Privacy Policy

What is the purpose of this document?

The purpose of this form is to provide information to you about services, including telehealth, and to ask for your informed consent to participate in consultations as part of providing Occupational Therapy services to you.

Please note that "participant" is used throughout this policy, and refers to clients of CCAHS.

Outcome

• Compliance with legislative requirements governing privacy of personal information.
• All Community Connected Allied Health Services’ participants are satisfied that their personal information is kept private and only used for the intended purpose.

Background

The Privacy Act 1988 (Privacy Act) is an Australian law which regulates the handling of personal information about individuals by private sector organisations. CCAHS is subject to the Privacy Act 1988 and must comply with obligations related to the collection, use and disclosure of personal information, including through telehealth.

Amendments were made to this legislation in 2012 (the Privacy Amendment Act 2012) which updates the Australian Privacy Principles (APP) and came into effect in March 2014. The amendment requires an organisation to explicitly state how they will adhere to the APP and inform their participants on how their privacy will be protected. The APP cover the collection, use, storage and disclosure of personal information, and access to and correction of that information. The APP are summarised in Appendix 1 of this document.

What information may be processed by AI (if you consent)

• Audio/visual from sessions (telehealth or in-person) where recording is explicitly agreed to at the time.
• Clinical notes/content you provide to CCAHS.
• De-identified or minimised excerpts needed for drafting a report/letter.

What is not done

• AI outputs are not used to make automated clinical decisions; a human clinician remains responsible.
• We do not sell personal information or permit use for targeted advertising.
• We do not allow AI providers to train public models on your identifiable information.

Security & access

• AI providers act as processors under contract; they must implement security controls and maintain confidentiality.
• Access is limited to authorised CCAHS staff on a need-to-know basis.
• Recordings (if used) are encrypted in transit and at rest by our chosen provider(s).

Storage location & cross-border disclosure (APP 8)

Some artificial intelligence (AI) tools we use may store or process data outside of Australia. Where cross-border disclosure occurs, CCAHS takes reasonable steps to ensure any overseas provider manages your information in line with the Australian Privacy Principles (APPs).

If you do not wish your information to be processed overseas, please let your therapist know — services will continue without penalty.

Current platforms used

Healthcare-specific platforms (may process client data under contract):

• Everbility — data is processed and stored in Australia.
• Heidi — data is stored in Australia, but some processing may occur overseas for performance purposes.
• Zanda — practice management platform with integrated AI; data is hosted in Sydney, ISO 27001 certified.

General AI platforms (de-identified information only):

• Claude (Anthropic) and ChatGPT (OpenAI) — used to support report writing and clinical documentation only. No personally identifiable information is shared with these platforms. See AI Tools Consent and Information Form for full details.

Retention & deletion

• Source recordings used for AI (if any) are retained only as long as needed to create accurate notes/reports, then securely deleted or de-identified per our retention schedule.
• Final clinical records are kept in your CCAHS file under our standard retention periods.

Withdrawing consent

You may withdraw AI consent at any time — verbally or in writing. We will cease AI processing from that point onward (this will not affect the lawfulness of prior processing with consent).

1. Staff training and responsibilities

• The Director of Community Connected Allied Health Services (CCAHS) will review this Privacy Policy annually and ensure all staff understand their responsibility to protect participant privacy.
• All staff receive privacy and confidentiality training at induction and again on an annual basis.

2. Information storage and retention

• Participant information is kept in an individual participant record with a unique identification number.
• Records may include: personal information, clinical notes, assessment data, correspondence from other providers, photographs, and/or video footage.
• Security measures include: firewalls, password-protected and multi-factor authenticated systems, automatic inactive logouts, and locked fireproof cabinets for paper records.
• Records are stored for at least seven years following the last service. For participants under 18, records are kept until their 25th birthday (and for at least seven years after discharge, whichever is longer).
• At the end of the retention period, records are securely destroyed (e.g. shredding, permanent deletion from databases).

3. Participant privacy and consent

CCAHS refers to the Service Agreement for detailed privacy obligations and consents.

The Service Agreement includes four core consents:

• Consent for sharing and obtaining information.
• Consent for receiving services.
• Consent for photography.
• Consent to participate in satisfaction surveys.

These consents are discussed with the participant and/or their decision maker in a way they can understand prior to service commencement.

4. New enquiries

• Individuals making an initial enquiry are not required to provide personal details.
• Once a decision is made to engage services, CCAHS will collect the personal and sensitive information necessary to provide supports.

5. Information sharing

Personal information is not disclosed to third parties outside CCAHS, except:

• for a purpose made known to and agreed by the participant; or
• when required by law (e.g. imminent risk of harm).

