by Nick Manning
Client confidentiality has long been an ethical principle in youth work and welfare work. Confidentiality is often a condition of funding contracts, employment contracts and agreements between agencies and clients.
In recent years confidentiality has become a legal requirement too. Most NSW non-government welfare and youth agencies are required to comply with the federal Privacy Act 1988, the NSW Privacy & Personal Information Protection Act 1998, or both.
Personal information: The laws protect personal information: information about an individual who is identified, or whose identity could be reasonably worked out, from the information. Personal information does not include de-identified information or statistical data which does not allow individuals to be identified.
Accuracy of personal information
You must take reasonable steps to ensure the personal information your agency collects, uses and discloses is relevant, accurate, complete, up-to-date and not misleading.
Privacy statement
Your team must have a privacy statement setting out how you manage personal information. Make it available to anyone who asks for it. Include in it:
- generally, what sort of personal information you hold
- what purposes you hold it for
- how you collect, use and disclose that information
- who can access that information, and how.
Include the team's privacy statement (or how to get a copy) in documents you show, display or give to clients, families or others about the agency. (More information and a sample privacy statement in Model Policies*).
Collecting personal information
Anonymous and "first names only" activities: If you do not need to be able to identify or contact a person, give them the option of dealing with the agency anonymously, or by using just their given name (first name) or nickname.
Every time you collect personal information, make sure that:
- you actually need the information to provide the service the person wants
- the person knows why you are collecting the information
- the person knows whether it is compulsory or voluntary to give you the information, and what will happen if they don't
- the person understands the contents of your privacy statement including their right to access and correct the information
- you record the information accurately and completely
- you collect the information from the person concerned, or from someone else only if the person concerned has consented to this.
Client's access to, and alteration of, personal information
If a person asks, you usually must:
- give them access to the personal information the agency holds about them
- correct, delete or add to the information to keep it relevant, accurate, complete, up-to-date and not misleading.
More information: Young people's rights to their personal information in Model Policies*.
Team confidentiality
If you have more than 1 team at the agency, each team's privacy statement should list which positions, or types of positions, are on that team.
Staff can share personal information with other staff on their team. Staff can only disclose personal information to staff from other teams within the agency in the situations listed under Disclosing personal information & the Privacy Consent Form (below).
Avoid accidental disclosure
Take all reasonable steps to ensure that personal information is not accidentally or intentionally disclosed to other clients, staff on other teams, management or anyone else. Some recommended strategies:
- ensure that phone and face-to-face conversations are not overheard
- keep files and other personal information in a locked filing cabinet when not in use
- limit access to filing cabinets to those staff with a genuine need
- put files inside plain manila folders which do not identify clients, before you take them out of the building
- never leave files unattended in a car
- keep computer files (including emails) protected with passwords or stored on removable storage (eg. disks) which are locked away
- never leave computer records on a laptop computer without taking extra precautions against theft and misuse
- email is an insecure way to communicate and store personal information - avoid sending or receiving personal information via email whenever possible
- take care when sending or receiving personal information by fax
- limits on contact: whenever you record a person's contact details, ask them about any necessary limitations on contacting them in order to protect their privacy.
Destroying records: Records which the agency no longer needs to keep must be destroyed in a secure way. See How long should you keep your client files and other client records? in Model Policies*.
When can you disclose confidential information?
Disclosing personal information means disclosing the information outside your team. Generally you should only disclose personal information in the situations below. Your privacy statement should list these situations (an example: Model Policies*).
1. Consent
You can disclose personal information with the person's (legally valid) consent (more information: Model Policies*).
2. Missing person
If a person who uses your agency is reported to the police as a missing person, it is good practice to tell the police that they are OK, but do not tell the police or the person's family where the person is without consent.
3. Child protection
You can report a child at risk under the Children and Young Persons (Care and Protection) Act.
4. Unsuitability to possess guns
You may tell the police if you believe that a person is unsuitable to be in possession of a firearm (a gun):
- because of the person's mental condition, or
- because you think that the person might attempt to commit suicide, or
- because you think that the person would be a threat to public safety.
You do not need to know whether the person already has a gun or not. The purpose of informing the police is so that the police can decide whether to issue or revoke a gun licence. (Section 79, NSW Firearms Act 1996 ).
5. Crimes at your agency
If a crime occurs on agency premises or during activities and services, you (or the victim of the crime) can choose whether to report it to police.
6. Intended crimes
There is no legislation requiring you to disclose information about an intended crime. However, if the planned crime poses a serious and imminent threat to someone's life or health, then possibly you owe a duty of care to warn the person, or the police. See Serious and imminent threat to the life or health (below).
