Privacy and Confidentiality

Policy

Confidentiality is of paramount importance in our centre. This policy relates to the collection storage, use, disclosure and disposal of personal information, including photos, videos and health information and to ensure compliance with privacy legislation

Background

Early childhood services are obligated by law, service agreements and licensing requirements to comply with the privacy and health records legislation when collecting personal and health information about individuals.

The Health Records Act 2001 (Part 1, 7.1) and the Information Privacy Act 2000 (Part 1, 6.1) include a clause that overrides the requirements of these Acts if they conflict with other Acts or Regulations already in place. For example, if there is a requirement under the Education and Care Services National Law Act 2010 or the Education and Care Services National Regulations 2011 that is inconsistent with the requirements of the privacy legislation, services are required to abide by the Education and Care Services National Law Act 2010 and the Education and Care Services National Regulations 2011.

Legislation

• Education and Care Services National Law Act 2010
• Education and Care Services National Regulations 2011: Regulations 181, 183
• Freedom of Information Act 1982
• Health Records Act 2001 (Vic)
• Information Privacy Act 2000 (Vic)
• National Quality Standard, Quality Area 7
• Privacy Act 1988 (Cth)
• Public Records Act 1973 (Vic)

Definitions

Freedom of Information Act 1982: Legislation regarding access and correction of information requests.

Health information: Any information or an opinion about the physical, mental or psychological health or ability (at any time) of an individual.

Health Records Act 2001: State legislation that regulates the management and privacy of health information handled by public and private sector bodies in Victoria.

Information Privacy Act 2000: State legislation that protects personal information held by Victorian Government agencies, statutory bodies, local councils and some organisations, such as early childhood services contracted to provide services for government.

Personal information: Recorded information (including images) or opinion, whether true or not, about a living individual whose identity can reasonably be ascertained.

Privacy Act 1988: Commonwealth legislation that operates alongside state or territory Acts and makes provision for the collection, holding, use, correction, disclosure or transfer of personal information.

Privacy breach: An act or practice that interferes with the privacy of an individual by being contrary to, or inconsistent with, one or more of the information Privacy Principles (refer to Attachment 2: Privacy principles in action) or any relevant code of practice.

Public Records Act 1973 (Vic): Legislation regarding the management of public sector documents.

Sensitive information: Information or an opinion about an individual’s racial or ethnic origin, political opinions, membership of a political party, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual preference or practices, or criminal record. This is also considered to be personal information.

The Approved Provider (or delegate) is responsible for:

• ensuring all records and documents are maintained and stored in accordance with Regulations 181 and 183 of the Education and Care Services National Regulations 2011
• ensuring the service complies with the requirements of the Privacy Principles as outlined in the Health Records Act 2001, the Information Privacy Act 2000 and, where applicable, the Privacy Act 1988 by developing, reviewing and implementing processes and practices that identify:
• what information the service collects about individuals, and the source of the information
• why and how the service collects, uses and discloses the information
• who will have access to the information
• risks in relation to the collection, storage, use, disclosure or disposal of and access to personal and health information collected by the service
• ensuring parents/guardians know why the information is being collected and how it will be managed
• providing adequate and appropriate secure storage for personal information collected by the service
• developing procedures that will protect personal information from unauthorised access
• ensuring the appropriate use of images of children, including being aware of cultural sensitivities and the need for some images to be treated with special care
• ensuring all employees and volunteers are provided with a copy of this policy
• ensuring all parents/guardians are provided with the service’s Privacy Statement
• informing parents/guardians that a copy of the complete policy is available on request
• ensuring a copy of this policy, including the Privacy Statement, is prominently displayed at the service and available on request
• establishing procedures to be implemented if parents/guardians request that their child’s image is not be taken, published or recorded, or when a child requests that their photo not be taken.

The Nominated Supervisor (or delegate) is responsible for:

• assisting the Approved Provider to implement this policy
• reading  and following the Privacy and Confidentiality Policy
• providing notice to children and parents/guardians when photos/video recordings are going to be taken at the service
• ensuring educators and all staff are provided a copy of this policy and that they complete the Letter of acknowledgement and understanding
• obtaining informed and voluntary consent of the parents/guardians of children who will be photographed or videoed.

Certified Supervisors and other educators are responsible for:

• reading and following the Privacy and Confidentiality Policy
• recording information on children, which must be kept secure and may be requested and viewed by the child’s parents/guardians and representatives of DEECD during an inspection visit
• ensuring they are aware of their responsibilities in relation to the collection, storage, use, disclosure and disposal of personal and health information
• implementing the requirements for the handling of personal and health information, as set out in this policy
• respecting parents’ choices about their child being photographed or videoed, and children’s choices about being photographed or videoed.

Parents/guardians are responsible for:

• providing accurate information when requested
• maintaining the privacy of any personal or health information provided to them about other individuals, such as contact details
• completing all permission forms and returning them to the service in a timely manner
• being sensitive and respectful to other parent/guardians who do not want their child to be photographed or videoed
• being sensitive and respectful of the privacy of other children and families in photographs/videos when using and disposing of these photographs/videos.

