Provide regular training to all employees, contractors, and third-party service providers on their responsibilities under the Privacy Act and this policy.

This policy is essential to ensuring the security and integrity of our virtual business operations. All staff are required to adhere strictly to these guidelines to maintain a secure work environment, comply with Australia’s Privacy Act, and protect client and company information.

Website Privacy Policy

Comments

When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymised string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service Privacy Policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Cookies

If you leave a comment on our site you may opt in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

Embedded content from other websites

Suggested text: Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Who we share your data with

If you request a password reset, your IP address will be included in the reset email.

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognise and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Where your data is sent

Visitor comments may be checked through an automated spam detection service.