For the people accountable for the system

Psychosocial risk needs more than a policy on the intranet.

NSW organisations already had duties to manage psychosocial hazards. Since 1 July 2026, section 26A of the Work Health and Safety Act 2011 (NSW) has changed the status of approved codes of practice.

CaseNote helps turn part of that obligation into something operational: identify risk, respond, follow up and retain evidence of what happened. It does not replace the controls an organisation must put around work design, workload, change or other organisational hazards.

Read the section 26A readiness briefing →

The questions your security team will ask

Sensitive information deserves straight answers.

How is the information protected?

Every record is encrypted with AES-256-GCM using a separate key per record, wrapped by a master key held in a secrets manager.

Can the wrong person see this?

Clinicians, supervisors, duty officers and peers each see only what their role permits. The filter is applied at the database query, not in the interface.

Strong authentication

Multi-factor authentication for every role with access to clinical data, short idle and absolute session timeouts, and full session governance.

Can we tell who looked at a record?

Every access and change is logged by field name, never by content, so the audit trail itself can never leak what it protects.

Does our data sit beside somebody else's?

Each organisation runs in its own isolated environment with its own database and its own encryption keys. No co-mingled data, ever.

Where is the application data?

The application and its databases are hosted in Australia.

Breach readiness, built in

A data-breach register aligned to the NSW Mandatory Notification of Data Breach scheme, with eligibility assessment and notification tracking, ready before it is ever needed.

Access anomaly detection

Scheduled checks watch for unusual patterns: mass exports, access at unusual hours, repeated denied attempts. Administrators are notified automatically.

Retention, enforced

Retention policies are applied automatically: expired records and their encrypted files are purged on schedule, so data you no longer need is data you no longer hold.

This page is general information about work health and safety obligations, not legal advice. CaseNote is an independent product and is not affiliated with, or endorsed by, SafeWork NSW, Safe Work Australia, Phoenix Australia, AFAC, Natural Hazards Research Australia, Beyond Blue or any emergency service organisation. Statistics and case outcomes are drawn from the published sources named on this page: NSW legislation (legislation.nsw.gov.au), Safe Work Australia's Key WHS Statistics Australia 2025, WorkSafe Victoria, and Beyond Blue's Answering the Call (2018).