Healthcare & Care Information Privacy

1. Why Healthcare Privacy Matters

Care is built on trust. Families may need to share information about a person’s health, daily activities, mobility, medication routines, medical appointments, recovery, or need for assistance.

Such information should be handled only for appropriate purposes and shared with people who are authorised to receive it.

WARA’s approach to healthcare and care information privacy is guided by five principles:

• Respect: Treat every person receiving care with dignity and respect.
• Confidentiality: Protect sensitive information from inappropriate disclosure.
• Purpose: Use information for a clear, legitimate care-related purpose.
• Appropriate access: Make information available only to people who need and are authorised to receive it.
• Accountability: Establish clear responsibilities for handling information and addressing privacy concerns.

These principles guide the design and delivery of WARA’s care services. Specific practices depend on the service arrangement, applicable law, and safeguards actually in place.

2. What Information May Be Involved?

Depending on the care requested and the arrangements agreed with the family, relevant information may include:

Not every service requires every category of information. WARA should seek only information reasonably necessary for the relevant purpose and handle it in accordance with applicable requirements.

3. Consent, Choice and Authorised Representatives

Where consent or another lawful basis is required, information should be collected, used, or shared on that basis.

A family member arranging care for an older adult does not automatically have unrestricted authority over that person’s information.

Where appropriate, WARA should establish:

• Who is receiving the care.
• Who is authorised to make decisions or provide instructions, where relevant.
• Which family members or other contacts may receive updates.
• What information may be shared and for what purpose.
• How preferences, consent, or authorisations can be changed, subject to applicable law.

The wishes, dignity, privacy, and decision-making rights of the person receiving care should be respected. Where a person cannot make a particular decision independently, the applicable legal requirements for representation and decision-making must be followed.

4. Sharing Information for Coordinated Care

Coordinated care sometimes requires information to pass between family members, care workers, coordinators, doctors, hospitals, diagnostic providers, or other service partners.

Information should be shared only when there is an appropriate purpose and a lawful basis or other valid authority for doing so.

Depending on the agreed service, this may involve:

• Giving a care worker the instructions necessary to perform assigned activities safely.
• Sharing relevant observations with an authorised care coordinator.
• Helping an authorised family contact understand agreed care activities or follow-up needs.
• Coordinating appointments, referrals, diagnostic services, or hospital-related arrangements.
• Communicating relevant information to an appropriate healthcare professional when required for care.

Being involved in a person’s care does not automatically entitle every participant to access all their information. Access should be limited to what is appropriate for the person’s care, the participant’s responsibilities, and applicable requirements.

5. Privacy Across WARA’s Four CareNets

WARA’s care model has four distinct service areas. Each may involve different information and access needs.

ElderCareNet

May involve agreed check-ins, relevant observations, care-related concerns, reporting, and communication with authorised family contacts.

The information shared should be proportionate to the agreed service and the person’s privacy preferences.

HomeCareNet

May involve information needed for daily physical assistance, personal care, mobility, meals, routines, and other agreed activities at home.

Sensitive details should be handled respectfully and disclosed only as appropriate to the task and the person’s circumstances.

HealthCareNet

May involve healthcare appointments, referrals, diagnostic coordination, relevant medical information, and clinical follow-up arrangements.

Clinical information should be shared with appropriate healthcare professionals and other authorised recipients for legitimate purposes. Clinical decisions remain the responsibility of qualified healthcare professionals.

AyushCareNet

May involve recovery plans, physiotherapy or rehabilitation arrangements, mobility goals, and relevant continuing-well-being activities.

Information should be handled according to the sensitivity of the information, the agreed service, and the responsibilities of the people involved.

A family may need more than one CareNet. The coordination of services should not mean unrestricted sharing of information across every service or participant.

6. Care Ledger and Care-Related Records

The WARA Care Ledger is intended to support visibility and accountability through structured records of agreed activities, relevant observations, service coordination, and follow-up.

Where this capability is available and included in the service arrangement, records should be maintained with appropriate attention to:

• Accuracy and relevance.
• The purpose for which information is recorded.
• Who may create, view, or update a record.
• Appropriate access by the person receiving care or authorised representatives, subject to applicable requirements.
• Retention, correction, and handling of records.
• Protection against unauthorised access, alteration, loss, or disclosure.

