Privacy and Confidentiality

Privacy is a person's right to control information about themselves and to have personal space. Confidentiality is our duty to protect information that has been shared with us in trust. This lesson explains the difference, what counts as personal and sensitive information, and why health and disability information needs extra care. Key points: personal information is anything that identifies a person, sensitive information includes health, disability, cultural background and sexuality, and people we support often have little choice about sharing it with us, which makes protecting it even more important.

Several laws and standards set out how we must handle personal information. This lesson introduces the Privacy Act 1988 and the 13 Australian Privacy Principles, state and territory health records laws, the privacy element of the NDIS Code of Conduct and the Aged Care Quality Standards, and our own privacy policy. You do not need to memorise the legislation. Key points: collect only what is needed, use it only for the reason it was collected, keep it secure, let people access their own information, and follow our privacy policy, which turns these rules into everyday practice.

Most privacy risks come from everyday habits. This lesson covers how to keep information secure in our systems, on your phone and on paper, how to write respectful and factual notes, and how to decide whether information can be shared. It explains consent, the need to know test and situations where sharing is required by law, such as a serious risk to someone's safety. Key points: lock devices, never use personal apps for participant information, keep paper notes out of sight, share only with consent or legal authority, and ask when unsure.

Workers are often asked for information by family members, friends, other residents, neighbours and other services. This lesson explains how to respond politely without breaching privacy, including when a participant has a nominee, guardian or other authorised representative. It also covers conversations in public places, social media and photos. Key points: an adult participant decides who can know about them, even family must have consent or legal authority, check the file for authorised representatives, and never post about participants online. If in doubt, say you will check and refer the request to your team leader.

A privacy breach happens when personal information is lost, accessed without permission or shared when it should not be. This lesson gives realistic examples, such as a lost work phone, an email sent to the wrong person or a conversation overheard by another resident. It explains why you must report a breach straight away, even if you caused it, and how we assess breaches under the Notifiable Data Breaches scheme. Key points: act quickly to contain the breach, report it to your team leader immediately, and never try to hide or fix it quietly.

Confidentiality is not absolute. There are times when information must be shared to protect someone, even without consent, such as when a participant is at serious risk of harm, when a reportable incident must be notified to the NDIS Commission or the Aged Care Quality and Safety Commission, when a child may be at risk, or when the law or a court requires it. This lesson explains these exceptions and why you should never promise to keep a secret. Key points: safety comes first, tell your team leader, and share only what is needed.

This case study follows Sofia, a support worker who realises at the end of a busy day that she has left her work phone on a tram. The phone holds rosters, participant addresses and messages about health needs. We walk through what she does in the first hour: reporting it straight away, helping our team lock the phone remotely, and recording what happened. We also look at how our privacy officer decides whether it is a notifiable data breach, and the lessons for everyone. Key points: act fast, be honest, and let the right people assess it.

This case study follows Hoa, an adult participant with a psychosocial disability, and her sister Lan, who phones our office and then turns up at Hoa's home asking about her medication and appointments. Hoa has not given consent for her sister to receive information. The lesson shows how to respond kindly and firmly to a worried family member, how to check for consent or an authorised representative, and how to support the participant to decide what she wants to share. Key points: the adult participant decides, be kind to family, and refer requests.