Client Privacy and Confidentiality Policy
Emerge collects and administers a range of personal information with the purpose of providing service delivery to victim survivors of family violence.
Emerge is committed to adhering to the Australian Privacy Principles which set the standards for the collection, access, storage and use of personal information which is obtained as part of normal operations. The Privacy and Data Protection Act 2014 (Vic) and the Health Records Act 2001 (Vic) are the primary legislation that regulates the information handling of personal and health information. Emerge will manage information in accordance with the Information Privacy Principles and Health Privacy Principles that provide standards for information collection, storage, access, transmission, disclosure, use and disposal as prescribed within these Acts.
All clients have a right to privacy and confidentiality of their personal information.
Emerge will ensure that all personal information, no matter how or where it is obtained, is handled sensitively, securely and in accordance with legislation.
Scope
This policy applies to all personal and health information collected, stored, used and disclosed about any individual who is a client of Emerge.
Definitions
Privacy refers to keeping certain personal information free from public knowledge and attention and to having control over its disclosure and use.
Confidentiality applies to information given to a person or organisation under an obligation not to disclose that information to others unless there is a statutory requirement, duty of care obligation or consent to do so.
Personal information includes a person’s name or address, and can include photos, credit history information, bank details, a person’s place of employment and any other information that could reasonably identify them. Health information refers to any information relating to a person’s physical, mental or psychological health or disability.
Sensitive information may refer to information including a person’s racial or ethnic origin and immigration status, political opinions, religious beliefs or affiliation, trade union or other professional or trade association membership, membership of a political association, sexual identity or practices, gender identity, philosophical beliefs, criminal record and current or former occupation or employment status.
Privacy Principles
Emerge is bound by laws which impose specific obligations when it comes to handling information. The organisation has adopted the following principles as minimum standards in relation to handling personal information.
Emerge will:
- Collect only information which the organisation requires for the purposes of delivering services.
- Ensure that clients are informed as to why information is collected and how information is stored.
- Use and disclose personal information only for the purpose of providing service delivery or directly related to providing services, with the person’s consent or as required by law.
- Store personal information securely, protecting it from unauthorised access.
- Provide clients with access to their own information, and the right to seek its correction.
Procedure
Consent
Consent is when a person has expressly, either verbally or in written form, given their consent to their information being shared.
In general, information about clients is collected, stored and disclosed with informed consent.
It should be made clear to clients that they can revoke their consent at any time.
Both the Refuge and Therapeutic Services will obtain consent from clients to share information. Consent will be documented on appropriate forms or noted in SHIP in the client’s file.
Emerge employees can share information without consent of the client but must reasonably believe that:
- Sharing information will lessen or prevent a serious threat to an individual’s life, health, safety or welfare.
- Information is relevant to assessing or managing the risk of family violence to a child.
- A child has suffered or is likely to suffer abuse or neglect.
- An unlawful activity has been, is being or maybe engaged in.
Sharing information without consent will be discussed with the supervisor and decisions made on what information is relevant to share without consent and how this will impact on the client.
Collection
Emerge employees collect personal and health information directly from people who are provided with services and from other services who have the consent of the person to provide the information to Emerge.
Emerge will only collect information that is needed to provide services.
When information is collected about a client, Emerge practitioners will ensure that:
- A private space is provided for the client to disclose information.
- An explanation is provided about why information is collected.
- Information is provided to the client about consent to collect information from other sources.
Use and Disclosure
Emerge will only use client information for the purpose of providing services.
Emerge will only disclose information with the consent of the client.
Emerge will only disclose client information without consent when:
- It is required or authorized by law.
- There is a threat to life, health or safety.
Storage
Emerge will store all client information in the Specialist Homelessness Information Platform (SHIP) which is required by the funding contract and meets all Australian Government Protective Security Protocols. Any client information that is provided in paper form or via email will be uploaded to SHIP.
Information provided in paper about the client will be given to the client as appropriate or destroyed.
Information sent about the client via email or email attachments will be uploaded to SHIP. Relevant SMS correspondence with a client will be noted in SHIP.
Information on clients that forms part of organisational processes such as incidents or complaints will be saved on SharePoint with restricted access.
Where information is required to be distributed to staff members of Emerge for the benefit of service provision such as current client lists, this is be sent as a link to SharePoint.
Client information that cannot be uploaded to SHIP, due to size or is information about the person using violence, will be stored in SharePoint.
Destruction and De-identification
Emerge must retain any paper client files for 7 years after the last contact with the client or when the file has been closed. When the client is a child, the file must be kept until the child turns 25 years old.
