When reporting incidents online under the Serious Incident Response Scheme (SIRS), aged care providers must confirm that they have met the Collection Notice requirements under the federal Privacy Act. What is a Collection Notice and what are the associated requirements? Here’s what you need to know.
As mentioned in a previous Aged Care Essentials article, the SIRS is a national framework for incident management and reporting of serious incidents in residential aged care. From 1 April 2021, the SIRS required aged care providers to report Priority 1 incidents. From 1 October 2021, providers must also report certain less serious “Priority 2” incidents.
To meet your obligations under the SIRS, you will have to investigate incidents. This may involve collecting information from the people involved in, or affected by, the incident. Some of that information may be “personal information” or “sensitive information”. Personal and sensitive information is protected by privacy laws, and so, when you collect and use this information, you must meet certain requirements.
In the context of the SIRS, the SIRS Guidelines set out the key privacy requirement as follows:
“As part of your online notification of a SIRS reportable incident, you are required to confirm that you have provided a notice of collection (where appropriate) to any person affected by the incident for whom you have recorded personal or sensitive information.”
In other words, if you collect personal or sensitive information from a person as part of your SIRS investigation, you must take reasonable steps to provide the person with a collection notice.
The Privacy Act defines “personal information” as “information or an opinion about an identified individual, or an individual who is readily identifiable”. This is a very broad definition and includes just about any kind of written, spoken, photographed or other information about a particular person.
For example, in your facility you have a resident named Nancy Smith. The following things would qualify as “personal information” about Nancy:
The following things would NOT qualify as “personal information” about Nancy:
“Sensitive information” has a narrower definition than “personal information”. Sensitive information is a type of personal information that includes information about a particular person’s health, ethnicity, political opinion, sexual orientation or criminal record. The Privacy Act, and some state and territory legislation, usually require that this type of information be treated more carefully, in particular by letting people know exactly how this information will be used and to whom it will be disclosed.
When you collect personal or sensitive information from a person you have to tell them what information you are collecting and why. This is known as a “collection notice”.
By now you may be wondering, “Do I have to issue a collection notice every time I record someone’s name or take a photo of them?” The answer to that is: not quite.
When it comes to collecting personal information, you are only required to take reasonable steps to issue a collection notice. In some circumstances, this means you can issue a general notice to all of your residents in advance of collecting any information.
According to the Office of the Australian Information Commissioner, a notice may be issued “through a variety of formats, provided the matters are expressed clearly.” For example, you may be able to issue your notice of collection via signs, emails, pamphlets or through the conversations that staff have with residents. But bear in mind that you may need to be able to prove that you have issued a collection notice, so a written notice may be preferable.
Finally, note that when it comes to collecting most personal information which is required by law, such as SIRS information, you do not have to get a person’s consent. You must tell them that you are collecting their personal information, why you are collecting it and who (in broad terms) will have access to it, but you do not have to get their permission.
This can be different, however, when collecting information where it is not required by law and so the person has a choice as to whether to agree to it being collected. For example, taking someone’s image to put on your website would require their consent, while taking a photo of their injury for the purposes of writing a legally-required incident report usually would not. For sensitive information, the privacy requirements are more onerous, and you may have to get a person’s consent before you can use their information where there is no law requiring it to be collected or disclosed.
According to the Office of the Australian Information Commissioner, a collection notice will need to include important information such as:
With the new requirement to report Priority 2 incidents commencing 1 October 2021, it is important to ensure that you have issued a collection notice to your residents. The notice should clearly explain what information you are collecting and why. The notice can be issued in advance of collection to all your residents however keep in mind that you may need to be able to prove that you have issued a collection notice, so a written notice is preferable.
Also note that collection notice requirements apply to many other areas outside of the SIRS context. For example: COVID-19 related data and investigation, complaints reporting and investigation.