Purpose

Youth Focus collects individuals’ personal, sensitive and health information related to service facilitation and delivery. The Youth Focus Privacy Policy guides how we collect, manage, use, and protect this information.

Definitions

Client record includes all information recorded by Youth Focus in relation to a young person and their interactions with the service. Including, content related to the nature, delivery, progress, and outcomes of services.

Health Information is defined in the Privacy Act 1988 (Cth) as:

information or an opinion about:

the health, including an illness, disability or injury, (at any time) of an individual; or
an individual’s expressed wishes about the future provision of health services to the individual; or

a health service provided, or to be provided, to an individual; that is also personal information;
other personal information collected to provide, or in providing, a health service to an individual;
other personal information collected in connection with the donation, or intended donation, by an individual of his or her body parts, organs or body substances;
genetic information about an individual in a form that is, or could be, predictive of the health of the individual or a genetic relative of the individual.

Personal Information is defined in the Privacy Act 1988 as:

“information or an opinion about an identified individual, or an individual who is reasonably identifiable:

whether the information or opinion is true or not; and
whether the information or opinion is recorded in a material form or not.”

Personal information includes Sensitive Information and Health Information.

Privacy Legislation means all State and Australian Government privacy legislation which applies to Youth Focus and includes the Privacy Act 1988;

Privacy Principles refers to the Australian Privacy Principles set out in the Privacy Act 1988.

Sensitive Information is defined in the Privacy Act 1988 as:

information or opinion about an individual’s: Racial or ethnic origin; or

Political opinions; or

Membership of a political association; or

Religious beliefs or affiliations; or
Philosophical beliefs; or
Membership of a professional or trade association; or

Membership of a trade union; or
Sexual orientation or practices; or

Criminal record; that is that is also personal information; or

health information about an individual; or
genetic information about an individual that is not otherwise health information; or
biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or (e) biometric templates.

Scope

This policy applies to all services and departments within Youth Focus, including all headspace centres where Youth Focus is the Lead Agency. It is applicable to all staff, contractors, and volunteers.

Policy

How Youth Focus collects information

Youth Focus may collect personal information in a number of ways., including telephone, face to face meetings, forms and questionnaires. Where possible, personal information is collected directly from the individual.

When we receive personal information about an individual from a third party (for example, a referral received from a school or carer). we will take reasonable steps to contact the individual and ensure that they are informed regarding the purpose of and use of their information.

Consent

Youth Focus requires consent to record, use and disclose information. Consent to obtained by Youth Focus will be considered valid if it is:

Voluntary
Informed
Given by someone who has capacity
Accurate and current

See the Youth Focus Consent Policy for the minimum and best-practice standards for obtaining and documenting consent for young people accessing Youth Focus services.

Types of personal and sensitive information

Youth Focus respects the privacy of individuals and is open about the way we handle personal information (including sensitive and health information) shared with us by staff, contractors, volunteers, young people, carers, and members of the community.

We collect the following types of personal information to enable us to operate our business and deliver services.

Client Information, including,

Contact details (e.g. name, address, telephone number, email for client and family contacts)
Personal details (e.g. date of birth, gender, nationality, Medicare and health fund details)
Health information (see Heath Information).

Staff, contractor and volunteer information, including,

Contact details (e.g., name, address, telephone number, email)
Personal details (e.g. date of birth, country of birth, citizenship, residency and visa details)
Details of emergency contact persons
Information relating to qualifications, skills and experience; languages spoken, drivers licence details
Information and opinions from referees for prospective employees and candidates for volunteer work
Bank account details
Results of screening processes (i.e. Working with Children’s checks, National Police Clearance Check)
Health information (if requested by Youth Focus Inc. in which case the reason for collection of this information will be provided).

Donor information, including

Contact details (e.g. name, address, telephone number, email)
Personal details (e.g., date of birth, gender, income, areas of interest, donation history)
Credit card and bank account details.

Individuals have the right to decline sharing personal information reasonably requested by Youth Focus; however, this may impact on our capacity to provide services requested.

