Information Management Policy and Procedure

NDIS Policies and Procedures Manual – Core Module

Document Number: CM-POL-009

Document Control

This table shows a record of significant changes to the document.

Legal Name:	Holistic Healthcare Management Services
ABN:	20695058096
ACN:	695058096
Primary address/head office:	15 Agasse Way, Tapping WA 6065
Document Name:	NDIS Policies and Procedures Manual – Core Module
Document Number:	CM-POL-009
Approved by:	Director
Date Approved:	February 2026
Version No:	1.0
Comments:	Initial Release of the Policies and Procedures Manual
Next Review Date:	May 2026

Introduction and Purpose

Holistic Healthcare Management Services is committed to ensuring that participant information is managed responsibly, securely, and in compliance with relevant laws and standards. This policy provides a framework to safeguard participant information, maintain its accuracy and currency, and ensure its appropriate use to deliver high-quality support and services.

The purpose of this policy is to establish clear protocols for the collection, use, retention, and disclosure of participant information. It ensures that participants are informed about how their information is managed and their rights to access, amend, or withdraw consent regarding their information.

This policy underscores the importance of confidentiality, transparency, and informed consent, fostering trust and accountability in managing participant information.

Scope

This policy applies to all Holistic Healthcare Management Services operations, including participant care, administrative processes, and service delivery. It covers all individuals involved in managing participant information, including employees, contractors, consultants, and volunteers, across all organisational settings.

The policy applies to all types of participant information, including electronic records, physical files, and other data storage systems.

Definition

Term	Description
Participant Information	Any personal, sensitive, or health-related information about a participant collected or generated by Holistic Healthcare Management Services during service delivery.
Informed Consent	A process by which participants are provided with clear and comprehensive information about how their data will be used, stored, and disclosed, allowing them to make an informed decision.
Information Management System	A structured framework for collecting, storing, accessing, and protecting participant information proportionate to the size and complexity of the organisation.
Confidentiality	The assurance that participant information will be protected from unauthorised access, use, or disclosure.
Data Security	Measures and processes implemented to protect participant information from theft, loss, or damage, ensuring its integrity and confidentiality.

Outcomes and Indicators

Term	Description
Management of each participant’s information ensures that it is identifiable, accurately recorded, current and confidential. Each participant’s information is easily accessible to the participant and appropriately utilised by relevant workers.	Each participant’s consent is obtained to collect, use and retain their information or to disclose their information (including assessments) to other parties, including details of the purpose of collection, use and disclosure. Each participant is informed in what circumstances the information could be disclosed, including that the information could be provided without their consent if required or authorised by law. Each participant is informed of how their information is stored and used, and when and how each participant can access or correct their information, and withdraw or amend their prior consent. An information management system is maintained that is relevant and proportionate to the size and scale of the organisation and records each participant’s information in an accurate and timely manner. Documents are stored with appropriate use, access, transfer, storage, security, retrieval, retention, destruction and disposal processes relevant and proportionate to the scope and complexity of supports delivered.

Term

Description

Management of each participant’s information ensures that it is identifiable, accurately recorded, current and confidential. Each participant’s information is easily accessible to the participant and appropriately utilised by relevant workers.

Each participant’s consent is obtained to collect, use and retain their information or to disclose their information (including assessments) to other parties, including details of the purpose of collection, use and disclosure. Each participant is informed in what circumstances the information could be disclosed, including that the information could be provided without their consent if required or authorised by law.
Each participant is informed of how their information is stored and used, and when and how each participant can access or correct their information, and withdraw or amend their prior consent.
An information management system is maintained that is relevant and proportionate to the size and scale of the organisation and records each participant’s information in an accurate and timely manner.
Documents are stored with appropriate use, access, transfer, storage, security, retrieval, retention, destruction and disposal processes relevant and proportionate to the scope and complexity of supports delivered.

