How we protect your information
How we protect your information
Care records hold children’s histories, relationships, health information and circumstances. Protecting their privacy, preserving accurate information and keeping it available when needed are central responsibilities in the design of MyCarerHub.
This page explains the production security design. Implementation and verification remain in progress. The initial trial uses fictional examples only.
What this means for youThe responsibility behind the design
A responsibility to record. A responsibility to protect.
Good recordkeeping and careful protection belong together.
Queensland Child Safety’s published guidance requires carers to keep accurate records about children in their care, including evidence of important decisions and actions. It also requires child protection information to be kept secure, with access limited to people who have a legitimate need to know.
MyCarerHub is being developed to support both responsibilities: organising relevant information and applying safeguards to how it is stored, accessed and shared.
Queensland example: Read Child Safety’s recordkeeping and security guidance. Requirements in other states and territories need separate consideration.
Protection through several safeguards
Security across the way records are used.
The production design combines access controls, encryption, careful sharing and recovery. Each needs implementation and testing in the supported product.
Individual access
Help the right person access the records relevant to their role.
Encrypted storage
Protect stored records, documents and backup copies.
Deliberate sharing
Review the information, purpose and intended recipient.
Recoverable records
Plan for loss or failure and verify that restoration works.
Security depends on these safeguards working together with maintained devices and careful everyday handling. Local storage alone does not establish that information is secure.
Where information lives
Know where each copy goes.
An information map should account for the main records, backup copies and anything that leaves the care workspace.
Your computer or household server
The intended product keeps care records locally, with an encrypted database and encrypted documents. The supported installation and device arrangements need to be verified before use with real information.
When you create a backup or prepare information to share
A separate backup copy
Encrypted backups may be kept on a selected drive, server or cloud service. The chosen location, access permissions and recovery process need to be part of the setup.
A reviewed report or handover
An export creates another copy. Review its contents and recipient, then use an appropriate delivery method. The protection of that copy also depends on where it is sent and stored.
Website, account and support information have a separate purpose.
Website enquiries and information needed for accounts, subscriptions or support must be described separately from care records. Company procedures must explain what is collected, who receives it and how it is protected. Do not upload children’s records through this website.
Who can access it
Access should follow the person and their role.
The aim is to limit access to authorised people and give carers a clear way to protect their workspace between uses.
A separate carer identity
Each carer is intended to have their own identity and access permissions. Shared logins are not part of the production design.
A workspace that locks
Automatic locking and device controls are planned to reduce the risk of records being left available on an unattended device.
Access that can be managed
Authentication, account recovery and removal of access must work together, including when a device is lost or a person’s access changes.
What needs to be verified?
Testing needs to cover sign-in, the lock and unlock process, permissions, recovery and lost-device handling. Planned security notices also need delivery checks. A separate identity is useful only if the application consistently enforces the access attached to it.
Keeping records protected
Protection for records, documents and backups.
The same care needs to extend to every form of the information, including copies made for recovery or sharing.
Encryption makes stored information unreadable without the required key.
The design calls for encryption of the database, attached documents and household backups. Key protection and recovery are part of that design, because authorised carers still need a reliable way to open their records.
Protect the stored copies
Verification must cover records, attachments, backup files and any temporary copies created by the application. A protection claim needs to match what the software actually stores.
Protect information in transit
Supported connections between devices and services need appropriate transport protection. Once a report is exported, the selected delivery channel needs its own safeguards.
What encryption does—and what still needs care
Encryption of stored files does not protect information that someone can already view in an unlocked workspace. It also does not prevent an authorised person from sending a report to the wrong recipient. Device security, access controls and review before sharing remain necessary parts of the approach.
Sharing with care
A clear decision before information leaves.
The proposed workflow supports careful selection and review. It does not treat every record as suitable for every recipient.
Select the scope
Choose the child, purpose and relevant records.
Review the content
Check accuracy and remove information that is not needed.
Confirm the recipient
Check who should receive it and their authority.
Use an appropriate channel
Choose the delivery method and consider the resulting copy.
Restricted household records require a separate decision.
Carer administration and advocacy records are intended to remain outside routine care reports and handovers. Any deliberate inclusion needs an authorised review. Restricted access does not remove an applicable lawful disclosure obligation.
Recovery and ongoing security
Protection continues after setup.
Avoiding loss, maintaining safeguards and responding to problems are part of the same responsibility as protecting access.
Recovery that is tested
Encrypted backups need a supported restore process. Testing must show that records and documents can be recovered after device failure or loss.
Maintenance over time
Security depends on maintained software and devices. The release process needs a clear approach to updates, reported weaknesses and changes that affect protection.
A response when something goes wrong
Incident procedures need to cover reporting, containment, investigation and recovery, with assessment of any applicable notification obligations.
The company’s role and the carer’s role
Care Resource Management Pty Ltd: develop and verify the supported safeguards, provide understandable setup and recovery guidance, maintain the product and establish a clear security-reporting process.
Carers: follow the supported setup, protect sign-in and recovery information, maintain their devices, check backups, review recipients and report suspected problems promptly. Product instructions must make these responsibilities practical.
Responsible handling throughout care
A clear purpose from recording to return.
Privacy includes what is collected, how it is kept accurate, who may use it and what happens when the reason for keeping it changes.
Record what is relevant
Keep information needed for care and a clear account of decisions.
Keep the record useful
Maintain accuracy and preserve the history of changes.
Return or hand over appropriately
Follow the authority and requirements for the care situation.
Resolve remaining copies
Apply the relevant retention and secure-disposal requirements.
Queensland guidance requires children’s hard-copy and electronic records to be returned to Child Safety when care ends. A temporary stay and the ending of care are different situations. Any continued access or retention needs an appropriate basis; the website does not set one national period or promise indefinite retention.
The product’s return, retention and deletion procedures—including treatment of backup copies—need to be resolved for the circumstances before real care records are entrusted to it.
Queensland carer guidance · OAIC guidance on technical and organisational safeguards. These sources inform the approach; they do not establish approval of MyCarerHub.
Taking part in the trial
What this means for you
What to know before you start testing.
We’re still developing and checking MyCarerHub
Protecting care information is a priority. Security checks are still in progress, so the trial is not an invitation to start storing real children’s care records.
Use made-up information when testing
Try the features using fictional children, people and situations. Do not enter real names, case notes or other identifying details, or upload real documents and photographs.
Check what you can try
Before you begin, read the trial guide to see which features you can test and any limits you need to know about. Some features may still be under development.
We are not claiming that MyCarerHub has independent security certification or approval from a child safety organisation.
Information for organisations
Does your organisation need to review MyCarerHub before it can be used?
Contact admin@managingcare.com.au to discuss your requirements, the security information currently available and the checks still to be completed.
Security questions deserve clear answers.
Contact Care Resource Management Pty Ltd to discuss the security approach, assessment requirements or a privacy question. Please keep enquiries about the product and do not include identifying care information.