Aged care whistleblowing: navigating the new regime

Any individual can make a qualifying disclosure under the Aged Care Act, provided they have reasonable grounds to suspect information indicates a contravention of the Act by an entity (including a corporate entity, partnership, unincorporated association or individual).

This is a significant expansion of the class of potential eligible whistleblowers when compared with the Corporations Act regime. That regime limits protection to specific categories of ‘eligible whistleblower’. This broadly includes those who have or formerly had a working relationship with the regulated entity, and their relatives and dependants, and importantly, does not include customers or clients. 

The Aged Care Act also recognises a wide set of eligible recipients of qualifying disclosures. These can be made orally or in writing (including anonymously) to:

• the Commissioner or the Complaints Commissioner, or a member of the staff, of the Aged Care Quality and Safety Commission;
• the Secretary of the Department of Health, Disability and Ageing or an official of the Department;
• a registered provider;
• a “responsible person” of the registered provider. This includes, for example, any person responsible for executive decisions of the provider (including governing body members), or who has authority or responsibility for or significant influence over planning, directing or controlling its activities, and any registered nurse who is responsible for overall management of nursing services or day-to-day operations of an approved residential care home;
• an “aged care worker” of a registered provider;
• a police officer; or
• an independent aged care advocate.

Significantly, and in stark contrast to the Corporations Act’s more limited ‘eligible recipients’ concept, the definition of “aged care worker” is very broad. It essentially captures any person employed or engaged (including as a volunteer) to deliver funded aged care services, or engaged in conduct relating to such delivery, as well as employees, contractors and volunteers of associated providers.

For these individuals to be able to identify complaints as potential protected disclosures and safely acquit their responsibilities under the new regime, all of those people will need to understand the obligations and protections imposed by the regime. They will also need a sound understanding of the provider’s obligations under the Aged Care Act and Rules generally.

Similar to the Corporations Act regime, where an individual makes a qualifying disclosure under the Aged Care Act:

• (confidentiality) their identity and information likely to lead to their identification must be kept confidential, unless one of a broad range of exceptions applies. Examples of the exceptions include disclosures:
  • to the Commissioner, Complaints Commissioner, or the Inspector-General of Aged Care;
  • that are necessary to lessen or prevent a serious threat to the safety, health or wellbeing of one or more individuals;
  • to a lawyer to obtain advice or representation; and
  • whether the discloser consents to the disclosure of their identity.

A ‘reasonable investigation’ exception similar to that in the Corporations Act also applies as well as where the discloser elects to have the qualifying disclosure managed or dealt with as a complaint or feedback under the Act (see further below). A breach of confidentiality obligations is a civil penalty provision attracting up to 30 penalty units, currently $9,900.

• (victimisation) they must not be subjected to detriment or threatened detriment as a result of actual or suspected whistleblowing. This provision carries a civil penalty of 500 units (currently $165,000).

The Aged Care Act also includes a provision concerning anonymity of which there is no equivalent in the Corporations Act. It provides that if an individual makes a qualifying disclosure, and they request that they, or any other individual named in the request, remain anonymous, the recipient of the disclosure must “take such steps as are reasonable in the circumstances to preserve the anonymity of individuals named in the request”.

This creates a positive duty on recipients of disclosures to implement active identity protection measures, and extends anonymity protections beyond the whistleblower alone. Clearly, this will provide a way to protect the anonymity of vulnerable individuals receiving aged care services and their families who may be referenced in the disclosure.

Registered providers will need to consider how, practically, they can effectively discharge this duty. Perhaps more challenging, will be designing and implementing mechanisms for the effective discharge of this duty by the wide range of potential individual recipients of qualifying disclosures who are employed or engaged by the provider to deliver aged care services.

Unlike the Corporations Act whistleblower regime, registered providers of aged care services have a range of positive duties under the Aged Care Act’s regime. 