Client health information

Youth Focus collects health information about young people to facilitate safe and high-quality care which meets their needs and our professional and organisational obligations. This may include a young person’s medical history and content related to the nature, delivery, progress, and outcomes of services.

If we collect health information from a third party (for example a doctor, carer, or specialist health provider) Youth Focus will let young people know that this information has been collected and we will explain how the information will be used and disclosed.

Youth Focus will not use health information beyond the consent provided unless this aligns with one of the exceptions under Legislation. We will explain how the information will be used and will only disclose information without consent where necessary. See Use and disclosure of personal information.

Some client information, including outcome measures, may be used by Youth Focus, or our partners, as part of planning, research, and evaluation for quality assurance, improvement and reporting. Any client information used for these purposes, or where the individual has not consented to participate in the research, will be de-identified.

Further information can be found in the Client Information Management Policy.

Use and disclosure of personal information

Youth Focus will only use and disclose personal information for the purpose for which it was collected. We may share personal information within Youth Focus when is will likely be useful to the person, such as collaborative approaches to service delivery.

In some instances, we may disclose personal information to external organisations including:

Government departments and agencies who provide funding for Youth Focus services.
External assessment entities and agencies.
Emergency services who may be called to assist during the delivery of Youth Focus services.
Community services, doctors and health care professionals, who assist us to deliver our services.
Other regulatory bodies (for example the Australian Taxation Office, Worksafe, the Workplace Gender Equality Agency, Centrelink).
Referees identified by staff.
Former employers of people who apply for employment or volunteer services at Youth Focus.
Credit agencies.
Youth Focus’s professional advisers, including lawyers, accountants and auditors.

Youth Focus will not disclose an individual’s personal information to a third party unless:

the individual has consented to the release.
the release is authorised or required by law.
Youth Focus reasonably believes that an individual or the public will be harmed if the release is not made.

Wherever practicable and clinically appropriate, the person concerned should be notified prior to information being shared without consent. Youth Focus will ensure that decision making relating to breaking confidentiality is discussed with line management and appropriately documented.

Unauthorised disclosure of information by staff, volunteers and contractors is considered an act of misconduct and will be addressed by performance management procedures. Staff, volunteers and contractors remain obligated to maintain the confidentiality of personal information even if the professional relationship has ended (i.e. the staff member is no longer employed by organisation, the client is no longer engaged in services).

Under the provisions of the Criminal Code a client is able to take legal action against the organisation for any unauthorised disclosure of confidential information.

Unless an individual has opted not to receive such communications, Youth Focus may use personal information to contact that individual (including in person or by telephone, email or text message) in relation to the service provided.

Release of images or personal information for publicity purposes

Youth Focus produces publications (including information brochures and a regular newsletter) and from time to time runs promotional campaigns to raise awareness of its services, raise funds and provide information to the public and other stakeholders. Some of these publications include photographs, video footage and sound recordings in electronic media. We will collect informed consent from individuals who are identifiable before using or publishing any image or recording.

Research and evaluation

Information may be disclosed if it is considered necessary to research and has been approved by an Institutional Ethics Committee. If the individual has not consented to participate in the research, any personal information collected must be de-identified. When client information is required for statistical purposes, information will be deidentified.

Youth Focus may, from time to time, carry out evaluations on the outcomes and impact of our services for planning, service improvement and fundraising purposes. Data used for this purpose will always be de-identified.

Access to and correction of your personal information

Under the Privacy Principles), individuals have a right to access their personal information. This includes requests to correct personal information, which is inaccurate, incomplete or out of date.

Youth Focus will:

respond to requests to correct personal information quickly and confidentially,
take reasonable steps to verify the identity of anyone requesting information to ensure that access is only provided to authorised individuals.

Where proof of identity is required, documents will be sighted but not copied or stored.

correct any inaccurate or out of date information which is brought to our attention.
ensure that requests to access personal information will not impact access to, and engagement with Youth Focus services.

Requests for access or corrections to personal information can be made in writing to reception@youthfocus.com.au. We may ask to see proof of identity to support a request.

Youth Focus will take all reasonable steps to provide access to the information requested within 14 days. If we need more time, (for example, if we need to access a large volume of information) we will aim to complete the request within a maximum of 30 days.