Families Records and Information:

When will information be divulged?

For medical treatment or emergency

To outside agencies with parents permission

When required by National Law ie: Department of Education and early Childhood Development

With written consent from person/s with lawful authority

All staff sign a confidentiality agreement upon beginning employment

Who has access to your information?

• Management
• Administration staff
• Relevant educators caring for your child

Individuals have the right to ask for access to personal information the service holds about them without providing a reason for requesting access. Under the privacy legislation, an individual has the right to:

• request access to personal information that the service holds about them
• access this information
• make corrections if they consider the data is not accurate, complete or up to date.

There are some exceptions set out in the Information Privacy Act 2000, where access may be denied in part or in total. Examples of some exemptions are where:

• the request is frivolous or vexatious
• providing access would have an unreasonable impact on the privacy of other individuals
• providing access would pose a serious threat to the life or health of any person
• the service is involved in the detection, investigation or remedying of serious improper conduct and providing access would prejudice that.

Personal Information One World collects:

• Contact details for parents and children
• Details for emergency contacts and persons authorised to collect your child
• Children’s health status
• Immunisation records
• Developmental records, plans, portfolios and observations
• External agency information
• Custodial arrangements
• Incident reports
• Medication records
• Child Care Benefit information and additional funding records
• Medical records
• Permission forms

Storing of Personal Information:

• Your personal files are kept in a secure filing cabinet in a private room which is kept locked outside of operational hours. Computerised records are  stored safely and secured with a password for access
• Staff observations and portfolios are kept in a secure cupboard in your child’s family room
• Your personal files and portfolios are available for your viewing upon request

Staff Records and Information:

When will information be divulged:

• For medical treatment or emergency
• When required by law
• With written consent by you

Who has access to your information?

• Management staff
• Financial controller

Individuals have the right to ask for access to personal information the service holds about them without providing a reason for requesting access. Under the privacy legislation, an individual has the right to:

• request access to personal information that the service holds about them
• access this information
• make corrections if they consider the data is not accurate, complete or up to date.

There are some exceptions set out in the Information Privacy Act 2000, where access may be denied in part or in total. Examples of some exemptions are where:

• the request is frivolous or vexatious
• providing access would have an unreasonable impact on the privacy of other individuals
• providing access would pose a serious threat to the life or health of any person
• the service is involved in the detection, investigation or remedying of serious improper conduct and providing access would prejudice that.

Personal Information One World Collects

• Tax declaration form
• Working contract
• Personal Details
• Emergency Contact details
• Medical details
• Immunisation details
• Working with Children Check
• Qualifications
• First Aid, CPR and Anaphylaxis certificates
• Medical History
• Permission forms
• Personal Resume
• Payroll information
• Superannuation details

Retention  of records are kept and archiving and disposal of these records:

Once information can be destroyed it is placed in a secure bag to be collected by a company for shredding.

Type of record	Timeframe	Reference
Child assessments	Until the end of 3 years after the child’s last attendance	Regulations 74, 183
Incident, injury, trauma and illness record	Until the child is 25 years old	Regulations 87, 183
Medication record	Until the end of 3 years after the child’s last attendance	Regulations 92, 183
Child’s attendance	Until the end of 3 years after the record was made	Regulations 158 – 159, 183
Child enrolment	Until the end of 3 years after the child’s last attendance	Regulations 160, 183
Death of a child while being educated and cared for by the service	Until the end of 7 years after the death	Regulations 12, 183
Staff record	Until the end of 3 years after the staff member works for the service	Regulations 145
Record of access to early childhood teachers	Until the end of 3 years after the staff member works for the service	Regulations 152
Record of educators working directly with children	Until the end of 3 years after the staff member works for the service	Regulations 151
Record of volunteers and students	Until the end of 3 years after the volunteer or student attended the service	Regulation 149

Permission form for photographs

Background information

Photographs and videos are now classified as ‘personal information’ under the Information Privacy Act 2000.

The purpose of this permission form is to:

• comply with the privacy legislation in relation to all photographs/videos taken at the service, whether by the Approved Provider, Nominated Supervisor, Certified Supervisor, educators, staff, parents/guardians, volunteers or students on placement
• enable photographs/videos of children to be taken as part of the program delivered by the service, whether group photos, videos or photos at special events and excursions etc.
• notify parents/guardians as to who will be permitted to take photographs/videos, where these will be taken and how they will be used.

On enrolment a permission slip is completed to ensure management and staff are aware of parents requests in relation to photos and their use.

Source

Child Care Service Handbook 2011–2012: Section 4.9

Guidelines to the Information Privacy Principles: http://www.privacy.gov.au/law/apply/guidance

KPV Early Childhood Management Manual

Office of the Health Services Commissioner: www.health.vic.gov.au/hsc/

Privacy Victoria: www.privacy.vic.gov.au

Letter of acknowledgement, understanding and declaration of confidentiality

One World for Children Acknowledgement of Country: Here is the land; Here is the sky; Here are my people and here am I. We give thanks to future, present and past; Ancestors and Elders and the connection that lasts. We acknowledge the Wathaurong people on whose land we learn and play; We promise to look after it every day. ©