1. Purpose

1.1 Healthdirect Australia (Healthdirect) is a government-owned organisation that is required to comply with the Corporations Act 2001 (Commonwealth).

1.2 An amendment to the Corporations Act 2001 (Commonwealth), requires that public companies create and maintain a Whistleblower Protection Policy.

1.3 This amendment took effect 1 July 2019 and companies are required to adopt a Whistleblower Protection Policy by 1 January 2020.

2. Scope

2.1 This policy applies to all current and former permanent full-time, part-time and fixed-term employees, casual staff, directors and officers of Healthdirect (Employees).

2.2 This policy applies to all, suppliers, contractors, outsourced service providers, associates and consultants engaged by Healthdirect and their employees (Contractors, Associates and Suppliers).

2.3 This policy applies to any relative, dependent or spouse of an Employee, Contractor, Associate or Supplier (Relatives).

3. Definitions

3.1 ASIC means the Australian Securities and Investments Commission.

3.2 Detrimental Conduct means:

1. termination of employment,
2. injury in employment,
3. alteration of an employee’s position or duties to their disadvantage,
4. discrimination between employees of Healthdirect,
5. harassment or intimidation,
6. harm or injury, including psychological harm,
7. damage to property,
8. damage to reputation,
9. damage to a person’s business or financial position, or
10. any other damage.

3.3 Discloser means an Eligible Whistleblower that has made an Eligible Disclosure.

3.4 Eligible Disclosure means a disclosure that is eligible for protection under the Corporations Act 2001 (Commonwealth).

3.5 Eligible Recipient means each of:

1. the Chief Executive Officer;
2. the Company Secretary;
3. the Chief Financial Officer;
4. a member of the executive team;
5. the Chair of the Board;
6. the Chair of the Finance, Risk Management and Audit Committee; and
7. an internal auditor or member of an internal audit team conducting an audit of Healthdirect.

3.6 Eligible Whistleblower means a current or former:

1. employee;
2. contractor, associate or supplier; or
3. relative.

3.7 Whistleblower Protection Officer means the Healthdirect General Counsel.

4. Principles

4.1 This policy is required under law.

4.2 This policy supports Healthdirect’s values and Employee Code of Conduct by discouraging wrongdoing by Employees of Healthdirect and encouraging disclosures to be made where required.

5. When will a disclosure qualify for protection?

5.1 An Eligible Disclosure is where:

1. the discloser is an Eligible Whistleblower;
2. the disclosure is made to an Eligible Recipient; and
3. the disclosure is of a matter listed in section 6.1. public interest.

6. What matters can be disclosed?

6.1 You may make an Eligible Disclosure about the following if you have reasonable grounds to suspect that the matter is occurring:

1. misconduct or an improper state of affairs or circumstances;
2. dishonest or unethical behaviour and practices;
3. conduct that may cause harm;
4. conduct that is prohibited by standards or codes of conduct;
5. an offence against the legislation listed in section 6.2;
6. an offence punishable by imprisonment of 12 months or more; or
7. conduct that represents a danger to the public or the financial system.

6.2 Further to clause 6.1(e), offences committed under the following legislation may be disclosed:

1. the Corporations Act 2001;
2. the ASIC Act 2001;
3. the Banking Act 1959;
4. the Financial Sector (Collection of Data) Act 2001;
5. the Insurance Act 1973;
6. the Life Insurance Act 1995;
7. the National Consumer Credit Protection Act 2009; and
8. the Superannuation Industry (Supervision) Act 1993.

6.3 There are several consequences to making a disclosure that you know is untrue, including:

1. reputational damage to you as the Discloser;
2. reputational damage to Healthdirect;
3. you will not be eligible to access the protections provided under legislation; and
4. you may be subject to criminal penalties.

