Client Privacy and Confidentiality Policy

1. Purpose

This Policy sets out Learning for Life Autism Centre Inc’s (Learning for Life) framework for the protection of Personal Information provided to Learning for Life by Clients and ensures that Clients, their families, carers and advocates etc are aware of:

• their right to have their Personal Information protected and treated confidentially; and
• how to access Personal Information held by Learning for Life.

2. Policy Statement

1. Learning for Life is bound by the Victorian Health Privacy Principles as set out in the Health Records Act 2001 (Vic) and the Australian Privacy Principles as set out in the Privacy Act 1998 (Cth).

2. Learning for Life understands that Clients have a right to confidentiality and embraces the Australian Privacy Principles and the National Disability Insurance Scheme (Quality Indicators) Guidelines 2018. Learning for Life is responsible for protecting Clients’ information from misuse, interference, loss, and from unauthorised access, modification or disclosure.

3. Learning for Life recognises that confidentiality and proper communication is a fundamental component of service provision and that Clients have a right to be treated with dignity and respect.

4. Learning for Life respects Clients’ right to privacy. Learning for Life realises it is important that Clients understand the purpose for which Learning for Life collects their Personal Information.

5. Learning for Life takes its obligations seriously and carries out all reasonable steps to comply with and protect the privacy of the Personal Information

6. Learning for Life shall engage employees and contractors that have the right skills, training and clearances to meet the standards prescribed by this Policy.

3. Scope

1. This Policy applies to all employees, contractors, volunteers (including board members) of Learning for Life and will be implemented with respect to all Clients of Learning for Life.

2. Personal Information provided to Learning for Life by persons other than Clients is covered by the Public Privacy Policy (with respect to Personal Information provided by members of the public such as donors, supporters, families making enquiries, applicants for positions or users of the Learning for Life website) or the Staff & Volunteer Confidentiality & Privacy Policy (with respect to Personal Information provided by Learning for Life staff or volunteers).

4. Communication and Complaints

1. This Policy is available in easy read and pictorial format.

2. This Policy will be communicated to existing Clients upon its commencement and to new Clients on the commencement of their service via a Client handout or verbally. This Policy will be made available for viewing by Clients on request.

3. This Policy will be communicated to all staff and volunteers of Learning for Life on its commencement and to new staff members and volunteers on the commencement of their

5. Definitions

APP or Australian Privacy Principles means the privacy principles set out under the Privacy Act 1988 (Cth) establishing standards for collection and handling of Personal Information.

Client means, for the purpose of this policy, a child who is enrolled in a Learning for Life program and their parents or guardians.

HPP or Health Privacy Principles means the health privacy principles established under the Health Records Act 2001 (Vic) that apply to the collection and handling of health information in Victoria by the Victorian public and private sector.

Personal Information means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.

6. Types of Personal Information

1. Learning for Life may collect the following types of Personal Information:

• name, address, date of birth, telephone number, email address, bank account details, credit card details, photographs, video or audio footage, etc; and
• “health information”, including mental ailments, medical treatment or procedures received, medications, allergies, vaccination records, medical history, records of medical appointments, and other records related to a Client’s health condition, including information provided by referring doctors and psychologists, psychological examinations and speech pathology reports.

2. Learning for Life also collects information about the health and educational progress of its Clients from the Client and their referring health care workers (e.g., information provided by referring doctors and psychologists, psychological examinations, speech pathology reports etc) so that Learning for Life may properly assess, support or provide therapy and/or recommendations for children with Autism Spectrum Disorder, Attention Deficit Hyperactivity Disorder or who may have behavioural, social or developmental challenges or exhibit behaviours of concern.

3. Under the APPs, health information should be afforded a higher degree of protection than other Personal Information. Learning for Life will not collect a Client’s health information unless the Client consents to its collection and the health information is reasonably necessary.

7. Collecting and Handling Information

1.Learning for Life may collect information using a variety of means, including (but not limited to):

• face-to-face verbal communication;
• telephone calls;
• video calls or online video conferencing platforms;
• email;
• written communication via letters, application forms, website forms and messages;
• business transactions;
• publicly available information sources (telephone directories, internet websites and social media, etc.);
• direct marketing databases;
• emergency medical contact’s of a Client;
• from referring health care workers; and
• from a Client’s kindergarten and school teachers, childcare facilities and other allied healthcare providers.

2. Learning for Life shall take reasonable measures to ensure the integrity of Client information; it shall be kept accurate, complete and up-to-date, including checking Personal Information with Clients on an annual basis.

3. Learning for Life shall only use lawful means of collecting information. Learning for Life shall collect information directly from the Client unless the Client consents to the information being collected from another individual or entity, or Learning for Life has a lawful obligation to do so.

4. In some cases, completion of a consent form may be required prior to information being collected from a Client, other sources or provided to other parties. Any consent form shall be kept on the Client’s file.