A care record is not a substitute for a medical record maintained by a healthcare provider, nor does it independently establish a clinical diagnosis.

The exact information recorded, access arrangements, and available record-management features depend on the service and the systems implemented.

Learn more about the [WARA Care Ledger](/care/ how-care-works/care-ledger/).

7. Family Updates and Remote Care

Families may arrange care for parents or other loved ones while living in another city or country. Agreed updates can help them understand how care is progressing and what may require attention.

Where family communication is included in a service arrangement, WARA should establish the designated recipients, the type of information to be shared, and the appropriate communication method.

Family updates should respect the privacy and lawful rights of the person receiving care. They should not automatically disclose every personal detail, observation, conversation, or healthcare record.

Read more about Care for Families Living Away.

8. Emergencies and Urgent Situations

An urgent situation may require relevant information to be shared with emergency services, healthcare professionals, or other appropriate responders.

Any such disclosure should be limited to what is appropriate and permitted or required under the circumstances and applicable law. Emergency situations may involve specific legal rules concerning consent and disclosure.

WARA’s care coordination framework does not itself guarantee emergency detection, immediate response, ambulance availability, hospital admission, or a particular outcome.

In an urgent or life-threatening situation, contact the appropriate local emergency service immediately. Do not wait for WARA.

See the Emergency Response Network for the intended coordination framework and its limitations.

9. Security, Access and Record Retention

Personal and health information requires safeguards appropriate to its sensitivity and the risks involved.

Depending on the relevant service and systems, appropriate safeguards may include:

• Access restrictions and role-based permissions.
• Secure handling and transmission of information.
• Appropriate authentication and account protection.
• Staff, worker, and partner confidentiality responsibilities.
• Procedures for managing suspected privacy or security incidents.
• Retention and disposal practices appropriate to the purpose and applicable requirements.

These are important safeguards for WARA to implement and maintain. This page does not, by itself, certify that every listed safeguard is already implemented across every service, partner, or system.

Information should not be retained indefinitely without an appropriate reason. Retention, deletion, and access requests must be handled in accordance with applicable legal requirements and any legitimate record-keeping obligations.

10. Indian Data Protection Law and HIPAA

WARA’s handling of personal and health information must be assessed against the laws and regulations applicable to its actual activities, the people involved, and the relevant service arrangements.

For services operating in India, this includes assessing applicable Indian data-protection requirements and other relevant laws.

What about HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) is a United States law governing specified aspects of protected health information for covered entities and their business associates.

HIPAA does not automatically apply to every organisation that handles health information. Whether it applies depends on the organisation’s role, the relevant relationships, and the circumstances of the service.

WARA should therefore not claim to be HIPAA-compliant merely because it follows healthcare privacy principles. Where a service or contractual relationship brings HIPAA obligations into scope, the applicable requirements must be assessed and addressed.

Privacy commitment: WARA aims to handle care-related information responsibly and transparently. Legal compliance and any specific certification or compliance claim must be supported by an appropriate assessment of the actual service, processes, contracts, and technical safeguards.

11. Your Privacy Questions and Concerns

If you are receiving care, arranging care for a family member, or acting as an authorised representative, you may contact WARA to ask about the information handled for the relevant service.

Depending on your role and applicable law, you may be able to ask about:

• What information is collected and why.
• Who may receive or access that information.
• How to correct inaccurate information.
• How to change a communication preference or withdraw consent where applicable.
• How information is retained or deleted, subject to legal and legitimate record-keeping obligations.
• How to raise a privacy concern or report a suspected inappropriate disclosure.

Requests may require verification of identity or authority to protect the person whose information is involved.

For privacy enquiries, use the contact details provided in the WARA Privacy Policy or the WARA Contact page.

12. How This Page Relates to WARA’s Privacy Policy

This page explains WARA’s approach to privacy in the context of healthcare, elder care, home care, recovery, and care coordination.

It is an explanatory page, not a replacement for the general Privacy Policy, a service agreement, a consent document, or a legally required privacy notice.

Please also read the WARA Privacy Policy for information about website and general personal-data handling.

Where specific services require additional notices, consent arrangements, contractual terms, or legally prescribed disclosures, those requirements should be addressed separately.

Care deserves trust. Information shared for care deserves respect.

WARA’s objective is to make coordinated care easier for families while respecting the dignity, privacy, and rights of the people receiving it.