Guiding Principles

Participant-Centred Approach: Participant information management is conducted transparently, with a focus on respecting participants’ rights, preferences, and consent (Indicator 1).
Compliance with Laws and Standards: The organisation adheres to relevant privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles, ensuring compliance in all aspects of information management.
Accuracy and Accessibility: Participant information is kept up-to-date, accurate, and accessible to authorised individuals, enabling effective support delivery and safeguarding participant rights (Indicator 3).
Security and Confidentiality: Appropriate security measures are implemented to protect participant information against unauthorised access, loss, or misuse (Indicator 4).
Transparency and Empowerment: Participants are informed about how their information is collected, stored, used, and disclosed, empowering them to make informed decisions and exercise their rights (Indicators 2, 3).

Policy

Holistic Healthcare Management Services will establish and maintain an advanced information management system that supports the secure collection, storage, retrieval, and use of participant information. This system will be designed to meet privacy legislation requirements, including compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). The system will be adaptable and scalable, aligning with the organisation’s size, scope, and the complexity of supports provided. It will also integrate advanced technologies and best practices to ensure participant information remains accessible, accurate, and secure.

The system will include automated processes for tracking changes, notifying relevant personnel of updates, and flagging areas requiring immediate attention. Regular system evaluations and upgrades will be conducted to ensure that the organisation remains at the forefront of privacy and data security standards. This commitment ensures that participant information is handled with the highest level of care, supporting efficient service delivery and safeguarding participant rights.

The organisation commits to:

Obtaining informed consent for information collection, use, and disclosure (Indicator 1)

Informed consent will be the cornerstone of information management at Holistic Healthcare Management Services. Consent forms will include clear, plain language explanations of why information is being collected, how it will be used, who will have access, and under what circumstances it may be disclosed. These forms will provide participants with examples of how their information could be utilised, such as improving support plans or coordinating care with other professionals.

Participants will be informed that certain disclosures might occur without their consent if mandated by law, such as reporting to regulatory bodies. Staff will undergo regular training to ensure they can effectively communicate these processes to participants, using accessible language, alternative formats, or assistive technologies when required.

Ensuring participants can access, correct, and manage their information (Indicator 2)

Participants will be empowered with detailed guidance and support to access their personal records, propose corrections, or update their preferences. The organisation will ensure that requests are acknowledged promptly and addressed transparently, fostering trust and confidence.

The organisation will implement user-friendly mechanisms, such as secure online portals or designated contact points, to facilitate seamless access and corrections. Participants will also be educated on their rights to withdraw or amend consent at any point, ensuring their information remains aligned with their preferences and current circumstances.

Implementing a secure information management system (Indicator 3)

Holistic Healthcare Management Services will deploy an information management system equipped with sophisticated encryption protocols, access controls, and automated auditing features to ensure data integrity. The system will allow for real-time updates, enabling accurate and timely recording of participant information across all operational areas.

Customisable access levels will be established to ensure that only authorised personnel can view or modify sensitive information. The system will also include tracking mechanisms to monitor who accessed the data and for what purpose, ensuring complete transparency and accountability.

Enforcing robust data security protocols (Indicator 4)

Comprehensive data security protocols will govern every aspect of information handling, from collection to destruction. These protocols will include multi-factor authentication, routine system audits, and secure disposal methods such as shredding or digital wiping of records.

Regular training for staff will reinforce best practices in data security, including recognising phishing attempts, safeguarding portable devices, and maintaining confidentiality in conversations. Additionally, a formal incident response plan will be in place to address data breaches swiftly and effectively, minimising potential harm to participants.

Providing training to all workers handling participant information

Staff at all levels will receive training tailored to their roles, covering legal obligations, organisational policies, and practical skills for managing participant information securely. This training will include modules on consent processes, data accuracy, secure storage, and recognising potential security threats.

Competency assessments will be conducted periodically to ensure that workers remain up-to-date with evolving privacy standards and organisational requirements. Continuous education opportunities, such as workshops or online courses, will be provided to maintain a culture of excellence in information management.

