NDIS Policies and Procedures Manual – Core Module
Document Number: CM-POL-003
Document Control
This table shows a record of significant changes to the document.
| Legal Name: | Holistic Healthcare Management Services |
| ABN: | 20695058096 |
| ACN: | 695058096 |
| Primary address/head office: | 15 Agasse Way, Tapping WA 6065 |
| Document Name: | NDIS Policies and Procedures Manual – Core Module |
| Document Number: | CM-POL-003 |
| Approved by: | Director |
| Date Approved: | February 2026 |
| Version No: | 1.0 |
| Comments: | Initial Release of the Policies and Procedures Manual |
| Next Review Date: | May 2026 |
Purpose
The purpose of this policy is to ensure that Holistic Healthcare Management Services respects and protects the dignity and privacy of all participants accessing its supports and services. Privacy is a fundamental right, and this policy ensures compliance with the National Disability Insurance Scheme (NDIS) Practice Standards, the Privacy Act 1988 (Cth), and the Australian Privacy Principles (APPs). These legislative frameworks mandate that personal information be handled securely, transparently, and with respect for individuals’ autonomy.
This policy is required to ensure participants’ personal information is managed in a manner that safeguards their privacy, promotes informed consent, and upholds their dignity. By implementing robust practices for data handling, Holistic Healthcare Management Services demonstrates its commitment to fostering trust and integrity in all participant interactions.
Personal information is collected to enable the development and execution of tailored support plans. These plans are designed to address each participant’s unique needs and goals. The information is also used to coordinate with healthcare providers, comply with legal obligations, and improve service delivery through regular reviews.
Participants are informed of specific instances where their information might be shared, such as with medical practitioners or NDIS regulatory bodies.
Before any such disclosures occur, explicit consent is obtained, and participants are provided with detailed explanations. A thorough documentation process ensures that all uses of personal information are traceable and accountable.
Scope
This policy applies to all participants accessing supports and services from Holistic Healthcare Management Services. It encompasses:
- Participants receiving NDIS-funded supports and services: Ensuring privacy and dignity are upheld for all individuals whose supports are funded through the National Disability Insurance Scheme.
- Families, guardians, and advocates: Recognizing the role of family members and advocates in supporting participants and ensuring their involvement adheres to privacy principles.
- Staff, contractors, and volunteers: Extending the privacy and dignity commitments to include all individuals interacting with participants as part of Holistic Healthcare Management Services’s service delivery framework.
- Service locations and environments: Applying privacy standards to all physical, digital, and community-based settings where supports are provided.
This policy also covers all personal information collected, stored, used, and disclosed in connection with Holistic Healthcare Management Services’s operations, ensuring consistency in respecting participant privacy across all organizational functions.
Definition
| Term | Description |
|---|---|
| Personal Information | Information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not. |
| Sensitive Information |
A subset of personal information that is afforded a higher level of privacy protection. It includes:
|
| Collection Notice | A statement provided to individuals explaining how their personal information will be collected, used, and disclosed. |
Outcomes and Indicators
| Term | Description |
|---|---|
| Each participant accesses supports that respect and protect their dignity and right to privacy. |
|
Policy
Holistic Healthcare Management Services is committed to safeguarding the privacy and dignity of all individuals who interact with Holistic Healthcare Management Services’s services. This Privacy Policy aligns with the NDIS Practice Standards on Privacy and Dignity, ensuring compliance with legal and ethical obligations to protect personal information.
Holistic Healthcare Management Services collect personal information only as necessary to provide quality support and services. This includes details such as your name, address, contact information, and information specific to the support services you require. Non-personal information, such as your interactions with Holistic Healthcare Management Services’s website, may also be collected to improve service delivery and user experience.
Holistic Healthcare Management Services use your information solely to provide and manage services under the NDIS framework, facilitate communication, fulfil regulatory requirements, and ensure that your rights and dignity are upheld. We will always seek your informed consent before collecting, using, or sharing your information unless otherwise required by law.
