Section 5: How do I manage my Child Link Users?

Your responsibilities as a Child Link Authoriser include:

• Ensuring staff who are nominated to be Child Link Users must complete required training on information sharing and MARAM prior to the authorisation occurring.
• Ensuring your Child Link Users comply with the Child Link Secretary’s Guidelines, the Terms of Use of Child Link and any Child Link User practice guidance. Note: Your organisation may also have specific operational processes for Child Link that you and your Users should follow.
• Reviewing and confirming whether your Child Link Users should have their Child Link access maintained or removed every 4 months. This is called the User Access Review (UAR).
• Removing Child Link access when staff resign, change roles, take extended leave, or go on secondment.
• Removing Child Link access and immediately notifying the Department of Education if you believe staff no longer have a WWCC or VIT registration. See Notification process for details.
• Notifying the Department of Education if you form a view that a Child Link User in your service should have their access investigated, with the potential to restrict that Child Link User’s access. See Restriction of a Child Link User’s Access for details.

As an Authoriser, you may request access to information about how your Child Link Users have been using Child Link. You may also be asked to determine if a User’s usage patterns align to the expectations for the person’s role.

How to manage your Child Link Users’ accounts

Follow the steps below to view the status of your Child Link Users and manage their accounts.

1. Select 'Authoriser Home' from the menu.

2. Select 'Manage users' to display the details of all the Users you have invited to Child Link.

3. The next screen shows the details and status of all the people you have invited to Child Link.

Note: all details in these examples are entirely fictional and have been created for illustrative purposes only.

Users listed under the ‘Invitations’ heading have not completed all the steps to validate their accounts.

If their User card says they have been invited, the User has not yet clicked the link to register their Child Link account.

If their User card says ‘Incomplete’, the User has not completed all the steps required to validate their account. You can view what steps a User has completed by selecting their User card (see number 4 below).

All Users listed under the 'Active users’ heading have completed all the steps required to register and validate their account.

4. Hover your mouse over a User card in the Invitations section to reveal a menu with options to manage the User's details, resend an invitation or cancel an invitation. Select 'Manage details' to manage the User details.

5. The next card will display the invited Users' details and status.

You can also hover your mouse over a User card in the Active Users section to reveal a menu with an option to ‘manage details’ or ‘manage services’.

How to update an Active User's details

You can easily update the name of a Child Link User under your authorisation at any time to ensure it matches with the name on their WWC Clearance or VIT Registration.

1. Select Authoriser Home from the left-hand menu, and then select ‘Manage Users’.
2. Hover your mouse over the relevant User card.
3. Click ‘Manage details’ option and then select the ‘edit’ button to initiate the update.

4. Enter the User’s first name and last name, ensuring that it matches with the name on their WWC Clearance or VIT registration.

Once completed, you will see the following pop-up window to confirm the name of your User has been updated successfully.

How to manage services for an Active User

You can easily add or remove access entitlement to a service for Child Link Users under your authorisation at any time by using the ‘Manage services’ function.

How to Manage all Services

The ‘Manage All Services’ function allows Authorisers to manage individual services by adding and removing users from that service.

For a selected service, a list of users will be displayed with the option to add user, remove user or cancel invitation. These actions can be performed on individual users. Add user is also available with multi select option.

Requesting Child Link User activity information

It is the responsibility of Authorisers to remove User access in circumstances where the access is no longer appropriate.

To support Authorisers to carry out this responsibility and if the Authoriser suspects concerning behaviour, you may request access to usage activity information. The usage information may include:

• date and time the User has accessed Child Link
• date and time the User has accessed Child Link to view information about a particular child or children
• frequency that the User has accessed the information about a particular child or children
• specific searches related to a particular child or children that the User has completed (including searches of last name and age).

An investigation may occur where a User's access or usage is detected that varies from anticipated behaviour. This may require Authorisers working with the relevant User(s) to verify usage behaviour against their Child Link User purpose for access and associated professional activities.

Authorisers can complete the Child Link User Activity Information Request Form found in the Practice Guidance and email the form to requests@childlink.vic.gov.au with the subject line ‘Child Link User Activity Information Request Form’.

User Access Review process

Child Link conducts a User Access Review (UAR) every 4 months.

You will receive an email advising you that you must review all the Child Link Users under your authorisation and decide if you should maintain or remove their Child Link access.

You have a 2-week window to complete your review. You may log in to Child Link as many times as you need to re-certify your Users within your 2-week window.

If you do not complete the review within the required period, your Users’ Child Link accounts will be locked, and they will not be able to access Child Link until the review is completed.

You will be prompted to perform the UAR when you log in to Child Link during the UAR time frame. You will continue to receive a prompt every time you log in to Child Link until you have completed your review. For more information, refer to the Authoriser Roles and Responsibilities guidance in Child Link.