Where relevant, CCAHS may share information with other allied health professionals, support team members, contractors, or suppliers to ensure coordinated care. Information is only shared when necessary, and only with professionals who are bound by privacy and confidentiality obligations. Permission to share information is always sought from the participant before disclosure, unless urgent legal or safety obligations apply.

6. Use of AI service providers

CCAHS may use secure, contracted service providers to assist with administrative tasks such as transcription, note generation, or report drafting. These providers are bound by written agreements to:

• use information only for CCAHS’ stated purposes;
• maintain strict security and confidentiality;
• delete or return personal information at the end of service delivery.

Storage and cross-border disclosure (APP 8)

Some AI processors may store or process data outside Australia. CCAHS takes reasonable steps to ensure any overseas providers comply with the Australian Privacy Principles. If you prefer not to have your information processed overseas, please advise your therapist — services will continue without penalty.

Current platforms used

• Everbility – data is processed and stored in Australia.
• Heidi – data is stored in Australia, but some processing may occur overseas for performance purposes.

What is telehealth?

Telehealth is the use of telecommunication techniques for the purpose of providing Occupational Therapy services over a distance, rather than the therapist and client meeting at the same location. The occupational therapist will most often use video-conferencing to administer the session, but may also utilise other formats of communication such as telephone, or email.

What does a telehealth consultation involve?

• Your therapist will explore your needs and occupational therapy related goals with you and, where appropriate, will offer information and recommendations. Your therapist will provide you with details of how telehealth will be used in your individual circumstances.
• You will be responsible for any costs associated with setting up the technology needed so that you can access telehealth services. You will need an appropriate device, i.e. smartphone, laptop, iPad, computer, with a camera, microphone and speakers; and a reliable internet connection.
• Community Connected Allied Health Services will be responsible for the cost of calls to you and the cost associated with the platform used to conduct telehealth services.
• Your occupational therapist will ask that you access a quiet, private, space to participate in the telehealth consultations.
• You may include a support person with you, as you might in a face-to-face consultation.
• You are not permitted to video or audio record the consultation, unless your occupational therapist gives you permission to do so.

What are the potential benefits of telehealth?

• Telehealth may improve access to occupational therapy services.
• Telehealth may reduce your need for travel.
• Telehealth may decrease exposure to infectious disease.

What are the potential risks of telehealth?

• Telehealth consultations may be impacted by technical problems which may affect the quality of the occupational therapy session.
• There may be some components of the occupational therapy service for which telehealth is not appropriate or effective and a follow up face-to-face consultation may be required.
• Telehealth may not feel the same as an onsite session.
• Telehealth may be very new to you and may take time to become familiar with. If you have any concerns, please discuss these with your therapist as soon as possible.
• Telehealth may include practices and procedures that are not as well understood in a telehealth setting as they are onsite.
• Telehealth may increase exposure to privacy and digital security risks (see next section).

Will my privacy be protected?

Your occupational therapist needs to collect and record personal information from you that is relevant to your situation, as a necessary part of the occupational therapy assessment and intervention that is conducted. The occupational therapist must maintain confidentiality and privacy standards during sessions, and in creating, keeping and transmitting records.

At times, audio and video recordings of sessions may be taken to support the occupational therapists work. The occupational therapist will inform you before a recording takes place and will provide you with the reason for doing so. You can refuse to be recorded for any reason.

A detailed description of how your personal information is managed, how you can access your personal information, and how to lodge any concerns or complaints about this service or how your personal information is managed must be provided to you by your occupational therapist on request.

While the occupational therapist is obligated to meet standards to protect your privacy and security, telecommunication, including video-conference, may increase exposure to hacking and other online risks; as with all online activities, there is no guarantee of complete privacy and security protection. You may decrease the risk by using a secure internet connection, meeting with the occupational therapist from a private location, and only communicating using secure channels.

Where you have consented to AI-assisted note-taking or transcription, telehealth audio/visual may be processed by a contracted AI provider. If you prefer not to have your information processed by AI tools or overseas service providers, please advise your therapist — your services will continue without penalty.

What does informed consent mean?

There are a few important principles related to informed consent:

• You must be given relevant information. Ask the occupational therapist if you have questions about the services offered including telehealth.
• You have the right to understand the information. Ask the occupational therapist for more information if you do not understand.
• You have the right to choose. If you do not agree to telehealth, you may refuse to participate. You may agree to or refuse specific activities within the session.
• You have the right to stop using telehealth anytime. You can change your mind about telehealth or a specific activity or procedure, even in the middle of a session.
• You can agree or refuse in writing or verbally. You may give your consent using the form below. You may also give consent or change your mind by telling the occupational therapist. Consent and refusal that you give verbally will be documented by the occupational therapist.
• You can ask about alternatives to telehealth. If you refuse or change your mind about telehealth services, your occupational therapist will discuss any other options with you. The occupational therapist may or may not be able to offer alternative services.