Whistleblowing under the new Aged Care Act: what boards and executives need to know

Sections 165-40 to 165- 60 of the Rules require every registered provider to operate an integrated ’whistleblower system’ that goes beyond simply having a policy on file. The system must: 

• Welcome anonymous oral or written disclosures to any aged care worker, responsible person of the approved provider, or the approved provider itself. This means that anyone – staff, contractors, volunteers, or even family members – can raise concerns without fear of being identified if they choose anonymity.
• The complaint can be made orally or in writing.
• Protect the confidentiality of the discloser and any person named in the disclosure.
• Information must be handled securely, and identities must only be revealed if required by law or with consent.
• Provide active support and fair treatment to the discloser and anyone at risk of detriment. This includes ensuring that no one suffers reprisals, victimisation, or discrimination for speaking up.
• Publish a whistleblower policy and give the policy to individuals to whom the provider provides services and any other person upon request.
• The whistleblower system must be reviewed, at minimum, annually to ensure it remains effective and compliant with evolving legal requirements. 

Training is compulsory for all workers and responsible persons. This training must cover how to recognise protected disclosures, handle personal information and data, understand escalation pathways and appreciate the penalties for breaching confidentiality. 

Providers must communicate regularly, at least monthly, to aged care workers and responsible persons and persons that qualify for protection that protected disclosures are encouraged and supported (section 165-40(f)). This ongoing communication helps reinforce a culture of openness and safety. 

A significant innovation in the new Act is the dual pathway for managing disclosures. 

The Rules allow a whistleblower to elect to have their disclosure managed under the complaints and feedback regime (s.165-35(3)), rather than the whistleblower stream.

This means that your organisation’s systems must include a clear triage process to determine, in consultation with the discloser where possible, whether an issue should proceed through the whistleblower stream (which prioritises anonymity and statutory protections) or the complaints stream (which emphasises open disclosure, consumer involvement, and restorative practices). 

Whistleblower policies should have a decision tree and flow chart.

Aged Care providers must also take reasonable steps to tell any other person involved in the resolution of any issue raised by the initial feedback how the feedback can also be given to the Aged Care Complaints Commissioner, within the Aged Care Quality and Safety Commission.

For example, a staff member who reports suspected financial misconduct may wish to remain anonymous and access whistleblower protections, while a resident’s family member raising concerns about care quality may prefer the complaints process, which allows for direct involvement in resolution. Documenting the rationale for the chosen pathway is essential for transparency and accountability and helps ensure that all parties understand their rights and the process. 

The dual pathway under the Aged Care Act is in addition to a whistleblower complaints pathway under the Corporations Act for large proprietary companies and public companies, including public companies limited by guarantee.

Section 165- 55 sets a high bar for what must be included in your whistleblower policy. A compliant policy must:

• Clearly explain the effect of Part 5 of Chapter 7 (whistleblower protections), so that staff and consumers understand their rights and the protections available.
• List all internal and external channels for making disclosures, including the provider’s own reporting mechanisms, the Aged Care Quality and Safety Commission, the Police and an independent aged care advocate.
• Describe the processes for investigating disclosures.
• Outline the protections available and how fair treatment of anyone named in a disclosure will be ensured and support for those who may be subject to allegations.
• Set out what a discloser can do if they believe the Act has been breached, including escalation options and access to independent advocacy. 

The policy must be published in an accessible format, translated into other languages or alternative formats as needed, and distributed to consumers, their supporters, and anyone who requests it. This mirrors the transparency obligations for complaints information and ensures that everyone in your community knows how to access and use the whistleblower system. 

For public companies limited by guarantee and other entities already subject to s.1317AI of the Corporations Act, the new requirements mean your whistleblower policy must now satisfy both the Aged Care Act and the Corporations Act. 

While there is overlap, there are also key differences. 

The Aged Care Act introduces aged-care-specific protections, broader access for consumers and their supporters, and more frequent communication obligations (such as monthly staff notifications and consumer access to the policy). 

The Corporations Act focuses more on corporate misconduct and financial wrongdoing. 

To avoid confusion and ensure compliance, it is recommended to develop a single, integrated ‘hybrid’ policy that references both Acts and clearly explains the different types of disclosures, protections, and processes. This approach streamlines training, communication, and reporting, and helps foster a unified culture of transparency and accountability.