8. Recording, disclosing and using information
The NDIS Act contains a number of specific authorisations that allow NDIA staff and other persons in lawful possession of protected information (for example, contractors, local area co-ordinators or providers of supports) to record, disclose to any person or otherwise use protected information to people outside the NDIA (section 60(2)).
The unauthorised disclosure and use of protected information is an offence under the NDIS Act (section 62), and may also be a breach of the APS Code of Conduct (see criminal sanctions).
8.1 General power to record, disclose and use information for the purposes of the NDIS Act
A person may make a record, disclose to any person or otherwise use protected information for the purposes of the NDIS Act (section 60(2)(d)(i)).
Making a record, disclosure or use of protected information will be for the purposes of the NDIS Act if:
- it is authorised by the NDIS Act; and
- it is required by the NDIS Act.
The recording, disclosure or use of protected information is also taken to be for the purposes of the NDIS Act if the NDIA believes, on reasonable grounds, that it is reasonably necessary for one or more of the following purposes:
- research into matters relevant to the NDIS (section 60(3)(a));
- actuarial analysis of matters relevant to the NDIS (section 60(3)(b)); or
- policy development (section 60(3)(c)).
NDIA staff must consult with the Privacy Contact Officer where there is any doubt in relation to whether recording, disclosing or using information would be for the purposes of the NDIS Act.
8.2 Recording, disclosing and using information with the consent of the person to whom the information relates
The NDIS Act allows for the recording, disclosure or use of protected information when a person to whom the information relates requests or consents to the disclosure (express consent) or can be taken to have requested or consented to the disclosure (implied consent) (section 60(2)(d)(iii)).
When determining whether a participant has consented to the disclosure of protected information about them, it is important to remember that the consent can be in writing (such as an email) or provided orally (such as over the telephone or in a face to face meeting).
Where consent is given orally, NDIA staff must make a written record of that consent.
It is also possible that a participant can be taken to have given their consent where they agree to a course of action that requires the disclosure of their protected information. For example, a participant will be taken to have consented to the disclosure of their protected information to a service provider where the participant has requested they receive services from that service provider (i.e. during the development of the participant's plan) and disclosure is necessary to facilitate the provision of those services.
NDIA staff must contact the Privacy Contact Officer where they are considering whether to disclose a participant's protected information and are not sure whether the participant or their parent/guardian have consented to the disclosure.
NDIA staff must also ensure that any person receiving protected information understands the obligations on them to comply with information handling provisions of the NDIS Act.
8.3 Recording, disclosing and using information to prevent or lessen a serious threat to an individual's life, health or safety
The NDIS Act expressly allows for the recording, use or disclosure of protected information where a person believes on reasonable grounds that the making of the record, or the disclosure or use of the information, is necessary to prevent or lessen a serious threat to an individual's life, health or safety (section 60(2)(e)).
If the urgent disclosure of protected information is necessary to prevent or lessen a serious threat to an individual's life, health or safety, the NDIA will carefully consider the matter and proceed with the urgency required by the circumstances.
A serious threat to life, health or safety could arise when a person is subject to, or at risk of, harm, abuse, neglect or exploitation. Such threats could be physical or emotional, such that the person has suffered or is likely to suffer physical or psychological injury that jeopardises, or is detrimental to their wellbeing.
Harm, abuse, neglect or exploitation may also involve a reasonable likelihood of a person being killed, injured, abused or neglected by a person they live with, a person who has threatened to kill or injure them before or a person who has killed, abused or neglected another person in the past.
Whether a serious threat exists, and whether there are reasonable grounds to believe that the disclosure is necessary to prevent or lessen the threat to the individual's health, life or safety are questions of fact to be determined in the individual circumstances of each case.
Careful consideration and judgement is required, along with supporting evidence on which to form the belief required.
If time permits, NDIA staff must discuss the matter with the most senior person available and seek advice from the Privacy Contact Officer, particularly where it is unclear whether the disclosure would prevent or lessen a serious threat to an individual's life, health or safety.
All disclosures must be documented as soon as possible after the disclosure is made. The record should contain:
- a copy of the protected information released or a record of any oral disclosures;
- the circumstances of the release, including to whom, the method of release and the time and date; and
- a clear description of the factual information which was relied on to demonstrate that the belief was based on reasonable grounds.
A copy of this information must also be provided to the Privacy Contact Officer as soon as possible after the disclosure.