5. When collecting information from a third party without direct consent or inquiry from the Client, Learning for Life shall take reasonable steps to notify the Client of:

• the fact that the information has been collected from a third party;
• the lawful obligation Learning for Life has to collect this information (if any);
• the purpose of collecting the information;
• the expected consequences of not collecting this information;
• any other third party to which this information may be disclosed;
• this Policy, including notification that this Policy outlines how and why information may be collected;
• if relevant, whether the information is likely to be disclosed to overseas recipients and in which countries those recipients are likely to be located.

6. Although Clients are not obliged to provide Personal Information to Learning for Life, in some cases, Learning for Life may be unable to respond to a Client’s request or provide services without collecting the requested information.

7. Personal Information received by Learning for Life without prior request shall be considered unsolicited and shall be destroyed unless:

• this information could have been collected in line with the Australian Privacy Principles; or
• this information is contained within a Commonwealth record.

8. Holding Personal Information

1. Learning for Life takes reasonable steps to ensure that all Personal Information is kept secure in accordance with reasonable physical, electronic, and managerial procedures. However, for Personal Information collected online and stored in electronic databases, no security system is impenetrable and the security of those databases can never be guaranteed. Learning for Life also cannot guarantee that the information a Client supplies will not be intercepted while being transmitted over the internet.

2. Accordingly, any Personal Information or other information which a Client transmits to Learning for Life is transmitted at the Client’s own risk. Nevertheless, once Learning for Life receives a Client’s transmission, Learning for Life will take reasonable steps to preserve the security of such information and ensure that there are appropriate security protections in place.

3.  While Learning for Life’s principal place of business is Victoria, Australia, some staff and volunteers may reside and work interstate and information held on cloud-based software may also be held in servers located interstate.  Accordingly, Personal Information provided to Learning for Life by Clients may be transmitted interstate but will continue to be treated in accordance with the terms of this Policy.

4. From time to time Learning for Life may engage third parties to perform certain services on Learning for Life’s behalf.  Where these third parties store, process and transfer personal information on servers located outside of Australia (such as in the United States), Learning for Life will take reasonable precautions to ensure that these service providers comply with the APPs and are obliged to keep confidential any Client Personal Information that they use. However, these third parties may not be bound by APPs and Learning for Life cannot control the acts and omissions of such third parties.

9. The Purpose of collecting, holding, using and disclosing Personal Information

1. Learning for Life will only use Personal Information for the primary purpose(s) for which it was collected. Learning for Life will not use or disclose Personal Information about a Client for any secondary purpose, unless the Client consents to that use or disclosure, or the Client would reasonably expect the use or disclosure in the circumstances, and that secondary purpose is:

• in the case of Personal Information which is not health information: related to the primary purpose for which Learning for Life have collected that information; and
• in the case of health information: directly related to the primary purpose.

2. The purposes for which Learning for Life uses the information it collects from Clients includes:

• to provide a safe and responsive service;
• to fulfil duty of care responsibilities;
• to respond to any query or complaint that a Client makes;
• to provide Clients with information relating to Learning for Life’s services, events or activities or other services, events or activities relevant to services Learning for Life provide and the community Learning for Life serve;
• to fulfil contract requirements to provide information to a Government funding (e.g. Medicare or the National Disability Insurance Agency) or auditing body (e.g. the Australian Tax Office, an external auditor);
• for other purposes to which a Client has consented to; and
• for any other purposes required or authorised by law or a court/tribunal order or by a regulatory body.

3. Learning for Life may also send out newsletters, event invitations and other information to individuals that agree to receive marketing material. Learning for Life will not add a Client’s details to mailing lists without their prior knowledge and consent. Clients are under no obligation to agree to receive marketing communications, and if a Client has agreed but no longer wish to receive communications, they may unsubscribe or opt out to remove themselves from the mailing list.

4. Learning for Life shall keep any hard copy documents containing Client Personal Information in a locked filing cabinet (or similar place with restricted access) and electronic files containing Client Personal Information shall be protected by restricting the access to only those requiring it to perform their duties.

5. Learning for Life may disclose Personal Information it has collected about a Client:

• to other healthcare service providers and consultants on the team looking after the Client;
• to other service providers, including suppliers which provide IT and cloud services to Learning for Life; and
• if required or authorised by law (for example, to respond to a subpoena or search warrant or in accordance with the Child Safe & Vulnerable Persons Policy as noted below in clause 7.4 of this Policy).

When Client Personal Information is disclosed to Learning for Life’s service providers, Learning for Life will take reasonable measures to ensure that those third parties are aware of and comply with this Policy when dealing with that information.

Learning for Life’s clinicians are bound by their own professional codes of ethics which may include additional regulatory and legal disclosure obligations.

6. Learning for Life recognises the National Guidelines for Best Practice Early Childhood Intervention and the requirement that information may be released to authorities in situations where a child is at risk. Where such disclosure is required Learning for Life will act in accordance with the Child Safe & Vulnerable Persons Policy.

