Whistleblower protection policy

1.1 Healthdirect Australia (Healthdirect) is a government-owned organisation that is required to comply with the Corporations Act 2001 (Commonwealth).

1.2 Public companies must create and maintain a Whistleblower Protection Policy.

1.3 The purpose of this policy is to encourage Eligible Whistleblowers to recognise and disclose wrongdoing or misconduct in relation to Healthdirect, and to ensure that, when they do so:

• they can do so safely, securely and with confidence that they will know what Healthdirect's process for handling and investigating disclosures will be;
• Healthdirect will ensure disclosures are dealt with appropriately and in a timely manner;
• Healthdirect will protect and support them; and
• Healthdirect will ensure the fair treatment of all the individuals involved.

2.1 Broadly, whistleblowers are most people with a connection to a company or organisation who may be in a position to observe or be affected by misconduct and may face reprisals for reporting it. These people can access the rights and protections in the law from when they report misconduct. The protections also extend to the spouses and relatives of these people. These people are eligible under law to make disclosures that satisfy the criteria for disclosures eligible for protection under the law. This policy explains who is an Eligible Whistleblower, what are protected Eligible Disclosures (see section 5), what are not Eligible Disclosures (e.g. personal workplace grievances – see section 6), and protections for Eligible Whistleblowers. This policy also provides information on the processes for making and investigating Eligible Disclosures.

2.2 Specifically, this policy applies to all current and former Employees, casual staff, directors and officers of Healthdirect (Staff).

2.3 This policy also applies to all current and former suppliers, contractors, outsourced service providers, associates (as defined in the Corporations Act) and consultants engaged by Healthdirect and their employees (Contractors and Associates).

2.4 This policy also applies to any relative, dependent or spouse of an Employee or Contractor and Associates, (Relatives).

2.5 While this policy sets out provisions relevant to current and former Staff, it is not limited to Staff and applies more broadly, as set out in sections 2.2, 2.3 and 2.4.

3.1 ASIC means the Australian Securities and Investments Commission.

3.2 ATO means Australian Taxation Office.

3.3 Contractors has the meaning in section 2.3.

3.4 Detrimental Conduct is referred to in section 8 (which sets out protections against certain actions towards Disclosers) and means:

1. termination of employment;
2. injury in employment;
3. alteration of an employee's position or duties to their disadvantage;
4. discrimination between employees of Healthdirect;
5. harassment or intimidation;
6. harm or injury, including psychological harm;
7. damage to property;
8. damage to reputation;
9. damage to a person's business or financial position;
10. any other conduct causing damage to a person; or
11. any threat (express or implied, conditional or unconditional) to engage in any conduct of the sort listed above where there is an intention that the other person will fear that the threat is carried out, or where the person making the threat is reckless as to that outcome, and whether or not the threatened person actually feared the threat would be carried out, but Detrimental Conduct will not include:
12. conduct that is solely administrative action taken to protect the eligible whistleblower from detriment; or
13. where the Eligible Whistleblower is an Employee, managing the discloser's work performance in accordance with Healthdirect's relevant policies and procedures.

3.5 Discloser means an Eligible Whistleblower that has made an Eligible Disclosure.

3.6 Eligible Disclosure means a disclosure that is eligible for protection under the Corporations Act 2001 (Commonwealth), as further described in section 5.

3.7 Eligible Recipient means each of the following:

1. Chief Executive Officer;
2. Company Secretary;
3. Chair of the Board;
4. Chair of the Finance, Risk Management and Audit Committee;
5. any other Director on the Healthdirect Board;
6. a member of the executive team; and
7. an auditor or member of an audit team conducting an audit of Healthdirect,

as required by the Corporations Act.

3.8 Eligible Whistleblower means any current or former:

1. Staff;
2. Contractors and Associates; or
3. Relatives.

3.9 Employee means any permanent, fixed term, full time or part time employee of Healthdirect.

3.10 Relative has the meaning in section 2.4.

3.11 Staff has the meaning in section 2.2.

3.12 Whistleblower Protection Officer means the Healthdirect General Counsel.

4.1 An Eligible Disclosure is where:

1. the discloser is an Eligible Whistleblower;
2. the disclosure is made to an Eligible Recipient; and
3. the disclosure is of a matter listed in section 5.1.