We may share your information with third parties only when necessary to provide NDIS-related services, such as engaging with allied health professionals, contractors, or external service providers. All third parties are bound by strict confidentiality agreements to ensure your information is handled in compliance with the NDIS Practice Standards.
You have the right to access, review, and correct your personal information at any time. Requests can be made by contacting Holistic Healthcare Management Services directly, and Holistic Healthcare Management Services will respond promptly. Additionally, you can withdraw consent or request the deletion of your information, subject to legal and contractual obligations. Our commitment is to respect your autonomy and ensure that your choices are honoured wherever possible.
We implement robust measures to protect your personal information, including secure storage systems, restricted access protocols, and staff training on privacy principles. However, no system can be entirely secure, and Holistic Healthcare Management Services encourage you to contact Holistic Healthcare Management Services immediately if you suspect any breach of your information.
We retain your information only for as long as required to fulfil service obligations or comply with applicable laws. Once your information is no longer needed, it will be securely destroyed or anonymized in accordance with best practices and legal requirements.
Our services are inclusive and respect the rights of all individuals, including children and vulnerable persons. We do not collect or use information from individuals under the age of 18 without appropriate consent from their parent or guardian.
This Privacy Policy is reviewed regularly to ensure compliance with NDIS standards and evolving legal requirements. Updates will be communicated through Holistic Healthcare Management Services’s website or directly to you as appropriate. The effective date will always reflect the latest revision.
If you have any questions or concerns about this Privacy Policy or wish to exercise your rights, please contact Holistic Healthcare Management Services at [Business Contact details]
Procedure
The following procedures are implemented to ensure that Holistic Healthcare Management Services meets its policy objective of ensuring that the privacy and confidentiality of each participant are protected when accessing our supports and services.
Collection of Personal Information
Principles of Collection: Holistic Healthcare Management Services adheres to several key principles when collecting personal information. All information is collected lawfully and fairly, without undue intrusion or deception. Information is only collected if it is reasonably necessary for one or more of our functions or activities related to the provision of NDIS supports and services. Where required (e.g., for the collection of sensitive information), explicit consent is obtained from the individual or their legally authorized representative. Holistic Healthcare Management Services is committed to transparency, ensuring individuals are informed about the purpose of collection, how the information will be used and disclosed, and their rights regarding their personal information.
Collection Methods: Personal information may be collected through various methods. This can include directly from the individual through interviews, questionnaires, application forms, or during the provision of supports. Information may also be collected from a legally authorized representative with appropriate authority (e.g., guardianship, power of attorney). With the individual’s consent, information may be gathered from other service providers. In limited circumstances, and only when necessary and permissible by law, information may be collected from publicly available sources including social media.
Procedure for Collecting Personal Information: Before collecting any personal information, staff must clearly identify the specific purpose(s) for which the information is being collected. Staff must then determine if the collection is reasonably necessary for the identified purpose(s) and only collect information that meets this criterion. At or before the time of collection, staff must provide a collection notice to the individual. This notice must include Holistic Healthcare Management Services’s identity and contact details, the purpose(s) of collection, the types of personal information being collected, how the information will be used and disclosed, information about how the individual can access and correct their personal information, information about how the individual can make a complaint about a breach of privacy, whether the collection is required or authorized by law, the key consequences if the personal information is not collected, and any overseas recipients of the information. If collecting sensitive information, staff must obtain the individual’s explicit consent. Consent must be freely given without coercion or pressure, specific to the purpose of collection, informed based on a clear understanding of how the information will be used, and current, meaning it is given at the time of collection. Finally, staff must document the collection of personal information, including the date and time of collection, the method of collection, the individual’s name and contact details, the purpose of collection, whether a collection notice was provided, and whether consent was obtained (if applicable).
Specific Considerations for Sensitive Information: Extra care must be taken when collecting sensitive information. Staff must only collect sensitive information with the individual’s explicit consent, unless an exception applies under the APPs. The collection must be directly related to the provision of NDIS supports and services. It is also imperative that sensitive information is stored and handled securely.