7. Serious and imminent threat to life or health
You can disclose personal information to prevent or reduce a serious and imminent threat to the life or health of any person (the client or someone else). This means:
- there is an immediate serious risk to a particular person or particular people, and
- disclosure to a particular person or agency is likely to reduce that risk.
A 'serious' threat must reflect significant danger, and could include a potentially life threatening situation or one that might reasonably result in other serious injury or illness. A threat could also relate to an emergency, following an accident, when an individual's life or health would be in danger without timely decision and action.
A threat is 'imminent' if it is about to occur, or may result in harm within a few days or weeks.
As a guide, these situations might justify a disclosure:
- serious and imminent suicidal intent
- a drug overdose
- a serious threat to kill or seriously injure someone.
However, you should judge each situation individually. You can only disclose information to a person where disclosure is likely to reduce the risk - you must maintain normal privacy with all other people.
8. Concealing a serious offence (crimes in the past)
It is an offence to fail, without a reasonable excuse, to give information to the police which would help them to arrest, prosecute or convict someone guilty of a serious crime (Section 316 NSW Crimes Act 1900).
However this law is not used against youth workers and other welfare workers in NSW. In most situations youth workers have a "reasonable excuse" for not reporting: the need to protect client confidentiality so that you can continue working with the person to achieve positive outcomes.
In exceptional circumstances, such as the worst crimes and where there is a likelihood of further serious offending, the safety of the community would outweigh the importance of continuing to work with that client. In such situations you should consider disclosing to police.
Some issues to consider in deciding whether to disclose crime to police include:
- did the crime occur on agency premises or during an agency program, or was the agency or any of its staff, volunteers or clients a victim of the crime?
- is the offender a client
- the nature and seriousness of the crime (eg. did it involve serious violence?)
- is the crime related to the work you are doing with the client (eg. if you work mainly with offenders, you probably cannot report all their serious crimes)
- the likelihood of the crime being repeated
- the value of the work you are doing with the client and the likely effect on that work if you disclose
- the likely effect on your work with other people if you disclose (eg. will they find out? will they lose trust in you?).
You should judge each situation separately and carefully.
9. Subpoenas
A subpoena is a document requiring you to go to court to be a witness and/or to produce certain documents to the court. If you receive a subpoena:
- tell your management immediately
- attempt to contact any person whose privacy might be breached by the subpoena, to find out if they consent to disclosure or not
- seek legal advice (eg. from a community legal centre or a private solicitor) about how to negotiate about the subpoena to protect privacy.
For more information see Confidentiality and Privacy for Youth Workers.*
10. Other police situations
Except in the situations outlined elsewhere in this fact sheet, you generally should not answer police questions if it would breach client confidentiality. Failing to provide information to the police does not amount to the offence of hindering police. More information about police questions and police searches:
- the policy Crime and Police in Model Policies*
- Confidentiality and Privacy for Youth Workers.*
11. Other laws requiring disclosure?
There may be other laws (eg. about Centrelink, immigration or terrorism) which require disclosure by certain agencies in specific situations. Get advice from a lawyer if necessary (eg. a community legal centre).
*More information
- Model policies on working with young people, for non-residential youth services in NSW, (2004) by Nick Manning. YAPA. Has sample Privacy Statement and a Privacy Consent Form www.yapa.org.au/youthwork/modelpolicies
- Federal Privacy Commissioner www.privacy.gov.au or 1300 363 992
- NSW Privacy Commissioner www.lawlink.nsw.gov.au/privacynsw
- Confidentiality and Privacy for Youth Workers (2003) Shopfront Youth Legal Centre www.theshopfront.org (click "Inform and train youth workers about legal issues")
Published: 2005. Opinions are the author's and not necessarily YAPA's.
Applicable to NSW youth services (non-government agencies & local councils) providing accommodation, welfare, social or recreation services to young people. May not be consistent with laws and guidelines in, schools, out-of-home care or health services. "young people" - aged roughly 12-25 years old (unless stated otherwise).
Be careful! YAPA and the author took reasonable care to ensure that this information is correct. However government regulations, laws and standards are complex and changing constantly. The author/s have no health, occupational health and safety, or legal qualifications (unless stated), and information provided is general - it is not specific legal or professional advice. Do not rely on it - check with other publications and authorities and if necessary get qualified legal or professional advice for your situation.
Copyright 2005 Nick Manning. You can: a) quote small amounts of text if you acknowledge the author, publisher, web address & date; b) print out multiple copies of this web page but only if you print the whole web page. No other use permitted without prior consent. Do not put large amounts or all of the text in any other document, including: a policy & procedure manual; a presentation (eg. Powerpoint); a training/learning resource book (eg. for TAFE); a web page. Copyright and training enquiries: nmanning@pnc.com.au