5.1 An Eligible Whistleblower may make an Eligible Disclosure about the following if they have reasonable grounds to suspect that the matter is occurring:

1. misconduct or an improper state of affairs or circumstances;
2. dishonest or unethical behaviour and practices;
3. conduct that may cause harm;
4. conduct that is prohibited by standards or codes of conduct;
5. an offence against the legislation listed in section 5.2;
6. an offence punishable by imprisonment of 12 months or more; or
7. conduct that represents a danger to the public or the financial system; or
8. any conduct prescribed by regulations made under the Corporations Act from time to time as being conduct in relation to which an Eligible Disclosure can be made.

Conduct that is not an Eligible Disclosure is described in section 6.

5.2 Offences committed under the following legislation may be disclosed:

1. the Corporations Act 2001 (Cth);
2. the ASIC Act 2001 (Cth);
3. the Banking Act 1959 (Cth);
4. the Financial Sector (Collection of Data) Act 2001 (Cth);
5. the Insurance Act 1973 (Cth);
6. the Life Insurance Act 1995 (Cth);
7. the National Consumer Credit Protection Act 2009 (Cth);
8. the Superannuation Industry (Supervision) Act 1993 (Cth);
9. the Taxation Administration Act 1953 (Cth); and
10. instruments made under any of the above Acts.

5.3 There are several consequences to making a knowingly false disclosure, including:

1. reputational damage to you as the Eligible Whistleblower;
2. reputational damage to Healthdirect;
3. the Eligible Whistleblower will not be eligible to access the protections provided under legislation; and
4. the Eligible Whistleblower may be subject to criminal penalties.

5.4 Annexure A of this policy sets out guidance notes for Eligible Recipients.

6.1 A disclosure is not an Eligible Disclosure where it is solely about a personal workplace grievance (and the conduct does not have any significant implications for Healthdirect unrelated to the discloser)¹. For example, a personal workplace grievance may include:

1. bullying and harassment;
2. a decision about an Employee's engagement, promotion, suspension, discipline or termination;
3. interpersonal conflict between persons;
4. discrimination; or
5. breaches of Healthdirect's internal Staff conduct policies,

and it does not involve any conduct which would be otherwise covered by this policy (e.g., an alleged breach by Healthdirect of legislation referred to in section 5.2).

6.2 If you are an Employee and you have a workplace grievance, there are other ways to report this. Please refer to the Grievance Resolution Procedure.

6.3 If a disclosure is about a matter listed in section 6.1, but also involves a matter listed in section 5.1, it may still be an Eligible Disclosure and you should follow the steps in this policy first.

7.1 There are two more circumstances in which a disclosure may be an Eligible Disclosure. These are:

1. a public interest disclosure; and
2. an emergency disclosure.

7.2 An Eligible Whistleblower can make a public interest disclosure in the following circumstances:

1. the Eligible Whistleblower has already made an Eligible Disclosure of the information to ASIC or another Commonwealth body prescribed by Commonwealth regulations;
2. at least 90 days have passed since the Eligible Whistleblower made the Eligible Disclosure;
3. the Eligible Whistleblower has reasonable grounds to believe that no action has been taken in relation to the Eligible Disclosure;
4. the Eligible Whistleblower believes that making a further disclosure would be in the public interest;
5. after the end of the period referred to in (b) above, the Eligible Whistleblower has provided the recipient of the previous Eligible Disclosure written notice that:
   1. states that they intend to make the public interest disclosure; and
   2. contains enough information to identify the previous Eligible Disclosure; and
   3. the extent of information in the public interest disclosure is no more than necessary to inform the recipient of the matter.

7.3 An Eligible Whistleblower can make an emergency disclosure in the following circumstances:

1. the Eligible Whistleblower has already made an Eligible Disclosure of the information to ASIC or another Commonwealth body prescribed by regulation;
2. the Eligible Whistleblower has reasonable grounds to believe that the information concerns a substantial and imminent danger to the health or safety of one or more persons or to the natural environment;
3. the Eligible Discloser has provided the recipient of the previous Eligible Disclosure written notice that:
   1. states that they intend to make the emergency disclosure; and
   2. contains enough information to identify the previous Eligible Disclosure; and
4. the extent of information included in the emergency disclosure is no more than necessary to inform the recipient of the substantial and imminent danger.

7.4 To be eligible for protection, both a public interest disclosure and an emergency disclosure must be made to:

1. a member of parliament, whether State, Federal or the legislature of a territory; or
2. a journalist.

