Tracking potentially traumatic event exposure responsibly
A record of who was exposed to which traumatic events can be the most useful welfare tool an emergency service has, or the most feared. The difference is not the software. It is the purpose, the boundaries and the follow-through designed around it.
Why organisations track exposure
Most emergency service organisations already respond to major incidents: a debrief, a welfare check, an offer of support. What is harder to see is the accumulation of exposure for each person over time, and whether the organisation's response actually reached them. Tracking potentially traumatic event (PTE) exposure exists to answer three questions:
- Who has been exposed, to what, and how often?
- Did the organisation offer support, and was it followed through?
- Where is exposure concentrating across teams, locations and roles?
The cumulative trauma guide covers why accumulation matters. This guide is about building a system that does the job without causing harm of its own.
The December 2025 good practice principles
In December 2025, Natural Hazards Research Australia published Good practice principles for tracking potentially traumatic events exposure and organisational responses in emergency services (Report No. 49.2025). It was prepared by Phoenix Australia with AFAC representatives for Australian and New Zealand fire and emergency service agencies, and its principles are endorsed by AFAC. The guide is explicit that it is not prescriptive and not legally binding, and that evidence about the benefits of tracking systems is lacking. It also notes there is no evidence that tracking exposure alone improves workplace mental health, which is why a register has to sit inside a broader wellbeing strategy. It organises the topic under six elements:
| Element | The question it asks |
|---|---|
| 1. The primary purpose of a tracking system | What is the system for, how could it be misused, and how is its use bounded before it goes live? |
| 2. Design and implementation of the system | Is it fit for purpose and low burden for the people who feed it? |
| 3. What data is collected | Does it capture both the exposure and the organisation's response to it? |
| 4. How data is collected and stored | Is the information gathered appropriately and held securely? |
| 5. How data is analysed, reported and used | Does analysis lead to action, and is reporting aggregated and de-identified? |
| 6. Monitoring and evaluation of the system | Is the system itself watched, including whether its use stays within its purpose? |
The questions in the right-hand column are our paraphrase. Read the report itself before designing a system; the rest of this guide is practical advice organised around the same ground.
1. Write the purpose, and the prohibited uses, first
Before collecting anything, write a short scope statement that says what the register is for: offering support to people based on their exposure, and showing that the organisation followed through. Then list what it must never be used for. A useful starting list:
- performance review or capability assessment
- discipline or conduct proceedings
- promotion, role allocation or rostering decisions about an individual
- attendance management or surveillance
- fitness for duty or stand-down decisions driven by an exposure count.
Publish the statement to the workforce. People will feed an exposure register honestly only if they believe it cannot be turned against them.
2. Keep the burden low
A system that relies on exhausted people completing a form after a difficult job will have gaps exactly where it matters. Where possible, draw exposure from records the organisation already keeps, such as incident and dispatch records, and let a coordinator confirm who attended rather than asking each person to report. Make it quick to record a single severe event and easy to correct a mistake.
3. Collect the minimum, including the response
A workable minimum record for each exposure:
- the event, its date and a category or severity tag (for example a fatality, a child, a suicide)
- the people involved and, where relevant, their role at the event
- whether the exposure was direct or indirect
- the support offered, whether it was accepted, and the follow-up completed.
Do not put clinical detail in an exposure register. What a person said in a support conversation belongs, if anywhere, in a separate confidential record with tighter access.
4. Store it as sensitive information
Exposure and wellbeing records are sensitive. Handle them under the privacy law that applies to your organisation: the Privacy Act 1988 (Cth) for most private-sector organisations, or state legislation such as the Health Records and Information Privacy Act 2002 (NSW) for NSW public-sector agencies. In practice that means:
- access restricted by role, so that each person sees only what their job requires
- peer supporters kept away from clinical information
- encryption, Australian hosting where required, and an audit trail of who accessed what
- a retention period, and a process for people to request access to their own information.
5. Use it to act, and report without identifying people
An exposure record is only worth keeping if it changes what happens next. Link it to a response workflow: an exposure that crosses a threshold creates a task for a named person to make contact, and the contact is recorded. Review whether contacts are happening and how quickly.
Reporting to leaders should show patterns, not people: exposure by location, team or event type, coverage of support offers and follow-up completion. Suppress small groups (for example, fewer than five people), and also suppress enough neighbouring cells or totals that a hidden figure cannot be worked out by subtraction. Check reports against each other as well: two tables that are each safe can identify someone when read together. Suppression reduces the risk of identification; it does not remove it.
Treat any exposure score with care. Research shows cumulative exposure is associated with PTSD across groups, but exposure indexes identify individuals only poorly. The safest framing is the one we use in CaseNote: an exposure score is a prompt for a supportive conversation, not a verdict.
6. Watch the system itself
Review at least annually whether the register is being used as the scope statement says. Look for signs of drift, such as requests to use exposure data in HR processes, unusual access or exports, and falling trust in the workforce. Ask the people being tracked what they think of it. Amend the scope statement through a governance process rather than letting use expand quietly.
A short design checklist
- Is there a written purpose and a list of prohibited uses, shared with the workforce?
- Does exposure come from existing operational records wherever possible?
- Does each record capture the response as well as the exposure?
- Is clinical detail kept out of the exposure register?
- Is access role-based, audited and encrypted?
- Does a threshold create a task for a named person, and is completion tracked?
- Does leadership reporting suppress small groups, including figures that could be recovered by subtraction?
- Is use reviewed against purpose at least once a year?
Where CaseNote fits
CaseNote was designed around this problem. It builds exposure from incident records, records the organisation's response alongside the exposure, keeps peer supporters out of clinical detail with server-side access controls and clinical-field redaction, and logs every access in an append-only audit trail that records field names rather than content. Its scope statement confines exposure data to member support. We have mapped CaseNote against all six elements of the good practice principles; that mapping is our own self-assessment and does not imply endorsement by any of the publishing bodies.
Related guides
- Cumulative trauma in emergency services
- First responder mental health statistics
- Psychosocial hazards at work
Sources
- Howard A, Pedder DJ, Watson L, Savic A, Huckvale K, Sadler N. Good practice principles for tracking potentially traumatic events exposure and organisational responses in emergency services: A guide for fire and emergency service agencies. Prepared for Natural Hazards Research Australia by Phoenix Australia; principles endorsed by AFAC. Report No. 49.2025, December 2025.
- Safe Work Australia, Model Code of Practice: Managing psychosocial hazards at work (July 2022).
- Geronazzo-Alman L, Eisenberg R, Shen S, et al. Cumulative exposure to work-related traumatic events and current post-traumatic stress disorder in New York City's first responders. Comprehensive Psychiatry 2017; 74: 134-143.
- Privacy Act 1988 (Cth).
- Health Records and Information Privacy Act 2002 (NSW).
This guide is general information, not legal, clinical or professional advice. Check current legislation and guidance with the relevant regulator, and seek professional advice for your circumstances. CaseNote is not affiliated with, or endorsed by, any organisation named in this guide.