Procedure

Consent Management

Obtaining informed consent will involve a multi-step process to ensure participants fully understand the implications of providing their information. Workers will explain the purpose of data collection, how it will be used, and any potential risks involved. This communication will be tailored to the participant’s preferred language and mode of communication, ensuring inclusivity.

Consent will be revisited periodically, especially when significant changes occur, such as modifications to a support plan or updates to privacy laws. Workers will document all interactions related to consent in a secure system, ensuring a clear record of the participant’s decisions and any subsequent updates.

Information Collection and Accuracy

Information will be collected through direct communication with participants or their authorised representatives, ensuring its relevance and reliability. Before entering data into the system, workers will double-check details for accuracy, such as participant names, contact information, and support preferences.

Verification procedures will include cross-referencing data with existing records and seeking clarification from participants where discrepancies arise. By embedding accuracy checks at every stage, Holistic Healthcare Management Services ensures that participant information supports effective decision-making and quality care.

Access and Correction Rights

Participants will receive comprehensive information on their rights to access and correct their records. Requests will be logged systematically, and participants will be updated on the progress of their requests. Staff will guide participants through the process, offering assistance to those who require additional support, such as individuals with disabilities or limited digital literacy.

Corrections will be validated against supporting evidence to maintain data integrity, and updated records will be communicated to relevant teams to ensure continuity of care.

Information Storage and Security

Data will be stored in a secure environment, whether digital or physical, with clearly defined access protocols. Electronic data will utilise encrypted servers with automated backups, while physical files will be stored in locked cabinets within restricted areas.

Regular security audits will identify vulnerabilities, ensuring that protective measures remain effective. Staff will also be trained in handling data securely, including practices for transferring records, sharing information, and accessing systems remotely.

Information Use and Disclosure

The use of participant information will be strictly limited to purposes outlined in consent agreements. For disclosures requiring legal compliance, such as reporting risks to public safety, workers will ensure participants are informed unless otherwise prohibited by law.

Detailed logs will document every instance of information use or disclosure, including the rationale and authorisation for the action. This ensures accountability and enables participants to track how their information has been handled.

Information Retention and Disposal

Retention periods will align with legal and regulatory standards, ensuring information is stored only for as long as necessary. The organisation will implement clear procedures for securely destroying outdated records, using methods appropriate to the type of data. Disposal audits will confirm compliance, with detailed logs maintained to provide an audit trail. By adhering to strict retention and disposal guidelines, Holistic Healthcare Management Services minimises risks associated with unauthorised access to historical data.

Roles and Responsibilities

Ref No	Roles	Responsibilities
1	Board and Senior Management	Ensure compliance with legislative and regulatory requirements. Allocate resources for the implementation and maintenance of secure information management systems. Review and approve policies, procedures, and audit findings related to information management.
2	Workers	Adhere to organisational policies for collecting, storing, and disclosing participant information. Maintain confidentiality and promptly report any data breaches or security concerns. Support participants in accessing and managing their information.
3	Information Management Officer	Oversee the organisation’s information management system and ensure alignment with privacy standards. Conduct training sessions for staff on information management policies and best practices. Monitor compliance through regular audits and risk assessments.

Record Keeping

Participant Records

Comprehensive records of participant information, including consent forms, assessments, and support plans, will be maintained securely and updated regularly.

Access and Amendment Requests

Documentation of participant requests for information access or correction, including actions taken, will be stored for accountability.

Data Breach Reports

Any incidents involving unauthorised access or breaches will be thoroughly documented, including mitigation measures and outcomes.

Information Disposal Logs

Details of destroyed records, including dates and methods of disposal, will be recorded to ensure compliance with retention policies.

References

Privacy Act 1988 (Cth)
Australian Privacy Principles (APPs)
NDIS Practice Standards and Quality Indicators
ISO/IEC 27001:2013 Information Security Management Systems

Policy Review

This policy will be reviewed annually to ensure alignment with best practices, legislative requirements, and feedback from participants, staff, and advocates. Updates will be made as needed to enhance its effectiveness and relevance.