Removing Child Link User access

You must remove a Child Link User’s access at any time it is not appropriate for their access to continue.

This is a critical part of your role as it is essential to maintaining the security of the sensitive information on Child Link.

For example, you should remove a User from Child Link when they:

• leave their organisation
• no longer require access to Child Link, for example:
  • if they move into a new role in their organisation that does not require access to Child Link
• change roles within their organisation and require authorisation to Child Link for another purpose
• change roles within their organisation and require authorisation to Child Link under a different Authoriser
• no longer meet the prerequisites to be a Child Link User, for example:
  • if they no longer hold a valid WWCC
  • if they no longer hold a valid VIT registration.
• are no longer in circumstances where it is appropriate to have access to Child Link, for example, if a conflict of interest or misconduct has been evidenced
• pose an unacceptable risk of harm to any person if they access Child Link
• meet the criteria for restriction of access. See Restriction of Child Link User’s access for details.

You must also immediately notify the Department of Education if you reasonably believe your User no longer holds a valid WWCC or valid VIT registration. See Notification process.

What if a User goes on secondment or takes extended leave?

You should remove a User from Child Link if they will not need to access Child Link for 90 days or more.

Examples include when a User:

• changes roles for 90 days or more within the organisation, such as a secondment
• takes extended leave, such as long service leave, parental leave, or a sabbatical for a period greater than 90 days.

In these instances, you will need to add the User back to Child Link when they return to their role.

Re-adding Users to Child Link

Users will not need to re-complete Child Link training if they are re-added to Child Link within 12 months of the date they were removed.

They will be able to use the training receipt number from their original training certificate to set up their new account.

For Users who have been removed from Child Link for a period of longer than 12 months, it is recommended that they complete training again before being reinvited to Child Link.

How to remove a User from Child Link

1. Log in to Child Link.
2. Select 'Authoriser Home' from the menu.

3. Select 'Manage users'.

4. Hover the mouse over the specified User to reveal a menu, select 'Manage services'.

Note: all details in the examples are entirely fictional and have been created for illustrative purposes only.

5. Select 'Remove service' for all listed services.

Once all services associated with a User are marked as 'inactive', the User account will also become inactive and the User can no longer access Child Link.

Automatic offboarding process for inactive Users

Child Link Users who have been inactive for more than 60 days will have their access removed. Child Link Users will receive email advice that their accounts will be removed unless they log in to Child Link. You will be copied into any emails that are sent to your Users for this purpose.

Removing access for inactive Child Link Users is an important safety measure and supports the security of the information held in Child Link.

If your Child Link Users continue to be in a role that is eligible to access Child Link and still need access, they need to log in to Child Link to prevent their access being removed. Logging in includes entering their Child Link User credentials and accepting the sensitivity agreement. If the User does not log in to Child Link within the period stated in the email their access will be removed.

The email advice provides Child Link Users with instructions on what action they need to take.

What to do if your Users’ access is removed due to inactivity

If a Child Link User continues to be in a role that is eligible to access Child Link and still needs access, you will need to reissue them with an invitation to Child Link and they will need to start the registration process again.

You can do this from the 'Authoriser Home' menu by selecting 'Add new user'.

Users will not need to re-complete Child Link training and can use the same training receipt number from their original training certificate.

Restriction of a Child Link User’s access

If the Department of Education becomes aware that a User’s access to Child Link may cause a risk of unacceptable harm to a person or be otherwise inappropriate, the User’s access to Child Link will be immediately restricted.

You must notify the Department of Education if you believe a User should have restricted access to Child Link, or if you believe a User from your service no longer holds a valid WWCC or VIT registration.

For example, the Department of Education will immediately restrict a User’s access to Child Link if it becomes aware that:

• the User has been investigated under the Reportable Conduct Scheme, and the investigation has been substantiated
• the User is currently charged with, or has been convicted or found guilty of having committed an offence under the Child Wellbeing and Safety Act 2005 (the CWS Act)
• the User has a WWCC exclusion or interim exclusion, or their WWCC has been suspended or revoked
• the User’s VIT registration has been suspended or cancelled
• a serious concern has been raised about the User through Child Link auditing and/or monitoring process notifications
• the User is currently charged with, convicted or found guilty of an offence involving:
  • physical or sexual harm or threats of physical or sexual harm
  • violence or threats of violence
  • dishonesty
  • neglect in Victoria or
  • an equivalent offence in another area.

Once a decision has been made, you and the User will be notified of the outcome. The User will have an opportunity to request a review of the decision if appropriate.

Notification process

If you believe a User’s access to Child Link should be restricted, you are encouraged to complete the Restrictions Request Form available in Child Link. You must only email the form to restrictions@childlink.vic.gov.au, which is a secure site; and you must have the subject line ‘Restriction’ in the request email.