Clinical and Technical Governance Standard

1. Provides leadership to develop a culture of safety and quality improvement, and satisfies itself that this culture exists within the organisation
2. Provides leadership to ensure partnering with service users and their support people
3. Sets priorities and strategic directions for ethical, safe and high-quality care, and ensures that these are communicated effectively to the workforce and service users and their support people
4. Endorses the organisation’s clinical and technical governance frameworks
5. Ensures that roles and responsibilities are clearly defined for the governing body, management, clinicians, peer workers, technicians and other members of the workforce
6. Monitors the action taken as a result of analyses of clinical and technical incidents and trends
7. Reviews reports and monitors the organisation’s progress on safety, quality, performance and effectiveness
8. Establishes principles and practices within governance frameworks that support the organisation’s ability to adapt to technology as it changes.

1.02—The service provider establishes and maintains clinical and technical governance frameworks and uses the processes within these frameworks to drive improvements in safety, quality, performance and effectiveness.

1.03—The service provider implements and monitors strategies to meet its priorities for diverse population groups, including Aboriginal and Torres Strait Islander peoples, and inclusion of service users and where relevant, their support people.

1.04—The service provider considers the safety and quality of health care for service users and their support people in its business decision-making.

1.05—The service provider applies ethical principles to its business decision- making about the design, development and delivery of services.

1. Ensures clinical, peer worker and technical leaders understand and perform their delegated safety and quality roles and responsibilities
2. Ensures clinical, peer worker and technical leaders operate within the clinical and technical governance frameworks to improve the safety and quality of health care for service users and their support people
3. Engages clinical and peer worker expertise in the clinical governance of the service
4. Engages technical expertise in the technical governance of the service.

1.07—The service provider uses a risk management approach to:

1. Set out, review and maintain the currency and effectiveness of policies, procedures and protocols
2. Monitor and take action to improve adherence to policies, procedures and protocols
3. Review compliance with legislation, regulations and jurisdictional requirements.

1.08—The service provider uses quality improvement systems that:

1. Identify safety, outcome and quality measures, and monitor and report performance and outcomes
2. Identify areas for improvement in safety and quality
3. Maintain a quality improvement register to log initiatives to improve safety and quality
4. Assign to members of the workforce clear responsibility for safety and quality
5. Implement and monitor safety and quality improvement initiatives.

1.09—The service provider ensures timely reports on safety and quality systems and performance are provided to:

1. The governing body
2. The workforce
3. Service users and their support people.

1.10—The service provider:

1. Identifies and documents service risks
2. Uses clinical, technical and other data collections to support risk assessments
3. Acts to reduce risks
4. Regularly reviews and acts to improve the effectiveness of the risk management system
5. Reports on risks to the workforce, and service users and their support people
6. Plans for and manages internal and external emergencies and disasters, including cybersecurity risks and threats.

1.11—The service provider has incident management and investigation systems and:

1. Assists the workforce to recognise and report incidents
2. Assists service users and their support people to communicate concerns or incidents
3. Involves the workforce, consumers, carers and families in the review of incidents
4. Provides timely feedback on the analysis of incidents to the governing body, the workforce, and service users and their support people
5. Uses the information from the analysis of incidents to improve safety and quality
6. Incorporates risks identified in the analysis of incidents into the risk management system
7. Regularly reviews and acts to improve the effectiveness of the incident management and investigation systems.

1.12—The service provider:

1. Uses an open disclosure program that is consistent with the Australian Open Disclosure Framework
2. Monitors and acts to improve the effectiveness of open disclosure processes.

1.13—The service provider:

1. Has processes to seek regular feedback from service users and their support people about their experiences of the service and outcomes of care
2. Uses this information to improve safety, quality, performance and effectiveness.

1.14—The service provider has a complaints management system, and:

1. Encourages and assists service users and their support people to report complaints
2. Involves service users and their support people in the review of complaints
3. Resolves complaints in a timely way
4. Provides timely feedback to the governing body, the workforce, and service users and their support people on the analysis of complaints and actions taken
5. Uses information from the analysis of complaints to inform improvements in safety and quality
6. Records the risks identified from the analysis of complaints in the risk management system
7. Regularly reviews and acts to improve the effectiveness of the complaints management system.

1.15—The service provider:

1. Identifies the diversity of service users and their support people
2. Identifies groups of service users who are at higher risk of harm
3. Incorporates information on the diversity of service users and their support people, and higher-risk groups into the planning and delivery of the service.

1.16—The service provider has healthcare records systems that:

1. Support the creation and maintenance of accurate healthcare records
2. Comply with security and privacy legislation and regulations
3. Support the systematic audit of clinical information and the technical operation of the healthcare record
4. Integrate multiple information systems, where they are used.

