Psychosocial risk and wellbeing case management

See who is carrying the most, while there is still time to act.

CaseNote is one secure system for peer support programs, mental health teams and WHS leaders: cumulative exposure tracking, validated wellbeing screening and clinical case management, with the audit trail and de-identified reporting that show your organisation acted. Built for Australian law, including the NSW Work Health and Safety Act's new section 26A.

AES-256-GCM per-record encryption Hosted in Australia Built for the Privacy Act 1988 · HRIP Act Append-only audit trail Evidence for WHS Act s 26A
File 03 The law WHS Act 2011 No 10 (NSW)

Since 1 July 2026, the psychosocial Code of Practice is enforceable in NSW.

NSW employers have had an explicit duty to manage psychosocial risks since October 2022, and SafeWork NSW's Managing psychosocial hazards at work Code of Practice has described what good management looks like since 2021. What changed on 1 July 2026 is enforceability: a new section 26A of the Work Health and Safety Act 2011 (NSW) requires every organisation to comply with approved codes of practice, or to manage the same risks another way that meets an equal or higher standard.

19s 19 · WHS Act 2011 (NSW)

The primary duty of care

An organisation must ensure, so far as is reasonably practicable, the health and safety of its workers. The Act's definition of health includes psychological health, so the duty has always covered minds as well as bodies.

Where CaseNote fits Exposure tracking, screening and structured escalation give the psychological side of this duty a working system rather than a policy document.
55Ass 55A–55D · WHS Regulation 2025 (NSW)

Managing psychosocial risks

In force since 1 October 2022 and carried into the remade 2025 Regulation, these sections require employers to identify psychosocial hazards and control them using the hierarchy of controls. SafeWork NSW names exposure to traumatic events among the common hazards. Policies and training alone do not discharge the duty: controls must reach how work is designed, resourced and supported.

Where CaseNote fits The anonymous hazard survey measures the hazard categories across your workforce, and exposure and screening data show whether your controls are working over time.
27s 27 · WHS Act 2011 (NSW)

Officer due diligence

Directors and senior managers must exercise due diligence to ensure the organisation complies with its duties, including verifying that the resources and processes for managing psychosocial risk exist and are actually used. The duty is personal to the officer.

Where CaseNote fits De-identified program reporting gives officers a verification layer: coverage, response times and outcomes, without opening any individual's file.

What the consequences look like

Kozarov v Victoria
[2022] HCA 12 · common-law negligence

A solicitor prosecuting sexual-offence cases developed PTSD from the work. The High Court held that for roles like hers, the employer's duty required proactive steps, not a response after the injury had already appeared.

The Court Services Victoria prosecution
WorkSafe Victoria · sentenced October 2023

After a workplace suicide and findings of trauma exposure, role conflict and excessive workloads at the Coroners Court, Court Services Victoria was convicted under Victoria's OHS Act and fined $379,157, the maximum available, plus costs. A landmark Australian prosecution for psychological harm.

The cost of getting it wrong
Safe Work Australia · Key WHS Statistics 2025

Serious mental-health claims reached 17,600 in 2023-24 (preliminary), up 161 per cent over ten years. The median claim (2022-23) meant $67,400 in compensation and 35.7 working weeks away.

Work health and safety laws in every Australian state and territory require psychosocial risks to be managed; section 26A is a NSW addition on top. CaseNote's compliance layer is configured to your jurisdiction during onboarding. This page is general information, not legal advice.

The full picture, in a document you can hand to your executive.

File 05 Security & governance AES-256-GCM · Australia

The most sensitive record your organisation holds, treated that way.

Per-record encryption

AES-256-GCM with a separate key for every record, wrapped by a master key held in a secrets manager. A single compromised row stays a single row.

Role-based access, enforced low

Clinicians, supervisors, duty officers and peers each see only what their role permits. The filter is applied at the database query, not in the interface.

Strong authentication

Multi-factor authentication for every role with access to clinical data, short idle and absolute session timeouts, and full session governance.

Append-only audit trail

Every access and change is logged by field name, never by content, so the audit trail itself can never leak what it protects.

Tenant isolation

Each organisation runs in its own isolated environment with its own database and its own encryption keys. No co-mingled data, ever.

Australian data residency

The application and its databases are hosted in Australia.

Breach readiness, built in

A data-breach register aligned to the NSW Mandatory Notification of Data Breach scheme, with eligibility assessment and notification tracking, ready before it is ever needed.

Access anomaly detection

Scheduled checks watch for unusual patterns: mass exports, access at unusual hours, repeated denied attempts. Administrators are notified automatically.

Retention, enforced

Retention policies are applied automatically: expired records and their encrypted files are purged on schedule, so data you no longer need is data you no longer hold.

File 07 Register interest No obligation

Bring CaseNote to your people.

Tell us about your organisation and we'll be in touch about a pilot. No obligation.

We reply within two business days. No payment details, no obligation.

Protected by Cloudflare Turnstile · we'll never share your details · handled in line with the Privacy Act 1988.

Register for a pilot