Training and Awareness
All staff will receive regular training on privacy obligations, including this procedure and the APPs.
Purposes for Which Personal Information is Collected, Held, Used, and Disclosed
Collection of Personal Information: Personal information is collected to deliver safe, high-quality, and individualized services to participants. The types of personal information collected may include contact details, health and medical records, financial information, cultural and linguistic background, and emergency contact details. Collection occurs through direct interactions with participants, their representatives, or relevant third parties. Holistic Healthcare Management Services ensures that all information is collected lawfully, with the participant’s informed consent or as otherwise permitted by law.
Personal information is collected:
- To develop and implement individualized plans and supports tailored to the needs of participants.
- To ensure compliance with NDIS funding requirements and service agreements.
- To facilitate effective communication between Holistic Healthcare Management Services, participants, and relevant stakeholders.
- To assess and manage risks to the safety and well-being of participants and staff.
Participants are informed about the purposes for which their information is being collected and are provided with the opportunity to ask questions or seek clarification before their information is recorded.
Holding and Storage of Personal Information: Personal information collected by Holistic Healthcare Management Services is stored securely to protect it from unauthorized access, loss, or misuse. Information is held in both physical and electronic formats, with strict access controls in place to ensure that only authorized personnel can access sensitive data. Physical records are stored in locked cabinets, while electronic data is stored on encrypted systems with password protection and regular security updates. Retention periods for personal information comply with legal and regulatory requirements. Information that is no longer required is securely destroyed or anonymized in accordance with Holistic Healthcare Management Services’s data retention policy.
Use of Personal Information: Personal information is used to provide participants with services that meet their needs and preferences. It is used to:
- Plan and deliver services in line with participant goals and NDIS outcomes.
- Monitor and evaluate the quality and effectiveness of services provided.
- Respond to feedback, complaints, or incidents in a manner that upholds participant rights and safety.
- Ensure compliance with legal, regulatory, and funding body requirements.
All uses of personal information are limited to the purposes for which it was collected, except where consent has been provided for additional uses or where required by law.
Disclosure of Personal Information: Personal information may be disclosed to third parties only when it is necessary to provide supports and services or to comply with legal obligations. Disclosures are made to:
- Healthcare providers, allied health professionals, or other service providers involved in the participant’s care.
- Government agencies or funding bodies, such as the NDIS Quality and Safeguards Commission, when required by law or contractual obligations.
- Emergency services or law enforcement in circumstances involving safety, health, or legal risks.
Before disclosing personal information, Holistic Healthcare Management Services ensures that participants are informed and, where appropriate, their consent is obtained. Disclosures without consent occur only in situations permitted or mandated by law.
Data Breach Management
Identification and Reporting: The first step in managing a data breach involves identification and reporting. Any staff member who becomes aware of a potential or actual data breach must immediately report the incident to the Privacy Officer or designated contact point. Examples of incidents that require reporting include unauthorized access to participant files, accidental disclosure of sensitive information, or loss of devices containing such data. Initial details, such as the time, date, and description of the breach, should be documented promptly.
Containment and Preliminary Assessment: The Privacy Officer will take immediate action to contain the breach. Actions may include isolating affected systems, securing compromised records, or disabling user accounts involved in the breach. Conduct a preliminary assessment to identify the scope of the breach, systems impacted, and individuals potentially affected.
Risk Assessment: The next step is risk assessment. This involves evaluating the severity and potential impact of the breach by considering the type and sensitivity of the data involved, the likelihood of harm to affected individuals, and the possible misuse of the information. Based on this assessment, the Privacy Officer will determine whether the breach constitutes a Notifiable Data Breach (NDB) under the Privacy Act.
Notification: If the breach poses a risk of serious harm, notifications must be initiated promptly. Senior management and relevant internal stakeholders are informed, and affected individuals are notified with clear information about the breach, the mitigation steps being taken, actions they can take to protect themselves, and contact details for further assistance. Notify affected individuals, providing clear information on:
- The nature of the breach.
- Mitigation steps being taken.
- Actions individuals can take to protect themselves.
