Privacy and data protection, without the headache
A practical checklist of what the Privacy Act and the Australian Privacy Principles ask of NDIS providers, and how CompanionAxis helps with each point.
Participant records hold health information, which is sensitive information under the Privacy Act, so providers carry real duties. Work through the eleven points below; most are handled in your daily work once CompanionAxis is set up.
This checklist is a practical summary, not legal advice. Confirm your obligations with a privacy professional.
Why it’s worth getting right
Stay on the right side of the OAIC
Serious or repeated interferences with privacy carry significant penalties. Records of consent, access and breach handling are your best evidence.
Keep participants’ trust
Participants and families share more when they know their information is protected and only the right workers can see it.
Be ready for an audit
Consent records, access rules and the audit log are already in the system when an auditor, the NDIS Commission or a participant asks.
The checklist 11 points, and who does what for each.
- 01
Have a clear privacy policy
- What the law asks
- APP 1 requires an up-to-date privacy policy explaining what personal information you hold and how you manage it.
- What you do
- Publish a privacy policy written for participants, in plain language and accessible formats.
- How CompanionAxis helps
- Store your privacy policy and easy-read versions as documents, and link them to intake forms so participants see them before they share information.
- 02
Collect consent and tell people why
- What the law asks
- Health information generally needs consent to collect, and APP 5 requires you to tell people why you collect it and who you share it with.
- What you do
- Explain to participants, nominees and guardians how their information is used, and collect consent where it is needed.
- How CompanionAxis helps
- Consent forms and service agreements are signed electronically and kept with the participant record, with the date, the signer and their relationship to the participant.
- 03
Treat health information as sensitive
- What the law asks
- Sensitive information, including health and disability information, needs extra care and should be used only for the purpose it was collected for.
- What you do
- Decide which workers, coordinators and partners need which records, and review it when roles change.
- How CompanionAxis helps
- Role-based access means each support worker sees only the participants they are rostered to, and finance staff see billing without clinical notes.
- 04
Let participants access and correct their information
- What the law asks
- APP 12 and APP 13 give people the right to access the personal information you hold about them and to ask for it to be corrected.
- What you do
- Have a simple way for participants and their nominees to make requests, and answer them promptly.
- How CompanionAxis helps
- Staff with permission export a participant’s record, notes and documents on request, and corrections are made in the record with the change kept in the audit log.
- 05
Keep information secure
- What the law asks
- APP 11 requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access.
- What you do
- Use strong passwords, require workers to lock their phones, and remove leavers’ access the same day.
- How CompanionAxis helps
- Data is encrypted in transit and at rest, with daily backups stored apart and recovery tested. Single sign-on is coming soon.
- 06
Know who did what
- What the law asks
- You must be able to show that information was handled properly.
- What you do
- Review access to sensitive records regularly, especially behaviour support and medication records.
- How CompanionAxis helps
- The audit log records every view, edit and export with the user and the time, and can be filtered by participant, worker or date.
- 07
Respond to data breaches
- What the law asks
- Under the Notifiable Data Breaches scheme, an eligible data breach likely to cause serious harm must be assessed promptly and notified to the OAIC and affected people.
- What you do
- Have a named person and a short response plan for assessing and notifying a suspected breach.
- How CompanionAxis helps
- We notify you without delay with what we know, so you can assess the breach and meet your notification duties.
- 08
Keep information only as long as needed
- What the law asks
- APP 11 requires you to destroy or de-identify personal information you no longer need, but NDIS providers must keep records for 7 years.
- What you do
- Keep NDIS records for at least 7 years, and set a retention period for each other kind of record in line with your obligations.
- How CompanionAxis helps
- Participant records, shift notes and incidents sit in one system instead of paper files and shared drives, so there is one place to apply your retention policy.
- 09
Assess new ways of handling information
- What the law asks
- A privacy impact assessment is good practice before a new system or a new way of sharing information goes live.
- What you do
- Run a privacy impact assessment when you change systems or start sharing records with new partners.
- How CompanionAxis helps
- We support your assessment with our security overview, hosting details and answers to your questionnaire.
- 10
Name a privacy officer
- What the law asks
- Organisations should have someone accountable for privacy who staff and participants can contact.
- What you do
- Name the person responsible for privacy and make sure workers and participants know how to reach them.
- How CompanionAxis helps
- Give your privacy officer a role with access to the audit log, consent records and the exports they need.
- 11
Be careful with information sent overseas
- What the law asks
- APP 8 makes you accountable for personal information disclosed to overseas recipients.
- What you do
- Know where your systems store data, and ask vendors to confirm it in writing.
- How CompanionAxis helps
- Participant and worker information is hosted in Australia, and the data processing agreement confirms where it is stored.
Privacy questions
Does the Privacy Act apply to a small provider?
Generally yes. Organisations that provide a health service and hold health information are covered by the Privacy Act regardless of turnover. Check your own position with the OAIC or an adviser.
Does using cloud software break the Privacy Act?
No. You can use a service provider, provided you take reasonable steps to protect the information and know where it is held. That is what the data processing agreement and Australian hosting cover.
Who is responsible if there is a data breach?
Both sides have duties. Your organisation assesses the breach and notifies the OAIC and affected people where required. CompanionAxis must tell you without delay and help you respond.
Can we get this checklist as a document?
Yes. Print this page, or request the checklist and our data processing agreement and we will send them to you.