7.5 Before making a public interest disclosure or an emergency disclosure, an Eligible Whistleblower should contact the Whistleblower Protection Officer (for guidance only) or an independent legal advisor (for legal advice) to ensure that they understand the requirements in this section 7.

8.1 A Discloser will be protected in the following ways if they make an Eligible Disclosure:

1. their identity will not be able to be revealed, except for in accordance with section 8.5;
2. they will not face Detrimental Conduct as a result of the Eligible Disclosure;
3. legal action will not be able to be taken against them, except in relation to their own participation, if any, in the disclosable conduct that is revealed by the Eligible Disclosure;
4. contractual remedies will not be able to be enforced against them;
5. they will not be able to be criminally prosecuted for disclosing the information; and
6. disciplinary action will not be able to be taken against them for disclosing the information.

8.2 If the Discloser believes that the protective measures referred to in section 8.1 have not been followed, they may report this to any of the following:

1. Healthdirect, through any of the methods listed in section 9.2; or
2. ASIC.

8.3 If the Discloser informs Healthdirect that they are likely to face, or have faced Detrimental Conduct, Healthdirect will take action to prevent or stop the detrimental conduct and consult with them about the remedies and support that Healthdirect will offer. The Discloser may also be entitled to seek an order from a court for an injunction to prevent, stop or remedy the effects of the Detrimental Conduct.

8.4 Irrespective of section 8.1, Healthdirect may always undertake action, where there is legitimate reason to do so, in accordance with Healthdirect's relevant policies and procedures, provided such reason is not based on any Eligible Disclosure made under this policy.

8.5 Further to section 8.1(a), the Discloser's identity (or information that is likely to lead to their identification) may only be disclosed:

1. to ASIC;
2. to a member of the Australian Federal Police; or
3. to a legal practitioner for the purposes of obtaining legal advice or representation in relation to the operation of the whistleblower protection provisions of the Corporations Act;
4. to a person or body prescribed for this purpose under regulations made under the Corporations Act; or
5. with your consent.

8.6 If the Discloser believes their identity has been incorrectly disclosed, or information disclosed that could likely lead to their identification, the Discloser may also be entitled to seek compensation and other remedies through court processes if:

1. they suffer loss, damage or injury because of the Eligible Disclosure; and
2. the loss, damage or injury suffered is a result of Healthdirect failing to prevent a person from causing the Detrimental Conduct.

8.7 Each person involved in the handling and investigation of an Eligible Disclosure must:

1. keep the Eligible Disclosure and the Discloser's identity confidential; and
2. be aware that the unauthorised disclosure of the Discloser's identity or information that is likely to lead to their identification may be a criminal offence.

8.8 While every effort will be made to ensure that the Discloser's identity is protected, following an Eligible Disclosure, the Discloser's identity may become known in circumstances outside of the control of Healthdirect, for example where the Discloser:

1. has mentioned making the Eligible Disclosure to people;
2. is one of a small group of people with access to the disclosed information; or
3. has been told the disclosed information privately and in confidence.

8.9 Healthdirect will endeavour to ensure that all people involved in the Eligible Disclosure and investigation process, including those named in an Eligible Disclosure, are treated fairly in compliance with this policy and applicable laws.

9.1 An Eligible Whistleblower can make an Eligible Disclosure to any of the following:

1. ASIC;
2. a Commonwealth authority prescribed for the purposes of receiving whistleblower disclosures under the Corporations Act;
3. a legal practitioner for the purpose of obtaining advice about the whistleblower protections available to you; or
4. an Eligible Recipient.²

9.2 An Eligible Whistleblower can make an Eligible Disclosure in any of the following ways:

1. speak to an Eligible Recipient directly;
2. via email, to any Eligible Recipients;
3. to one of the following email addresses:
   1. board-chair@healthdirect.org.au;
   2. frmac-chair@healthdirect.org.au³;
   3. fraud@healthdirect.org.au (this email is monitored by the Healthdirect Company Secretary, and the Chief Executive Officer and General Counsel may also view correspondence to this email address);
4. send a letter to Healthdirect at PO Box K411, Haymarket NSW 1240 addressed to the 'Eligible Recipient' c/o the Whistleblower Protection Officer;
5. through the Eligible Whistleblower disclosure portal on Healthdirect's website; or
6. contact ASIC at asic.gov.au/about-asic/contact-us/.

