Organisation: Mood in Mind and Total Wellness Therapies
Effective Date: 28.02.26
Review Date: 28.02.26
Policy Owner: Tanya Genito
1. Purpose
Total Wellness Therapies and Mood in Mind is committed to protecting the privacy, confidentiality, and security of personal and health information entrusted to the practice.
This policy outlines how personal information is collected, stored, used, disclosed, and protected in accordance with:
- Duty of care for sensitive health information
- Privacy Act 1988 (Cth) and Australian Privacy Principles
- Notifiable Data Breaches Scheme
- Professional obligations under social work ethical standards
2. Scope
This policy applies to:
- All practice devices and cloud environments
- All client records and health information
- All staff, contractors, and service providers
- All electronic and physical information systems
3. Definitions
Personal Information: Information that identifies or could reasonably identify an individual.
Sensitive Information: Health information, mental health records, and clinical documentation.
Data Breach: Unauthorised access, disclosure, loss, or misuse of personal information.
4. Principles of Information Handling
Total Wellness Therapies and Mood in Mind manages personal information according to the following principles:
4.1 Lawful and Necessary Collection
- Information is collected only where necessary for providing therapeutic services
- Clients are informed about collection purposes and privacy practices
- Consent is obtained where required
4.2 Use and Disclosure
Information is used only for:
- Provision of clinical services
- Professional consultation where permitted
- Legal or regulatory obligations
- Client-authorised purposes
Information is not disclosed without consent unless required or authorised by law.
4.3 Data Minimisation
- Only information necessary for care delivery is collected and retained
- Access to information is limited to authorised use
5. Information Security Controls
Mood in Mind implements administrative, technical, and physical safeguards to protect personal information.
5.1 Access Control
- Multi-factor authentication for systems containing client data
- Restricted access to only Tanya Genito
- Managed user accounts with secure authentication
5.2 Data Protection
- Encryption of stored and transmitted data
- Secure cloud storage environment
- Separation of recovery credentials from operational accounts
- Controlled remote access arrangements (eg Harvey Norman Tech support)
5.3 Monitoring and Threat Protection
- 24/7 monitoring of email and cloud systems
- Advanced threat protection and web filtering
- Suspicious activity detection and response processes
5.4 Backup and Recovery
- Automated secure backups
- Tested data recovery procedures
- Protection against data loss and system compromise
5.5 Device and System Security
- Geographic access restrictions where appropriate
- Security scanning and configuration hardening
- Managed security environment by Harvey Norman Tech
6. Data Storage and Retention
- Secure destruction methods are used for obsolete records
- Client records are stored in secure practice systems
- Sensitive information is not stored in unsecured environments
- Records are retained and disposed of in accordance with legal requirements
7. Data Breach Response
Total Wellness Therapies and Mood in Mind maintains a structured incident response process.
7.1 Immediate Actions
- Contain the breach
- Secure systems
- Assess risk to individuals
7.2 Assessment
Breaches are assessed to determine whether serious harm is likely.
7.3 Notification
Where required, Total Wellness Therapies and Mood in Mind will:
- Notify affected individuals
- Notify the OAIC
- Notify relevant healthcare providers or agencies where appropriate
7.4 Documentation
All breaches and responses are recorded and reviewed for improvement.
To request the detailed Data Response Policy, please reach out to Total Wellness Therapies and Mood in Mind directly.
8. Client Rights
Clients have the right to:
- Access their personal information
- Request corrections
- Make privacy complaints
- Be informed of data breaches affecting them
Requests may be made in writing to the practice.
9. Professional and Ethical Responsibilities
Total Wellness Therapies and Mood in Mind recognises that protection of client information is a core ethical obligation. The practice commits to:
- Maintaining confidentiality and trust
- Acting in the best interests of clients
- Implementing reasonable safeguards for sensitive information
- Responding transparently to privacy incidents
- Continuously improving information security practices
10. Third-Party Service Providers
Service providers handling personal information must:
- Meet Australian privacy obligations
- Maintain appropriate security controls
- Use information only for authorised purposes
- Protect confidentiality of health information
11. Training and Awareness
The practice ensures:
- Regular training through Harvey Norman Tech and AASW
- Ongoing awareness of privacy obligations
- Regular review of security practices
- Continuous improvement of data protection measures
12. Complaints and Contact
Privacy enquiries or complaints may be directed to:
Practice Contact:
Tanya Genito
Mood in Mind and Total Wellness Therapies
tanyagenito@totalwellnesstherapies.com.au
If concerns are not resolved, individuals may contact the Office of the Australian Information Commissioner.
13. Policy Review
This policy is reviewed:
- Annually
- After any data breach
- Following significant system or regulatory changes