7. What is not an eligible disclosure?

7.1 A disclosure is not an Eligible Disclosure where it is solely about a workplace grievance (as defined in the Grievance Resolution Procedure) which includes:

1. bullying and harassment;
2. discrimination; or
3. breaches of the Employee Conduct Policy,

and it does not involve any conduct which would be covered by this policy.

7.2 If you are an Employee and you are suffering from a workplace grievance, please refer to the Grievance Resolution Procedure.

7.3 If a disclosure is about a matter listed in section 6.1, but also involves a matter listed in section 7.1, it may still be an Eligible Disclosure and you should follow the steps in this policy first.

8. Public Interest and emergency disclosures

8.1 There are two more circumstances in which a disclosure may be eligible for protection, these are:

1. a public interest disclosure; and
2. an emergency disclosure.

8.2 You can make a public interest disclosure in the following circumstances:

1. you have already made an Eligible Disclosure of the information;
2. at least 90 days have passed since you made the Eligible Disclosure;
3. you have reasonable grounds to believe that no action has been taken in relation to the Eligible Disclosure;
4. you believe that making a further disclosure would be in the public interest;
5. you have provided the recipient of the previous Eligible Disclosure written notice that:
   1. states that you intend to make the public interest disclosure; and
   2. contains enough information to identify the previous disclosure; and
   3. the extent of information in the public interest disclosure is no more than necessary to inform the recipient of the matter.

8.3 You can make an emergency disclosure in the following circumstances:

1. you have already made an Eligible Disclosure of the information;
2. you have reasonable grounds to believe that the information concerns a substantial or imminent danger to the health or safety of one or more persons or to the natural environment;
3. you have provided the recipient of the previous Eligible Disclosure written notice that:
   1. states that you intend to make the emergency disclosure; and
   2. contains enough information to identify the previous disclosure; and
4. no more information is included in the emergency disclosure than is necessary to inform the recipient of the substantial and imminent danger.

8.4 To be eligible for protection, both a public interest disclosure and an emergency disclosure must be made to:

1. a member of parliament, whether State, Federal or the legislature of a territory; or
2. a journalist.

8.5 Before you make a public interest disclosure or an emergency disclosure, you should contact the Whistleblower Protection Officer or an independent legal advisor to ensure that you understand the requirements in this section 8.

9. Legal and practical protections and support for disclosers

9.1 You will be protected in the following ways if you make an Eligible Disclosure:

1. your identity will not be able to be revealed, except for in accordance with section 9.5;
2. you, or any other person, will not face detrimental Conduct as a result of the Eligible Disclosure;
3. legal action will not be able to be taken against you, except in relation to your own participation, if any, in the disclosable conduct that is revealed by the Eligible Disclosure;
4. contractual remedies will not be able to be enforced against you;
5. you will not be able to be criminally prosecuted for disclosing the information; and
6. disciplinary action will not be able to be taken against you for disclosing the information.

9.2 If you believe that the protective measures referred to in section 9.1 have not been followed, you may report this to any of the following:

1. Healthdirect, through any of the methods listed in section 10.2; or
2. ASIC.

9.3 If you inform Healthdirect that you are likely to face, or have faced detrimental conduct Healthdirect will take action to prevent or stop the detrimental conduct and reach an agreement with you about the remedies and support that Healthdirect will offer.

9.4 Irrespective of section 9.1, Healthdirect will not be prevented from undertaking action, where there is legitimate reason to do so, in accordance with Healthdirect’s Performance Policy provided such reason is not based on any Eligible Disclosure made under this policy.

9.5 Further to section 9.1(a), your identity may only be disclosed:

1. to ASIC;
2. to a member of the Australian Federal Police; or
3. to a legal practitioner for the purposes of obtaining legal advice or representation;
4. under authorization by law; or
5. with your consent.

9.6 If you believe your identity has been incorrectly disclosed, you may also be entitled to seek compensation and other remedies through court processes if:

1. you suffer loss, damage or injury because of the Eligible Disclosure; and
2. the loss, damage or injury suffered is a result of Healthdirect failing to prevent a person from causing the detriment.

