Privacy Policy
Legislative and Regulatory Framework
GRP Speech Pathology is committed to managing information in accordance with all applicable Commonwealth and Victorian legislative obligations, including but not limited to:
- Privacy Act 1988 (Cth)
- Australian Privacy Principles (APPs)
- Notifiable Data Breaches Scheme (Cth)
- Health Records Act 2001 (Vic)
- Health Privacy Principles (HPPs)
- Fair Work Act 2009 (Cth)
- Occupational Health and Safety Act 2004 (Vic)
- Applicable allied health professional standards, ethical obligations, and clinical governance requirements
Policy Statement
GRP recognises that employees and contractors may access highly sensitive information relating to clients, families, employees, operational matters and business activities during the course of their work. All confidential information must be handled respectfully, securely, and only for legitimate and authorised work-related purposes.
Confidential information includes any information that is not publicly available and may include personal details, health information, clinical records, assessment reports, behavioural information, employment records, financial information, operational documents, business strategies, and internal communications.
All personnel engaged by GRP are expected to maintain strict confidentiality and exercise professional discretion at all times. Confidential information must not be accessed, discussed, copied, disclosed or used outside the scope of an individual’s role or authorised responsibilities. Confidentiality obligations continue following the conclusion of employment or engagement with GRP.
Collection of Information
GRP collects personal and health information that is reasonably necessary to support the provision of allied health services, operational requirements, employment obligations, safety processes, funding arrangements, legal compliance, and quality improvement activities.
Information may be collected directly from clients, parents or guardians, employees, contractors, referral sources, schools, funding bodies, medical practitioners, authorised representatives, or other relevant stakeholders.
The information collected may include:
- Personal and contact details
- Health and medical information
- Therapy and assessment records
- Funding and billing information
- Employment documentation
- Incident and risk management information
- Behavioural or support information
- Communication records relevant to service delivery
GRP will take reasonable steps to ensure individuals understand:
- why information is being collected
- how the information will be used
- who the information may be disclosed to
- and how the information will be stored and protected.
GRP will seek informed consent prior to the collection, use, or disclosure of health information unless otherwise authorised or required by law.
Use and Disclosure of Information
Information held by GRP will only be used or disclosed for purposes directly connected to the reason the information was collected, including:
- clinical assessment and therapy services
- communication with authorised stakeholders
- operational administration
- supervision and professional support
- funding and invoicing requirements
- employment obligations
- safety and incident management
- legal and regulatory compliance
- and quality improvement activities.
Information may be disclosed to treating practitioners, schools, support coordinators, funding bodies, medical practitioners, regulatory authorities, or other relevant service providers where:
- informed consent has been obtained
- disclosure is reasonably necessary for service delivery
- or disclosure is authorised or required by law.
GRP will take reasonable steps to ensure only the minimum necessary information is disclosed. Particular care will be taken when managing information relating to children, separated family arrangements, guardianship matters, NDIS participants, school-based services, and multidisciplinary care environments.