What gets in the way
- Workers in the field, often on their own phones. Shift notes, rosters and messages to coordinators happen on a phone between visits. When that phone is a personal one, participant information ends up on a device the business doesn’t control.
- Some of the most sensitive records there are. Health details, support plans, incident reports and family contacts. If that information leaks, the participant is hurt first, and the business has questions to answer after.
- People come and go. Casual and part-time workers start and finish often. Their access to the client management system and shared mailboxes has to end the day they leave, not when someone remembers.
- Audits want evidence, not intentions. An audit asks who can see each participant’s information, where records are kept and what happens when the system is down. The answers need to come from how things are set up.
How we help
- Microsoft 365 & Identity: Multi-factor sign-in on every account, casual workers included, and sign-in rules that stop the client management system and shared mailboxes opening from places your team never works.
- Managed Security Tiers: Endpoint protection on every office device, and on the Fortress tier, device and app management on the phones workers use, so work data can be wiped from a lost phone without touching personal photos.
- Backup & Recovery: Backups of Microsoft 365 and your records with scheduled test restores, so a deleted note or a ransomware attack doesn’t take participant history with it.
- Security Awareness: Short training aimed at the scams support workers actually see: fake rosters, urgent payment requests and messages pretending to come from a coordinator.
- Bastion Managed Services: An Australian service desk for the office and the field, with starters and leavers handled the day you tell us.
Obligations worth knowing
- The NDIS Practice Standards expect each participant’s information to be identifiable, accurately recorded, current and confidential, and easily accessible to the participant. Source
- The same Core Module asks for emergency and disaster planning that keeps supports critical to participants’ health, safety and wellbeing going during an emergency. Source
- Most businesses with a turnover of $3 million or less aren’t covered by the Privacy Act, but some are whatever their size, including health service providers. The OAIC has a checklist. Source
- Organisations covered by the Privacy Act must notify affected people and the OAIC when a data breach is likely to result in serious harm. Source
Shift notes belong in the system, not in text messages
The quickest way for participant information to escape is a photo of a support plan sent by text, or a shift note typed into a personal messaging app because the proper app was slow. Make the right way the easy way: the client management system and Microsoft 365 apps on every worker’s phone, signed in with multi-factor through Microsoft 365 and identity, and a clear rule that participant details don’t go into personal chats or camera rolls.
Plan for the day the system is down
If the client management system or the internet drops out, workers still need to know where they’re going and what each person needs. Keep a current offline copy of the critical details, know who rings whom, and test that you can restore records through backup and recovery. It’s the IT side of the emergency and disaster planning the Practice Standards already ask for.
Leavers are a security job
With a casual workforce, an account that isn’t closed is the most common open door. One checklist for every departure, covering the client management system, email, shared mailboxes and any work data on the phone, does more than any policy document. We run it as part of managed services.