9.7 Each person involved in the handling and investigation of an Eligible Disclosure must:

1. keep the Eligible Disclosure and the Discloser’s identity confidential; and
2. be aware that the unauthorized disclosure of the Disclosers identity or information that is likely to lead to their identification may be a criminal offence.

9.8 While every effort will be made to ensure that your identity is protected following an Eligible Disclosure, your identity may become known in circumstances outside of the control of Healthdirect, for example where you:

1. have mentioned making the Eligible Disclosure to people;
2. are one of a small group of people with access to the disclosed information; or
3. have been told the disclosed information privately and in confidence.

9.9 Healthdirect will endeavour to ensure that all people involved in the Eligible Disclosure and investigation process, including those named in an Eligible Disclosure, are treated fairly in compliance with this policy.

10. How to make a disclosure

10.1 You can make an Eligible Disclosure to any of the following:

1. ASIC;
2. a prescribed Commonwealth authority;
3. a legal practitioner for the purpose of obtaining advice about the whistleblower protections available to you; or
4. an Eligible Recipient.¹

10.2 You can make an Eligible Disclosure in any of the following ways:

1. speak to an Eligible Recipient directly;
2. via email, to any Eligible Recipients;
3. to one of the following email addresses:
   
   1. fraud@healthdirect.org.au;
   2. board-chair@healthdirect.org.au;
   3. frmac-chair@healthdirect.org.au;
4. send a letter to Healthdirect at PO Box K411, Haymarket NSW 1240 addressed to the Whistleblower Protection Officer; or
5. contact ASIC at asic.gov.au/about-asic/contact-us.

10.3 You may make an Eligible Disclosure anonymously or using a pseudonym and may continue to retain anonymity should the Eligible Disclosure be investigated.

10.4 While an Eligible Disclosure may be made to any of the entities referred to in section 10.1, it is recommended that you make the Eligible Disclosure to an Eligible Recipient at Healthdirect Australia in the first instance, in order to allow us to investigate and address the matter.

10.5 You may contact the Whistleblower Protection Officer to obtain confidential information about the following:

1. how this policy works;
2. what this policy covers; and
3. how an Eligible Disclosure is handled.

11. Handling disclosures

11.1 All Eligible Disclosures made to Healthdirect:

1. will be handled confidentially, where is it practical and appropriate to do so; and
2. will be assessed and may be subject to investigation to determine if there is sufficient evidence to substantiate or reject the disclosure.

11.2 If you feel as though you require support as a result of the Eligible Disclosure, you may contact the Whistleblower Protection Officer to discuss the appropriate support mechanisms available to you.

12. Investigating a disclosure

12.1 If you make an Eligible Disclosure to Healthdirect, you will be contacted via the appropriate method and within a reasonable period informing you:

1. that the Eligible Disclosure has been received;
2. if an investigation has commenced;
3. of regular updates; and
4. that an investigation has been concluded.

12.2 If you do not choose to remain anonymous in making an Eligible Disclosure, Healthdirect may also communicate with you via an appropriate method to ensure the protection of your identity. We may ask you the following:

1. the risk of your identity becoming known;
2. if you fear any detriment occurring towards you;
3. who you fear may cause detriment;
4. any conflicts you may be experiencing;
5. whether any threats of detriment have been made to yourself or others; and
6. any other relevant questions.

12.3 If you have remained anonymous when making an Eligible Disclosure, Healthdirect may be unable to contact you regarding the Eligible Disclosure.

12.4 If a disclosure is made to Healthdirect, the disclosure will be assessed to determine:

1. whether it is an Eligible Disclosure that comes under this policy; and
2. if a formal investigation in relation to the disclosure is required.