Responsibility for conduct of associated providers

Importantly, registered providers are responsible for the acts and omissions of “associated providers”, where the conduct is engaged in under an arrangement relating to the registered provider’s delivery of funded aged care services. The effect is that a registered provider may breach their registration conditions, and be liable for regulatory action, as a result of an act or omission of an associated provider. This will catch, for example, organisations who deliver services on behalf of a registered provider, such as landscapers who deliver gardening services to the home on the registered provider’s behalf, or plumbers engaged to do maintenance and repairs where this is the service the registered provider is funded to deliver. Available guidance suggests it wouldn’t catch organisations that deliver services to the registered provider (rather than on its behalf to the older people it cares for). Therefore, it wouldn’t include labour hire firms providing staff to the registered provider (though the staff themselves will be ‘aged care workers’), or firms providing accounting services to the registered provider. 

In relation to a disclosure

As noted above, registered providers must take reasonable steps to preserve the anonymity of individuals named in a request for qualifying disclosures that it receives. A registered provider must also ensure, as far as reasonably practicable, that:

• whistleblowers who are aged care workers or responsible persons of the provider are not victimised and that their identity and information likely to lead to their identification is protected; and
• the recipient of a qualifying disclosure made by an aged care worker or responsible person does not disclose the fact that the individual was the maker of the disclosure.

These are significant duties. Discharge of these duties will require positive steps to be taken by the registered provider to ensure its own compliance, as well as compliance by others, such as other aged care workers, responsible persons and associated providers. Registered providers will need to establish, implement and monitor the effectiveness of systems to comply with these duties.

In contrast, the Corporations Act does not impose positive duties of this nature (under that regime, whether an employer took reasonable precautions and exercised due diligence to avoid victimising conduct being occasioned on an employee are matters the court may have regard to when considering remedies).

Further obligations

The Aged Care Act and Rules also impose several conditions on a provider’s registration, including to “implement and maintain a whistleblower system, and maintain a whistleblower policy”. This carries with it detailed Rules and a list of criteria which are also unique to this regime, including significant, new positive obligations not currently contained in the Corporations Act whistleblower provisions. The criteria include:

• establishing a whistleblower policy which, among other things, describes the effect of the statutory regime, how disclosures may be made and investigated, how the provider will support a discloser and ensure fair treatment of any responsible person or aged care worker who is mentioned in a disclosure;
• communicating regularly, and at least monthly, to aged care workers and responsible persons that qualifying disclosures are welcome;
• providing training at least annually to aged care workers and responsible persons on how the system works, including how to recognise and respond to qualifying disclosures, how to manage relationships and communicate with disclosers, when and how to escalate disclosures, their roles and responsibilities and the penalties for contravening the confidentiality obligations; and
• as soon as practicable after a disclosure is made, to “take appropriate action” in relation to the disclosure, and support the discloser and any other individuals to whom detriment might be caused, or a threat of detriment might be made, because of the disclosure.

Election to have qualifying disclosure dealt with as a complaint or feedback

As well as the potential for more than one whistleblower framework to apply to a particular disclosure, there is more than one grievance process available within the new aged care framework itself.

The aged care regime also establishes a regime for managing complaints and feedback, and the Act makes it a condition of registration that a provider, among other things, implement and maintain a complaints feedback management system in accordance with the Rules. The Rules set out requirements for complaints and feedback management and resolution in some detail. As noted above, the Act and the Rules also allow an individual who makes a qualifying disclosure to elect to have their disclosure managed as a complaint or feedback, rather than as a whistleblower disclosure. This effectively creates an alternative, parallel mechanism for handling complaints other than utilising the whistleblower regime.

If an individual makes this election, the registered provider must manage the disclosure as a complaint or feedback in accordance with its complaints and feedback management system. This means the discloser will not be afforded the protections of the whistleblower regime. However, they are still required to be protected from reprisals and also have confidentiality protections.

For disclosures in this stream, registered providers must also practice “open disclosure” and prioritise restorative practices and manage complaints in an appropriate way. This includes practices being centred around those directly affected by the issue and resolving each issue by taking appropriate action. When an outcome is reached, the complainant (and anyone on whose behalf the complaint is made) must be notified of and provided reasons for the outcome, and told of the ability to notify the Complaints Commissioner of the complaint.