In December 2024, Parliament passed the new Aged Care Act 2024 (Cth) (Aged Care Act) in response to various recommendations from the Royal Commission into Aged Care Quality and Safety, as well as the Final Report of the Aged Care Taskforce.  Amongst the changes and additions to aged care legislation, the Aged Care Act brings with it changes to whistleblower protections (referred to simply as ‘disclosures’ under the current Aged Care Act 1997 (Cth)).
 
This EMA Note describes the new protections and how they interact with whistleblower protections set out in the Corporations Act 2001 (Cth).

---

The new Aged Care Act does not take effect until 1 July 2025.  This EMA Note covers only the new whistleblower protections under the Aged Care Act, but these are not the only changes which will be coming into effect.  Aged Care providers should ensure they are aware of and prepared for any changes to their obligations under the new legislation.
  

The New Whistleblower Protections

The new whistleblower protections apply when all of the following are satisfied: 

1. a disclosure is made to one of the following bodies:
   1. a Commissioner or Complaints Commissioner of the Aged Care Quality and Safety Commission (Commission), or any member of the staff of the Commission;
   2. the Secretary or an official of the Department of Health and Aged Care;
   3. a registered provider;
   4. a ‘responsible person’ of the registered provider (which means particular people, depending on the type of registered provider);¹[1]
   5. an aged care worker of a registered provider;
   6. a police officer; or
   7. an independent aged care advocate;
       
2. the disclosure is made orally or in writing (which may be anonymous); and
    
3. the person making the disclosure has reasonable grounds to suspect that the information disclosed indicates that the entity may have contravened a provision of the Aged Care Act.

Notably, unlike the protections available under the current Aged Care Act 1997, the new provisions do not appear to protect a disclosure to be made to any person authorised by a registered provider to receive disclosures on its behalf—only the above-described persons.
 
Protections
 
Where a person makes a disclosure which is protected by the Aged Care Act, they may not be subject to any civil, criminal, or administrative liability (or any claims for contractual remedies) in relation to the disclosure.²[2]
 
A recipient to a disclosure must, if the person making the disclosure wishes to remain anonymous, take steps which are reasonable in the circumstances to preserve the anonymity of that person.  If the person names others in the disclosure and requests that they also remain anonymous, the same obligation applies.
 
Disclosing the identity of the discloser—or any information likely to lead to the identification of the discloser—may result in civil penalties.  There are some exemptions to this, such as where the identity of the discloser is made to staff of the Commission, a police officer, or a legal practitioner for the purposes of seeking advice.  There are other exemptions, but an individual should seek legal advice before disclosing the identity of a person making a protected disclosure (or disclosing information that would likely lead to the person being identified) to ensure they do not breach the provisions of the Aged Care Act.
 
Neither a person making a protected disclosure, nor any entity which employs or is associated with that individual, may be victimised because it believes or suspects that the person has made, or intends to make, a protected disclosure.  Breaching this may result in significant civil penalties.  Victimisation includes causing a detriment and threatening to cause a detriment.  There is an exemption to this, though legal advice should be sought before engaging in any conduct which could create a detriment to a person making a disclosure or an entity that employs or is associated with them.
  

Interaction with Whistleblower Protections under the Corporations Act

There may be some circumstances where a disclosure could fall within the scope of both the Corporations Act and the Aged Care Act.  For example, a disclosure about conduct which breaches the Aged Care Act and carries a penalty of imprisonment for 12 or more months could fall within the scope of both.
 
In general, these whistleblower protections should be treated as entirely separate to the whistleblower protections under the Corporations Act.  Those protections apply to disclosures about different types of conduct, made to different entities, and carry different obligations, protections, and exemptions.  If an individual makes a disclosure in accordance with the Corporations Act, the Corporations Act procedures (with the relevant obligations and protections) should be followed; and if the individual makes a disclosure in accordance with the Aged Care Act, the Aged Care Act procedures (and its obligations and protections) must be followed.
 
We note that some state or territory laws may also provide certain whistleblower (or whistleblower-like) protections in relation to specific entities.  If you are unsure what laws may apply to you, you should seek specialist advice³.
  

A Whistleblower Policy

The Aged Care Act does not require regulated entities to have a whistleblower policy (unlike the Corporations Act, which requires certain types of entities to have a whistleblower policy that covers off specific information).  However, the Aged Care Act does require an entity to take reasonable steps to ensure it—and its workers, etc—complies with the entity’s obligations in relation to whistleblower protections.
 
Given this requirement, and given the potential confusion that could arise given the two different types of whistleblower protections, we recommend aged care providers have a whistleblower policy covering the new protections under the Aged Care Act.  If you are required to have (or otherwise have) a current whistleblower policy dealing with the Corporations Act’s whistleblower protections, we recommend either:
  

1. you keep two separate policies, one dealing with each of the different types of protections; or
    
2. if you would prefer to have all whistleblower matters dealt with in one policy, the protections and obligations under each act are clearly separated.

 
If you have a current policy which deals with disclosures made in relation to your entity’s serious incident response scheme (under the current Aged Care Act 1997, you will need to review that policy to ensure that when the changes come into effect on 1 July 2025, the policy is consistent with the new rules.
 
EMA Consulting is in the process of developing a template whistleblower policy for aged care providers to be available before the new changes come into effect.  Subscribers to My ERLibrary will be able to access this template as a part of their current subscription and will be notified when it is available for download.

Require further information/assistance?

This EMA Note is not comprehensive advice about your situation and does not cover all your obligations. If you require further information or advice, please contact your Consultant.

1. As defined at section 12 of the Aged Care Act 2024 (Cth). ↩︎
2. The individual may still be subject to liability for conduct revealed by the disclosure. ↩︎
3. There may also be additional whistleblower protections under some federal laws, such as under taxation law. ↩︎