Best Practices for Documenting Consent and Preferences
This episode breaks down why old signed forms aren’t enough for privacy compliance under the Privacy Act and NDIS Practice Standards, and why consent must be current, specific, and legally valid. It also covers communication preferences as a disability access issue, and how providers can build a live consent system that frontline staff actually use.
Chapter 1
The Myth of the Blanket Consent Form
Will, EnableUs Community
So, uh, I- I was actually looking at this audit report from last year, and it- it's wild because almost every NDIS provider who got flagged for a consent breach... they- they actually had signed forms on file. Like, the paperwork was literally right there, but it was still a failure. They had a, a single form from... I don't know, 2022, and they were using it to share files in 2026. It's a complete compliance ticking time bomb.
Winter, EnableUs Community
Wait, so... 2022 to 2026? That's four years. They- they were just assuming consent... what, lasts forever?
Will, EnableUs Community
Yeah, exactly! They think once it's signed at intake, it's a, a lifetime golden ticket. But under the Privacy Act 1988 and the NDIS Practice Standards, consent isn't... it's not a bureaucratic formality you tick once. It has to be current, and more importantly, it has to be specific. Those "blanket consent" forms that say, um, "I agree to share my information with anyone involved in my care"... they are completely invalid for sensitive health and disability data. You- you can't just bundle everything into one giant "yes" button.
Winter, EnableUs Community
Right, because "anyone involved in my care" could mean... well, it could mean the speech pathologist, but it could also mean the local transport provider or a random subcontractor they've never met. So you're saying a participant has to sign, like... separate forms for different things? That sounds like a massive admin burden upfront.
Will, EnableUs Community
It- it is more work upfront, absolutely. But think about what you're actually doing. You've got information sharing with a care team, photography for promotional stuff, having a student observer in a therapy session, next of kin contacts... those are completely different things! If you put them on one blanket form, the participant hasn't actually given specific, informed consent. They've just been pressured into signing a massive waiver so they don't, you know, lose their services. And that- that violates the "freely given" rule. If a participant feels like they *have* to sign to get their supports, it's legally dead in the water.
Winter, EnableUs Community
Mmm, that makes sense. But what about... okay, what about family? I see this all the time where a well-meaning mum or a sibling signs the form because, you know, "they're family, they manage the NDIS plan." That's standard practice for a lot of smaller providers, isn't it?
Will, EnableUs Community
Oh, it's a massive, massive trap. Being a close family member does not... it absolutely does not confer legal authority to consent on someone else's behalf. Unless that family member is a formally appointed guardian, an administrator, or a designated "person responsible" under state law... they cannot legally sign that paper. Auditors will look for the actual document verifying that legal authority. If you just have a signature from "brother" or "mum" with no backup legal proof, you've got a massive documentation gap. It's a privacy breach, plain and simple.
Winter, EnableUs Community
Wow. Okay. So you have to actually ask for the formal guardianship paperwork and file it. You can't just take their word for it because they're the ones who make the phone calls. But wait, what about emergencies? Like, if there's an actual crisis, do you still have to wait for a signature?
Will, EnableUs Community
No, no, and this is where the exceptions come in, but they are... they are incredibly narrow. We're talking about a serious and imminent threat to the life or health of the participant or someone else. Or, of course, your mandatory reporting obligations... like reporting child abuse or reporting a reportable incident to the NDIS Commission. You don't need consent there. But- but here is where providers fail: they don't document the decision *at the time*. If you share info without consent because of a threat, you have to write down exactly what the threat was, why it was imminent, and why you couldn't get consent... right then and there. You can't just write a retrospective note three weeks later when you're preparing for an audit.
Chapter 2
Communication Preferences as an Access Requirement
Winter, EnableUs Community
Right, because a retrospective note just looks like you're covering your tracks. Now, this- this actually flows perfectly into how we actually talk to participants. Because communication isn't just about sharing files... it's about how we interact every single day. And I think a lot of providers treat communication preferences... you know, "Do you prefer email or phone calls?"... as a nice-to-have. Like a polite courtesy. But it's actually a legal requirement, right?
Will, EnableUs Community
Yes! Under the Disability Discrimination Act, if a participant's preferred way of communicating is linked to their disability... say they have PTSD, severe anxiety, or auditory processing differences... ignoring that preference isn't just rude. It's a failure to provide reasonable adjustments. It's a breach of their fundamental access rights.
Winter, EnableUs Community
That is a huge reframe. Because if someone has severe anxiety or PTSD, and they have explicitly requested "written-only communication"... and then a scheduler calls them out of the blue to fill a shift... that's not just an oopsie. That can trigger actual panic or cognitive overload. It- it completely breaks the trust they have in the provider.
Will, EnableUs Community
Oh, completely. Imagine being in a state of high anxiety, and your phone starts ringing from an unknown number, or a provider who is supposed to be your safe space. It feels like your boundaries are being totally run over. And the thing is, the participant's file might say "written only," but because the rostering software doesn't show it, or the scheduler was in a rush... they just make the call. That's why having this info stuck in a static PDF inside a digital filing cabinet is so dangerous. It doesn't get to the frontline workers who actually need to see it.
Winter, EnableUs Community
So, how do we actually fix that? How do you make sure the scheduler, the support worker, the receptionist... everyone actually knows and respects these preferences in real-time?
Will, EnableUs Community
You need an active, structured consent and preferences register. Not a document... a dynamic database that integrates with your daily operations. When a scheduler opens a participant's profile to assign a shift, that "written-only" preference needs to flash on the screen, or at least be a mandatory field they see before they can even dial a number. And if you *absolutely* have to call... say, there's a complex service agreement issue that's too hard for text... you first email them, explain why a call would help, ask for permission, and then schedule it. And then you log that specific verbal consent in the system. It has to be an active part of your onboarding, and your whole team needs to be trained on it. It's about building a system where compliance isn't a separate chore... it's just how you do the work.
Winter, EnableUs Community
Yeah, it makes compliance the default state instead of something you scramble to fix before the auditor shows up. Well, that's a pretty clear path forward. Thanks, Will.
Will, EnableUs Community
No worries, Winter. Talk soon.