Quality
Information that is recorded about clients by Emerge staff will follow the guidelines provided in the Service Delivery Manual.
Information recorded about clients will:
- Use professional judgement using the Best Interest Case Practice Framework
- Be client centred
- Use risk identification and management
- Be about observations, information and agreed actions
- Be trauma informed
- Be brief, relevant and limited to what is necessary in the context of service delivery
Access and Correction
Clients can request to have access to their personal information held by Emerge. The request for access to personal information should be made by client in writing to the Service Delivery Director.
Requests must be responded as soon as possible and within 45 days.
Request to access personal information from the client can only be denied in full or part if there is a belief that:
- The information would pose a serious threat to life, health or safety.
- There is an unreasonable impact on the privacy of other individuals.
If a client is able to establish that their personal information is inaccurate then Emerge must take steps to correct it.
If Emerge disagrees with the inaccuracy, Emerge will allow the client to write a statement that will be uploaded to their file explaining the inaccuracy.
Information Sharing Scheme
Emerge is prescribed as an information sharing entity (ISE) and a risk assessment entity (RAE) and can share information and request information to support assessment and management of family violence risk with other information sharing entities.
Relevant information about adult victim survivors and third parties can only be shared with their consent, except when there is a serious threat, or the information is relevant to assessing or managing risk to a child victim survivor. Information about any relevant person can be shared without consent to assess or manage risk to a child victim survivor.
The two main purposes for the information sharing are to:
- to ensure the safety and protection of those experiencing family violence; and
- to hold perpetrators to account.
Requests to share information can be done verbally or in writing. Requests must be responded to in a timely manner particularly if where a serious threat has been identified. Emerge staff will ensure they are sharing information with another information sharing entity and verify the person’s identity requesting information if they do not have a prior knowledge of this person.
Emerge staff can request information from other information sharing entities and risk assessment entities to establish and assess family violence risk.
RAEs are a subset of ISEs. Only RAEs can request and receive information for a family violence assessment purpose. All ISEs can request or share information for a protection purpose (which includes ongoing risk assessment).
Emerge will mostly request information about perpetrators and share this information with victim survivors to increase safety. When providing information to a victim survivor, Emerge staff will inform the victim survivor that they are only permitted to use the information to manage their safety or their child’s safety. A victim survivor should not use the information for any other purposes.
Emerge is not permitted to share information that is restricted from being shared under other laws. Restricted information can include information that endangers a person's life, prejudices an investigation, or contravenes a court order. Legal advice may need to be obtained to determine if information meets these exemptions. Refusing to provide information must be put in writing with the reasons stated.
Consent
When sharing information for an assessment or protection purpose to assess or manage risk of family violence to an adult victim survivor:
- consent is required from the adult victim survivor to share their information, unless sharing is necessary to lessen or prevent a serious threat to an individual’s life, health, safety or welfare.
- the adult victim survivor’s consent will not be required if a child’s safety is also at risk.
- information about perpetrators of family violence, and adolescents who use family violence, can be shared without their consent.
Subpoenas
A subpoena is a document issued by a Court ordering either:
- The production of records; and/or
- The attendance of the named party at Court to give evidence.
When the subpoena is ordering the production of client records, it is to be directed to the Service Delivery Director.
A subpoena may request that certain documents be produced to the court such as case notes, files or any other records.
All subpoena requests will be discussed with the Service Delivery Director who will consult with the relevant Team Leaders.
If Emerge receives a subpoena to produce information about a victim survivor or a perpetrator, then legal advice will be sought on how to respond before producing any information.
A subpoena may be challenged. Emerge must consider the impact on the victim survivors’ safety when challenging a subpoena.
When the subpoena is ordering attendance in court it must be served “personally”. This means that the subpoena must be personally handed to the person named in the subpoena.
Any employee who is served with a subpoena should contact the Service Delivery Director or the Operations Director, who will make sure any employee attending court is appropriately supported.
The CEO must be notified of any subpoena request.
Legislation and Standards
Privacy Act 1988 (Commonwealth)
Privacy and Data Protection Act 2014 (Vic)
Health Records Act 2001 (Vic)
Children, Youth and Families Act 2005
Charter of Human Rights and Responsibilities Act 2006
Victorian Protective Data Security Standards
Family Violence Information Sharing Guidelines 2021
Social Services Standards (Vic) 2024; Standard 1- Safe service delivery
Social Services Standards (Vic) 2024; Standard 2 - Service user agency and dignity