In some cases, Youth Focus may charge reasonable fees for the cost incurred in meeting a request for information, including photocopying and delivery cost of information which is stored offsite. Young people and carers will not be charged for release of information.

Youth Focus may refuse access to information requested in certain circumstances. These include if:

the request relates to personal information about someone other than the individual making the request.
providing access would pose a serious and imminent risk of harm to the person, or others (including vexatious requests).
providing access would create an unreasonable impact on the privacy of others.
providing access would prejudice negotiations with Youth Focus.
access would be unlawful.
denial of access is authorised or required by law.
access would prejudice law enforcement activities.
access discloses a ‘commercially sensitive’ decision making process or information.
any other reason that is provided for in the Privacy Principles or the Privacy Legislation.

If we deny access to any information requested, we will provide an explanation of the reasons, and these reasons will be documented appropriately. Refer to the complaints procedure for information regarding disputes about a request to access information.

Security of personal information

Youth Focus takes reasonable steps to ensure the security and privacy of personal information held by us. The security and reliability of Youth Focus IT systems are controlled by organisational policies, role-based security and best-practice technologies. For further detail, refer to the IT Security Policy.

Youth Focus stores personal information within Australia, ensuring that it remains protected in accordance with the Australian Privacy Legislation.

Breach of information

An unauthorised breach of client information happens when personal information is accessed or released without authorisation, or is lost

Any unauthorised breach of client information is taken seriously by Youth Focus and if unrelated to any of the aforementioned exceptions, is considered an act of misconduct and may result in:

disciplinary action by the employer of the person who made the unauthorised disclosure.
disciplinary action by the health professional’s regulatory body.
an action for damages against the person who made the unauthorised disclosure and/or their employer.
penalties, including fines, as specified in the Health Services Act or other legislation as relevant; Once a breach of client information is made aware to Youth Focus, a clinical incident form must be completed as stipulated within the Youth Focus Incident Management and Reporting Procedure. The duty of confidentiality does not cease when the professional relationship with the client has ended.

Eligible data breaches will be reported to the Office of the Australian Information Commissioner in line with the Youth Focus Incident Reporting and Management

Policy.

Wherever personal information is breached, Youth Focus will make every effort to contact any effected individuals and provide them with:

an explanation of what happened
an opportunity to discuss any potential consequences
an explanation of the steps being taken to manage the situation
an opportunity to discuss their experience
an apology

Complaints procedure

All people who have provided us with personal and sensitive information have a right to make a complaint and have it investigated and dealt with under the Youth Focus Compliments, Complaints and Feedback Policy.

Any complaint can be submitted verbally, sent in writing to 54 Goodwood Parade, Burswood WA 6100 or by email to feedback@youthfocus.com.au.

Retention of client information

There is currently no legislation in Western Australia mandating the retention or destruction of health information, however, Youth Focus aligns with legislation held in Victoria, New South Wales and the Australian Capital Territory which requires:

health information collected from adults to be retained for a minimum of seven years after their last health service, and;
health information collected from children (under 18 years of age) to be at minimum retained until they reach 25 years of age, or for seven years after their last health service, whichever is later.

We also manage retention related to health records which include any of the following content:

Risk of suicide: retained for a further 7 years beyond the standard retention period.
Legal proceedings: retained for a further 7 years beyond the standard retention period.
Complaints against the organisation: retained for a further 7 years beyond the standard retention period.
Critical incidents: retained for a further 7 years beyond the standard retention period
Family Violence: Retain records until the latter of, o 50 years after last entry in the record, or o 50 years after client reaches 18 years of age,
Disclosed Child Sexual Abuse: Retain records until the latter of, o 50 years after last entry in the record, or o 50 years after client reaches 18 years of age,
Applies to a young person in the care of the Department of

Communities: Retain records until the latter of, o 50 years after last entry in the record, or o 50 years after client reaches 18 years of age.

Applies to an Aboriginal and/or Torres Strait Islander young person: retained indefinitely.

Youth Focus will maintain a register of client health records when they are transferred or destroyed. Any manner of disposal must preserve the young person’s confidentiality.