- Contact details for further assistance.
Additionally, regulatory bodies such as the Office of the Australian Information Commissioner (OAIC) and the NDIS Commission are notified if required.
Mitigation and Remediation: Mitigation and remediation follow notification. Measures to reduce harm may include monitoring affected accounts for suspicious activity, resetting passwords or access credentials, and offering support such as credit monitoring to affected individuals. A root cause analysis is conducted to identify the underlying issue and implement measures to prevent recurrence.
Documentation and Record-Keeping: Documentation and record-keeping are critical throughout the breach management process. Comprehensive records must be maintained, including details of the breach, affected parties, actions taken to contain and mitigate the breach, notifications issued, and their outcomes. These records are essential for auditing and future reference.
Post-Incident Review and Continuous Improvement: The final step involves post-incident review and continuous improvement. A review is conducted to evaluate the effectiveness of the response process and identify areas for improvement. Relevant policies, procedures, and security controls are updated based on lessons learned, and additional training is provided to staff if necessary.
Roles and Responsibilities
| Ref No | Roles | Responsibilities |
|---|---|---|
| 1 | Qualified Health Practitioners |
|
| 2 | Workers |
|
| 3 | Participant |
|
| 4 | Management |
|
Record Keeping
Documentation of Participant Preferences and Support Plans
- Each participant’s preferences, goals, and specific needs must be thoroughly documented in their personalised support plan. This includes details about their chosen communication methods, support network involvement, and preferred activities.
- Support plans must also include records of assessments, participant involvement in decision-making processes, and any adjustments made to ensure their preferences and rights are respected.
- These records are reviewed regularly, at least annually or whenever significant changes in the participant’s circumstances or needs occur, to ensure they remain current and relevant.
Consent and Decision-Making Records
- Records of informed consent must be maintained for all decisions made in collaboration with participants, including agreements about their support plans, community engagement, and involvement of support networks.
- Documentation must clearly outline the process of obtaining consent, including information provided to participants to enable informed decision-making.
Incident Reporting and Feedback Records
- Any incidents, concerns, or feedback related to the implementation of person-centred support must be recorded in the organisation’s incident management or feedback system.
- Reports should include the nature of the incident or feedback, actions taken to address the issue, and any follow-up measures implemented to enhance support quality.
Staff Training and Competency Records
- Records of all staff training related to person-centred support, including the content of training sessions, attendee lists, and competency assessments, must be maintained.
- These records are reviewed periodically to ensure that all staff have the necessary skills and knowledge to deliver person-centred support effectively.
Confidentiality and Data Protection
- All participant-related records are to be handled in compliance with organisational privacy policies and relevant Australian data protection legislation.
- Records must be securely stored, with access limited to authorised personnel. Electronic records must be password-protected, and physical records must be kept in locked, secure locations.
Continuous Improvement and Audit Trails
- Documentation of reviews, audits, and quality improvement activities related to person-centred support must be maintained. These records help identify areas for improvement and demonstrate compliance with the organisation’s policies and procedures.
- Records of changes made to support plans, policies, or procedures in response to participant feedback or audit findings must be clearly documented to provide an audit trail for quality assurance purposes.
Related Documents
- Participant Handbook
- Participant Consent Form
- Service Agreement
- Data Breach Response Plan
- Data Breach Assessment Report
- Staff Training Plan
- Staff Handbook
- Continuous Improvement Plan
- Continuous Improvement Register
References
- Privacy Act 1988 (Cth)
- Australian Privacy Principles (APP)
- National Disability Insurance Scheme Act 2013 (Cth)
- National Disability Insurance Scheme (Complaints Management and Resolution) Rules 2018
- National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018
- NDIS Practice Standards and Quality Indicators – November 2021
- Freedom of Information Act 1982 (Cth)
- OAIC’s website – Notifiable data breaches
Policy Review
This policy will be reviewed annually or as required by legislative changes, organisational needs, or participant feedback. Reviews will incorporate insights from audits, staff, and participants to ensure the policy remains effective and relevant.