12.5 If it is determined that an investigation is required, the investigation of the Eligible Disclosure will be undertaken by Healthdirect’s appointed Internal Auditors, who will determine:

1. the nature and scope of the investigation;
2. the person/s that should be part of the investigation;
3. the nature of any legal, financial or technical advice that will be required to conduct the investigation; and
4. the timeframe for the investigation.

12.6 Healthdirect’s Internal Auditors will undertake an investigation of the Eligible Disclosure in accordance with the requirements set out in section 12.7.

12.7 In an investigation, the information contained in the Eligible Disclosure will not be able to be further disclosed without your consent unless:

1. the information does not disclose your identity;
2. information related to your identity or that may lead to your identification is removed; and
3. it is reasonably necessary to investigate the Eligible Disclosure.

12.8 The outcome of investigations and any reviews of such investigations will be reported to the Board on a confidential basis.

13. Following investigation

13.1 When an investigation is conducted as a result of an Eligible Disclosure, you will receive the following information after the investigation is finished, if it is possible to contact you:

1. the outcome of the investigation;
2. how your identity has been and will continue to be protected following the investigation process;
3. the steps that have been taken in relation to the Eligible Disclosure, if appropriate; and
4. the steps that have been taken to prevent the conduct in the future.

13.2 If you are the subject of an Eligible Disclosure, you will be advised of the following:

1. the subject matter of the Eligible Disclosure as and when required and prior to any actions being taken; and
2. the outcome of the investigation.

13.3 If you are unsatisfied with the outcome of an investigation conducted by Healthdirect, you may:

1. lodge a complaint with a regulator, such as ASIC; or
2. request a review by contacting the Whistleblower Protection Officer.

13.4 If a review of the investigation is undertaken, Healthdirect may, at its discretion:

1. seek to determine if the investigation was conducted in accordance with this policy; and
2. review any new information or evidence available, in accordance with this policy.

13.5 Healthdirect is under no obligation to review an investigation and may conclude a review if it is decided that the investigation was conducted in accordance with this policy, or there is no new information that would change the outcome of the investigation.

14. Ensuring the policy is easily accessible

14.1 This policy will be made available to Employees on the Policy and Procedure Library on the staff intranet.

14.2 Employees must provide a copy of this policy to all new and existing Contractors, Suppliers and Associates.

14.3 Employees are encouraged to inform Relatives of this policy.

15. Reviewing and updating the policy

This policy must be reviewed and presented to the Board every two years.

Annexure A — Guidance for eligible recipients

As part of your role at Healthdirect Australia you are considered an Eligible Recipient under this Policy. As an Eligible Recipient, you may receive information from a number of sources about a range of matters and it is important to be aware of your obligations under this Policy as the information that you receive may be considered an Eligible Disclosure.

If you receive information that you think may qualify as an Eligible Disclosure, please follow the following steps:

1. in the first instance, treat the disclosure as though it were an Eligible Disclosure under this policy; and
2. as soon as possible after receiving the disclosure, please contact our external legal advisor Neil Napper of Lander and Rogers on 02 8020 7612 who will provide you with guidance on whether the disclosure may qualify as an Eligible Disclosure and instructions on the next steps to take in relation to the matter.

It is vital that you follow the processes outlined in this policy, as well as any advice received by our external legal advisor because as an Eligible Recipient you have a number of obligations in relation to receiving an Eligible Disclosure, which include:

1. ensuring that the information contained in any Eligible Disclosure, as well as the identity of the Disclosure are kept confidential;
2. participating in any investigation that is required in relation to the Eligible Disclosure; and
3. ensuring that the Discloser does not face any Detrimental Conduct because of the Eligible Disclosure.

If you do not comply with your obligations, there are several potential consequences, including, but not limited to:

1. the potential for criminal action to be taken against you;
2. reputational damage to yourself and to Healthdirect Australia; and
3. potential legal action.

---

^{1. Note that in cases where a disclosure is made to an internal auditor as Eligible Recipient, such disclosure will be reported to the General Counsel.}