7. Learning for Life shall promptly investigate, remedy and document any grievance regarding actual or suspected confidentiality breaches in accordance with the relevant Learning for Life policies.

8. Learning for Life shall hold Client Personal Information only as long as it remains relevant to the delivery of services, fulfilling its duty of care or legal obligations with respect to maintenance of Client records unless other lawful obligations apply or a Client has expressly consented in writing to Learning for Life counting to hold the specific information. Once it is no longer required (or permitted) to hold the information, Learning for Life shall take reasonable steps to destroy it.

10. Accessing Personal Information

1. Learning for Life will provide access to Clients’ Personal Information in accordance with the Health Privacy Principles set out in the Health Records Act 2001 (Vic) and the Australian Privacy Principles as set out in the Privacy Act 1998 (Cth).

2. A Client may request to access their Personal Information kept by Learning for Life. Requests should be made in writing by filling out the Request for Access Form supplied by Learning for Life.

3. Any requests made to Learning for Life to release a Client’s Personal Information shall be recorded and kept on the Client’s file.

4. Subject to clauses 10.5 and 10.6 below, Learning for Life will provide access by allowing the Client to inspect, take notes of, or receive copies or printouts of any held Personal Information requested about them. Under certain circumstances, Learning for Life may provide access to the appropriate parts of and not the entire record.

5. Irrefutable proof of identification must be provided when accessing Personal I This is necessary to ensure that the Personal Information is provided only to the correct individual. The correct individual will include both parents, where both parents are the joint guardians, unless by order of the Family Court of Australia. It may also include the non-parent guardian, as by order of the Supreme Court of Australia or the Children’s Court of Australia.

6. A request to access personal information will be denied if any of the following is applicable to the request:

• the request does not relate to the personal information of the child or person making the request;
• the person making the request is not the legal guardian of the child;
• access would be unlawful;
• denial of Access is required by law;
• providing access would pose a serious and imminent threat to life or health of an individual;
• providing access would create an unreasonable impact on the privacy of others;
• the request is frivolous or vexatious;
• the request relates to legal proceedings between the client and Learning for Life;
• the request relates to an employee record; or
• any other reason provided for under applicable law.

7. Where a request for Personnel Information is denied, Learning for Life will provide a written response containing an explanation of the circumstances that prevent Learning for Life from disclosing it along with the details for how the Client can appeal that decision or make a complaint.

8. Charges may be levied in accordance with the Health Records Act 2001 (Vic) and the Victorian Health Records Regulations. This will be at the discretion of the Board of Learning for Life.

11. Correction of Personal Information

1. Learning for Life will take such steps as are reasonable in the circumstances to correct Personal Information held to ensure that it remains accurate, up to date, complete, relevant and not misleading. Learning for Life can correct faulty Client Personal Information held on its own initiative or on request from the Client.

2. If a Client requests that Learning for Life correct their Personal Information and Learning for Life refuses to because:

• Learning for Life is not satisfied that the information is faulty;
• it would be unlawful to change the information; or
• changing the information would post a serious threat to the life or health of any individual,

Learning for Life must give the Client a written notice setting out the reasons for the refusal (except to the extent that it would be unreasonable to do so, having regard to the grounds for refusal) and the complaint mechanisms available to the Client.

3. If Learning for Life has collected Personal Information and then disclosed that Personal Information to a third party, Learning for Life may have an additional obligation in relation to that information if a correction request is received from a Client. If the Client requests that Learning for Life notify the third party of a correction to their Personal Information, then Learning for Life must take such steps (if any) as are reasonable in the circumstances to notify that third party of the correction unless it is impracticable or unlawful to do so.

4. If Learning for Life refuses to correct Personal Information, Learning for Life must, at the Client’s request, take reasonable steps to associate a statement with the Personal Information indicating that the Client believes the information to be inaccurate, out-of-date, incomplete, irrelevant or misleading. The statement must be apparent to users of the information and be associated with all records containing Personal Information claimed to be faulty.

12. Complaints

1. Client feedback about the practices of Learning for Life can be communicated according to the Client Complaints, Feedback and Grievances Policy. Complaints, feedback or queries about the handling of privacy matters can also be communicated directly to Learning for Life’s Privacy Officer at:

Email: victoria.crane@learningforlife.com.au

Tel: 0402 443 949;

Post: PO Box 7118, Hawthorn North, VIC 3122

Privacy complaints and queries will be dealt with fairly and as quickly as possible and be responded to within a reasonable time frame.

2. If a Client feels Learning for Life’s response to their privacy complaint, query or feedback was unsatisfactory, the Client may discuss the issue with Learning for Life further, or contact the Australian Information Commissioner for more information at:

Website: https://www.oaic.gov.au/about-us/contact-us/

Tel: 1300 363 992

Post: GPO Box 5218, Sydney NSW 2001