4.1 Collection

Unidex Healthcare will only collect information that is necessary for what we do and will only do so in a fair, non-intrusive and lawful way. Where possible and practicable, personal and sensitive information will be collected directly from the participant or their representative, rather than from a third party. Unidex Healthcare may collect information from a participant’s family, doctors, school or other support services after a participant’s consent has been received.

Unidex Healthcare will only collect personal or sensitive information with an individual’s consent, or if required by law, provided that information is required to provide services, is required by our contractual obligations, or is required to allow us to meet our duty of care obligations. Unidex Healthcare will only collect Protected Information in accordance with its obligations under the NDIS Act 2013.

Unidex Healthcare collects information through a variety of different methods including:

• Paper-based forms
• Electronic forms (including online forms)
• Face to face meetings
• Telephone communication
• Email communication
• Communication with authorised persons or Agencies (e.g., via National Disability Insurance Agency (NDIA) Portal, NDIA and National Injury Insurance Scheme Queensland (NIISQ) representatives)

Anonymity and Pseudonymity

Wherever it is lawful, practicable and does not compromise the provision of services Unidex Healthcare will give people the option of not identifying themselves when personal information is collected. Participants have the right to determine what personal information they want to disclose and are not required to disclose personal or sensitive information (e.g., sexual orientation/gender identity) not relevant to the delivery of support(s).

Data Security

Unidex Healthcare will take reasonable steps to protect the information it holds from misuse and loss, and from unauthorised access, modification or disclosure. Unidex Healthcare will ensure participant records will be securely stored in areas/systems to which only authorised staff will have access. All staff will be required to sign the Privacy and Confidentiality Agreement.

Retention and Storage of Personal Information

Unidex Healthcare retains personal, sensitive and protected information only for as long as necessary to fulfil the purpose for which it was collected, to meet legal, regulatory, contractual and duty of care obligations, and to support the safety and wellbeing of participants.

In accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the NDIS Act 2013, and the NDIS Practice Standards, Unidex Healthcare applies the following retention principles:

• Participant Records:
  Participant records, including support plans, progress notes, incident reports, consent forms and clinical documentation, are retained for a minimum period of seven (7) years from the date of last service provision, unless a longer retention period is required by law, contractual obligations, or for legal, clinical or regulatory purposes.
• NDIS Protected Information:
  Protected information collected in connection with the National Disability Insurance Scheme is retained and managed in accordance with the NDIS Act 2013 and relevant NDIS Rules and Guidelines. Unidex Healthcare acknowledges that certain protected information may be subject to restrictions on alteration, destruction or disclosure.
• Employee, Contractor and Volunteer Records:
  Records relating to employees, contractors, students and volunteers are retained in accordance with applicable employment, workplace, and taxation legislation, generally for a minimum of seven (7) years following cessation of employment or engagement, unless otherwise required by law.
• Financial and Business Records:
  Financial records, invoices and related business documentation are retained in accordance with Australian taxation and corporate record-keeping requirements, generally for a minimum of seven (7) years.
• Secure Disposal:
  Where personal information is no longer required to be retained, Unidex Healthcare will take reasonable steps to securely destroy or permanently de-identify the information to prevent unauthorised access, misuse or disclosure.
• Extended Retention:
  In some circumstances, records may be retained beyond standard retention periods, including where required for ongoing investigations, complaints, incidents, legal proceedings, audits, or regulatory compliance. The justification for extended retention will be documented.

Retention periods are reviewed periodically to ensure ongoing compliance with legislative and regulatory requirements.

Government Identifiers

Unidex Healthcare will not adopt a government identity number for use in a way which is inconsistent with its primary purpose.

4.2 Disclosure

Unidex Healthcare will only use or disclose the information it holds for the purpose for which it was collected, or for a matter related to that purpose. In accordance with our statutory obligations, Unidex Healthcare may be required to disclose personal or sensitive information to third parties.

If Unidex Healthcare needs to disclose personal or sensitive information outside of the organisation, the information will ordinarily be de-identified prior to disclosure where it is practicable to do so. An individual’s personal or sensitive information will not be disclosed to anyone outside of Unidex Healthcare except where consents are in place or where the disclosure is authorised or required under law, including the NDIS Act 2013 and NDIS Rules. Unidex Healthcare may also disclose information in accordance with relevant state government Information Sharing Guidelines.