1.17—The service provider providing clinical information into the My Health Record system has processes that:

1. Optimise the safety and quality of care to service users and their support people
2. Use national patient and provider identifiers
3. Use standard national terminologies
4. Describe access to the system by the workforce, to comply with legislative requirements
5. Maintain the accuracy and completeness of the clinical information the service provider uploads into the system.

1.18—The service provider provides orientation to the organisation that describes roles and responsibilities for the safety and quality of services for:

1. Members of the governing body
2. Clinicians, peer workers, technicians and other members of the workforce.

1.19—The service provider uses its training systems to:

1. Assess the competency and training needs of its workforce
2. Implement a training program to meet its requirements arising from these standards
3. Provide access to training to meet its safety and quality training needs
4. Monitor the workforce’s participation in training.

1.20—The service provider has strategies to provide culturally safe services to meet the needs of its Aboriginal and Torres Strait Islander service users and their support people.

1.21—The service provider has valid and reliable performance review processes that:

1. Require members of the workforce to regularly take part in a review of their performance
2. Identify needs for training and development in safety and quality
3. Incorporate information on training requirements into training systems.

1.22—The service provider has processes to ensure clinicians and peer workers involved in the design and delivery of services:

1. Have the necessary skills, experience and qualifications for these roles
2. Have, and work within, a defined scope of clinical practice.

1.23—The service provider has a process to ensure technicians involved in the design and delivery of services have the necessary skills, experience and qualifications for this role.

1.24—The service provider has processes to:

1. Assign safety and quality roles and responsibilities for services to the workforce
2. Support the workforce to understand and perform their roles and responsibilities for safety and quality.

1.25—The service provider maximises the safety and quality of care:

1. Through the design of services, the digital operating systems and internal access controls
2. By ensuring the terms and conditions for use of services are fair and transparent and do not mislead service users and where relevant, their support people
3. By ensuring devices and other infrastructure are fit for purpose and well maintained
4. By developing and using processes for the prompt implementation of legislative and regulatory changes.

1.26—The service provider has systems to:

1. Minimise risk of abuse of service users and where relevant, their support people
2. Minimise risk of exploitation of service users and where relevant, their support people
3. Preserve the dignity of service users and where relevant, their support people.

1.27—The service provider has systems to minimise the risk for children and young people to be harmed while using a service.

1.28—The service provider conducts a privacy impact assessment for each service in accordance with best practice.

1.29—The service provider has privacy policies for each service that are:

1. Easy to understand and transparent for service users and their support people
2. Uphold service users’ rights and choices
3. Readily available to service users and their support people before accessing and while using the services
4. Compliant with privacy laws, privacy principles and best practice.

1.30—The service provider advises service users, and where relevant, their support people, of changes to privacy policies in a timely and comprehensible way.

1.31—The service provider has systems for the collection, use, disclosure, storage, transmission, retention and destruction of data that provide service users and where relevant, their support people with:

1. Information on the types of data collected and how the information is used
2. Information on any interoperable healthcare services
3. Information on who has access to their data, including through data sharing agreements, provision or sale to third parties, and if transfer of data outside of Australia occurs
4. Timely information if requests to access data by external parties are granted by the service provider
5. Protection of their data that was provided anonymously or using a pseudonym
6. Prevention against the unauthorised re-identification of anonymous or de-identified data
7. Notification if the service ceases operation or changes ownership
8. Information on where their data will go if the service ceases to operate or changes ownership
9. Information on the legacy of their data.

1.32—The service provider has mechanisms for service users to:

1. Consent to the use of personal data and records for any purpose beyond direct care
2. Consent before any personal data and records are used in research, unless it is de-identified
3. Withdraw or withhold consent for the collection, storage or distribution of their personal data and records
4. Opt out from the sharing of their personal data and records
5. Access, copy and amend their personal data and records
6. Request deletion of their personal data and records.

1.33—The service provider provides service users and where relevant, their support people with clear and transparent information on the:

1. Direct costs to access the service
2. Estimated data usage requirements for using the service.

1.34—The service provider ensures that in-product sales or advertising:

1. Complies with Australian Consumer Law and regulatory requirements
2. Is appropriate for service users.

1.35—The service provider has information security management systems and uses a risk-based approach to:

1. Assign responsibility and accountability for information security
2. Complete and maintain an information and data inventory
3. Protect data in transit and at rest
4. Protect against interruption, damage or disconnection of the service
5. Assess the size and extent of threats to its information assets
6. Consider and mitigate vulnerabilities and threats
7. Conduct regular updates, reviews and audits of information security
8. Detect, respond and report to the governing body, workforce, service users and their support people on information security incidents and technical faults.

1.36—The service provider:

1. Manages platform and operating system updates and patches
2. Manages the continuity of services, backup and recovery mechanisms 
3. Effectively communicates service changes or interruptions to service users and where relevant, their support people.