9.3 An Eligible Whistleblower may make an Eligible Disclosure anonymously or using a pseudonym and may continue to retain anonymity, during and after any investigation, should the Eligible Disclosure be investigated. A Discloser may refuse to answer any question, at any time, where they feel their answer could reveal their identity. However, Healthdirect recommends that, even where the Discloser wishes to remain anonymous, they engage in two-way communication so that Healthdirect can ask follow-up questions and/or provide feedback.

9.4 While an Eligible Disclosure may be made to any of the entities referred to in section 9.1, Healthdirect recommends that they make the Eligible Disclosure to an Eligible Recipient at Healthdirect, in the first instance, in order to allow us to investigate and address the matter.

9.5 An Eligible Whistleblower may contact the Whistleblower Protection Officer at whistleblowerprotectionofficer@healthdirect.org.au to obtain confidential information about the following:

1. how this policy works;
2. what this policy covers; and
3. how an Eligible Disclosure is handled.

10.1 All Eligible Disclosures made to Healthdirect:

1. will be handled by Healthdirect confidentially, where is it practical and appropriate to do so, including by:
   1. maintaining a restricted access network folder for storing documents in relation to disclosures;
   2. restricting access to the Eligible Disclosure accounts to Eligible Recipients, the Whistleblower Protection Officer, the investigation team (see section 11);
   3. providing training to Eligible Recipients about their obligations regarding confidentiality; and
   4. making available an anonymous Disclosure mechanism; and
2. will be assessed by Healthdirect and may be subject to confidential investigation to determine if there is sufficient evidence to substantiate or reject the matters that are the subject of the disclosure.

10.2 If you feel as though you require support as a result of the Eligible Disclosure, you may contact the Whistleblower Protection Officer to discuss the appropriate support mechanisms available to you.

11.1 If an Eligible Whistleblower makes an Eligible Disclosure to a Healthdirect Eligible Recipient, and elects not to be anonymous, the Eligible Recipient will contact the Eligible Whistleblower via the appropriate method and within a reasonable period informing them:

1. that the Eligible Disclosure has been received;
2. if and when an investigation has or will be commenced;
3. the members of the investigation team;
4. of regular updates; and
5. when an investigation has been concluded.

11.2 The members of the investigation team for each Eligible Disclosure may differ, depending on the nature of the Eligible Disclosure. Members will generally be from Healthdirect's Legal, People and Culture, Finance or Business Resilience teams or another Eligible Recipient (in appropriate circumstances) and may involve the Whistleblower Protection Officer, Chief Executive Officer, or Board Chair. Healthdirect may appoint external specialists instead of an internal investigation team such as where the matter is sensitive or requires a high degree of independence. Healthdirect may also appoint external specialists to form part of an internal investigation team, such as Healthdirect's auditors or fraud forensic specialists.

11.3 If the Eligible Whistleblower elects not to remain anonymous in making an Eligible Disclosure, Healthdirect may also communicate with them via an appropriate method to ensure the protection of their identity. The Eligible Recipient may ask the Eligible Whistleblower the following:

1. the risk of their identity becoming known;
2. if they fear any detriment occurring towards you;
3. who they fear may cause detriment;
4. any conflicts they may be experiencing;
5. whether any threats of detriment have been made to them or others; and
6. any other relevant questions.

11.4 If an Eligible Whistleblower has remained anonymous when making an Eligible Disclosure, the Eligible Recipient will acknowledge receipt of the Eligible Disclosure (assuming contact details are available) and advise the Eligible Whistleblower that they will refer it to the investigation team and who the members of the investigation team are. If the Eligible Whistleblower elects to remain anonymous, the Eligible Recipient may be unable to contact them or investigate the Eligible Disclosure.

11.5 If an Eligible Whistleblower provides contact details, before passing any information onto the investigation team, the Eligible Recipient will confirm with the Eligible Whistleblower whether they wish to remain anonymous throughout the investigation, and to obtain further information. If an Eligible Whistleblower has provided their identity to the Eligible Recipient, but has advised that they wish to remain anonymous during the investigation, the Eligible Recipient will send the information to the investigation team without disclosing the Eligible Whistleblower's identity.

11.6 Healthdirect will make appropriate efforts to investigate an Eligible Disclosure where the Discloser elects to remain anonymous, but there may be limitations on the effectiveness of the investigation in these circumstances.