Some examples of when Unidex Healthcare may be required to disclose information include:

• When issued with a court subpoena or when authorised by a Commonwealth or State statute
• Mandatory reporting (e.g., abuse pertaining to Unidex Healthcare participants under the age of 18 years old)
• Where is it a necessary part of an internal or external investigation following a complaint, incident or care concern
• Where it will prevent or lessen a threat to someone’s health or safety
• Suicide – where the individual is at risk of causing self-harm
• Duty to the public – where the individual is a danger to others

Participant Consent for Disclosure of Information

All Unidex Healthcare participants consent to Unidex Healthcare disclosing information in accordance with its statutory obligations and in order to provide services to participants. Disclosure of participant information to third parties not related to the provision of services by Unidex Healthcare requires express consent of the participant. Unidex Healthcare participants or participant representatives that are lawfully able to act on a participant’s behalf will be asked to complete a Consent to Obtain and Release Information Form.

Following completion of this form, Unidex Healthcare will not provide participant information to a person or entity who is not: the participant, a third party directly related to the provision of services to the participant, a validly appointed representative or nominee of the participant, or a third party legally entitled to access the information unless the participant has expressly consented for Unidex Healthcare to provide information. The Consent to Obtain and Release Information Form will be revised annually for each Unidex Healthcare participant.

No third-party service provider will be permitted to disclose participant information other than in accordance with the Consent to Obtain and Release Information Form or when authorised to do so by law.

Accuracy of Information

Unidex Healthcare will take reasonable steps to confirm the accuracy, completeness and currency of the information it collects, uses and discloses. Wherever possible and reasonable, steps will be taken to correct inaccurate or incomplete information.

Access to Information

Unidex Healthcare recognises participants have a right under the Privacy Act to access personal and sensitive information held about them. Participants also have the right to withdraw or amend their prior consent to obtain or release information.

A request to access participant information held by Unidex Healthcare must come from a Unidex Health participant or in accordance with a written consent from the participant. Unidex Healthcare may request personal information from an individual in order to verify their identity prior to granting them access to personal information. Information will not be provided to a person who is not the participant, a validly appointed representative or nominee of the participant, a third party legally entitled to access the information or person who holds a written consent from the participant. Applicants can complete the Request for Access to Personal Information form.

Unidex Healthcare may decline to provide a participant or those acting on their behalf access to personal or sensitive information where the refusal is required by law.

A participant may request NDIS information held by Unidex Healthcare in accordance with the NDIS Act 2013. Unidex Healthcare may be barred from disclosing, correcting or destroying information under the NDIS Act 2013.

Correction of Information

Participants have a right under the Privacy Act 1988 to request corrections to any personal and sensitive information held about them. Any request to amend participant information must be made by the participant, a validly appointed representative or nominee of the participant or person who holds a written consent from the participant.

Participants have the right to seek correction of the personal and sensitive information Unidex Healthcare holds about them within a reasonable timeframe. In the event that Unidex Healthcare does not, upon legitimate grounds, agree to the correction sought, the correction sought shall still be documented.

A participant may seek correction of protected information. Unidex may be barred from correcting this information under the NDIS Act.

Information Sharing Guidelines

Unidex Healthcare follows the SA and QLD government Information Sharing Guidelines for Promoting Safety and Wellbeing (ISG). This means Unidex Healthcare will work closely with other agencies to co-ordinate the best support for vulnerable adults and children. Under the Information Sharing Guidelines, informed consent for the sharing of information will be sought and respected in all situations unless:

• It is unsafe or impossible to gain consent or consent has been refused; and
• Without information being shared, it is anticipated a person or member of their family will be at risk of serious harm, abuse, neglect or pose a risk to their own or public safety

Reasonable steps will be taken to maintain the security and protect the privacy of personal information that is transferred to a third party.

Accidental or Unauthorised Disclosure of Personal Information

Unidex Healthcare will take seriously and deal promptly with any accidental or unauthorised disclosure of personal or sensitive information. Matters relating to the accidental or unauthorised disclosure of personal or sensitive information are to be responded to in accordance with the Unidex Healthcare Feedback and Complaints Handling Policy.