11.7 If an Eligible Disclosure is made to an Eligible Recipient, the disclosure will be assessed to determine whether:

1. it is an Eligible Disclosure that comes under this policy; and
2. a formal investigation in relation to the disclosure is required.

11.8 If it is determined that an investigation is required, the Eligible Recipient will pass the Eligible Disclosure to the investigation team who will determine:

1. the nature and scope of the investigation;
2. the person/s that should be part of the investigation;
3. the nature of any legal, financial or technical advice that will be required to conduct the investigation; and
4. the timeframe for the investigation.

11.9 In an investigation, the information contained in the Eligible Disclosure will not be able to be further disclosed without the Discloser's consent unless:

1. the information does not disclose their identity;
2. information related to their identity or that may lead to their identification is removed; and
3. it is reasonably necessary to investigate the Eligible Disclosure.

11.10 An investigation of an Eligible Disclosure will normally include the following steps:

1. the Eligible Recipient discussing the matter with the Discloser;
2. determining whether there will be an investigation and who the investigation team members will be;
3. as and when required by principles procedural fairness, and at the appropriate time, informing the person/s about whom the Eligible Disclosure relates that an Eligible Disclosure has been made and whether they are under investigation;
4. ensuring the appropriate reminders of confidentiality are issued and conflicts of interest declarations are obtained from the investigation team;
5. determining whether there are relevant witnesses to the disclosed conduct;
6. accessing and reviewing relevant records (including emails) and keeping the Discloser informed;
7. preparation of a report to document the investigation outcome;
8. informing the Discloser and, as and when required by principles procedural fairness, and at the appropriate time, those identified in the Eligible Discloser of the outcome.

11.11 The outcome of investigations and any reviews of such investigations will be reported to the Healthdirect Board on a confidential and de-identified basis.

12.1 When an investigation is conducted as a result of an Eligible Disclosure, the Discloser will receive the following information after the investigation is finished, if it is possible to contact them:

1. the outcome of the investigation;
2. how their identity has been and will continue to be protected following the investigation process;
3. the steps that have been taken in relation to the Eligible Disclosure, if appropriate; and
4. the steps that have been taken to prevent the conduct in the future.

12.2 If a person is the subject of an Eligible Disclosure, that person will be advised of the following:

1. the subject matter of the Eligible Disclosure as and when required and prior to any actions being taken; and
2. the outcome of the investigation.

12.3 If a person is unsatisfied with the outcome of an investigation conducted by Healthdirect, they may:

1. lodge a complaint with a regulator, such as ASIC; or
2. request a review by contacting the Whistleblower Protection Officer.

12.4 If Healthdirect receives a complaint about the outcome of any investigation, Healthdirect will appoint a reviewer to review the investigation outcome to:

1. determine if the investigation was conducted in accordance with this policy; and
2. review any new information or evidence available.

13.1 This policy will be made available to Staff on Healthdirect's Staff intranet, and to the public, by publishing a version on Healthdirect's website.

13.2 This policy will be accompanied by plain language summary information on ways a person can make a complaint or raise an issue including an Eligible Disclosure, the way reports are processed, and protections available including the option to remain anonymous.

This policy must be reviewed and presented to the Board every two years.

If you are an Eligible Recipient, you may receive information from a number of sources about a range of matters and it is important to be aware of your obligations under this Policy as the information that you receive may be an Eligible Disclosure.

If you receive information that you think may qualify as an Eligible Disclosure, please follow the following steps:

1. in the first instance, treat the disclosure as though it were an Eligible Disclosure under this policy; and
2. as soon as possible after receiving the disclosure, please contact our external legal advisor at Lander and Rogers on 02 8020 7612 (please contact the Whistleblower Protection Officer for the name of the then current legal advisor) who will provide you with guidance on whether the disclosure may qualify as an Eligible Disclosure and instructions on the next steps to take in relation to the matter.

It is vital that you follow the processes outlined in this policy, as well as any advice received by our external legal advisor because as an Eligible Recipient you have a number of obligations in relation to receiving an Eligible Disclosure, which include:

1. ensuring that the information contained in any Eligible Disclosure, as well as the identity of the Disclosure are kept confidential; and
2. participating in any investigation that is required in relation to the Eligible Disclosure.

If you do not comply with your obligations, there are several potential consequences, including, but not limited to:

1. the potential for criminal action to be taken against you;
2. reputational damage to yourself and to Healthdirect; and
3. potential legal action.