Last updated: 28 July 2021 at 12:21pm
Which businesses are required to maintain a contact register?
The following businesses are required to maintain contact registers for WA Health Department COVID-19 contact tracing, if needed:
- food and licensed venues (restaurants, takeaway services, food courts, cafés, bars, pubs, taverns, nightclubs)
- retailers (supermarkets, department stores, pharmacies, hardware and general retailers) and the retail components of other businesses (bank branches, post offices, manufacturing showrooms)
- gyms, indoor sporting centres, wellness centres, health clubs and fitness centres
- indoor play centres
- saunas and bathhouses
- swimming pool, both indoors and outdoors
- places of worship, and funeral parlours
- beauty and personal care services (hairdressers, barbers, nail salons, tattoo parlours, spa and massage parlours)
- galleries and museums
- cinemas, theatres and other entertainment venues (casino, gaming or gambling venues)
- motor vehicles or boats which are capable of carrying 12 or more passengers and is used on a commercial basis for a party, tour or function
- auction houses and real estate inspections
- community facilities, libraries and halls
- zoos and amusement parks
- function centres
- hotels, motels, campgrounds or other accommodation facilities that ordinarily have check-in arrangements
- boarding schools or residential colleges (not including residents)
- adult entertainment premises (strip clubs, brothels and sex on premises venues)
- venues where events are held and certain outdoor functions and gatherings under 500 people (e.g. weddings, corporate functions, carnival, fetes, festivals, markets, funerals/memorial services).
- public and private hospitals (visitors only – persons visiting patients or attending meetings/lectures, couriers, and contractors)
- airport terminals
Refer to the Contact Register Directions (No 3) for a more detailed list of particular businesses and venues.
How do I register contacts — which modes of registration are acceptable?
It is up to you how you collect this information, provided you collect the necessary details (name, phone number, date and time someone enters the premises). The 3 most common options are:
- WA Government’s SafeWA app, which provides an easy, safe and efficient digital contact register system. Use of this app is encouraged, and endorsed by WA Health.
- Paper register – suggested formats and templates are available to assist you.
- Electronic-based register e.g. a form on a tablet at the front of your business.
When you use SafeWA or an electronic-based register, you must also have a paper register to ensure access to your premises is inclusive and allows patrons that cannot or choose not to use SafeWA to check-in.
Information collected for contact tracing purposes including through electronic contact registers and paper registers must be stored securely for 28 days, unless you are notified that you must retain the information for a longer period for contact tracing purposes. Once that 28-day period is up, businesses need to destroy the records as soon as practicable. This means taking all reasonable steps to ensure that the information cannot be retrieved.
If you use your own QR code for your contact register, you are also required to provide the SafeWA QR code as an option for patrons, ensuring that the SafeWA QR code and branding is clearly identified.
SafeWA is the quickest and easiest way for WA Health to access information for contact tracing.
Businesses may choose to use other electronic sign-in methods of registration. If they use an electronic system different to the SafeWA contact register app or a paper register, they will need to ensure the method they choose complies with the legal requirements.
What information do I need to record in a contact register?
The contact register must record the name, contact telephone number, location, date and arrival time of patrons.
Do I need to record the details of everyone that visits my premises?
You are required to request the contact details of each person that appears to be aged 16 years and over who enters a place listed above, including patrons, staff, volunteers and contractors.
Records are not required to be collected for:
- children under 16 years;
- people entering for medical or emergency purposes;
- people who enter a boarding school or residential college if they reside there; or
- people entering a premises used to accommodate staff of a mining site (including mining site accommodation) if it is only open to and used by those staff.
Unaccompanied children under 16 are encouraged but not required to register. Adults accompanying children under 16 are encouraged to register for them.
Who is responsible for maintaining the contact register?
The occupier or other person in charge of a place is required to maintain a contact register.
For example, the occupier or other person in charge of a restaurant will be required to maintain a register of anyone entering the premises.
If a local hall is hired for a function, the occupier or other person in charge is responsible for maintaining the register for the period of the function.
How does the SafeWA app contact register work?
- Businesses download the SafeWA app through the Apple or Google Play App Store and register their venue(s). They will then receive a welcome pack which includes supporting information and a unique QR code for each venue.
- The business can print hard copies of the QR code on posters that are placed in the premises and/or use an electronic device (such as a tablet) to display the QR code.
- When a patron arrives at the businesses’ premises, they use the SafeWA app, if they have downloaded it, to scan the QR code.
- The smartphone reads the code, and they will be checked-in and see a confirmation on their device.
- Through the check-in process, the patron’s name and telephone number as well as the date and time they attended the venue, are collected and stored in the WA Health database.
- A staff member at the premises may choose to check the successful sign-in on the patron’s phone.
SafeWA is accessible only if you have a compatible smartphone. SafeWA is compatible with Apple iPhone model 5S (and later) with iOS 9.3 (and higher), plus most Google Android mobile devices running Android 5.0 (and higher).
How is the data stored on the SafeWA app?
Data is encrypted at the point of capture and stored securely for 28 days. If required for contact tracing purposes, it can be stored for a longer period.
How many people can I register for my business as administrators of the app?
Businesses are attached to a person’s individual account when they create a business account on the SafeWA app. Only one person can be an administrator.
If you need to change the administrator of your business account, you need to have it removed from your account and get it attached to another individual’s account. To do this, please call 13 COVID (13 26843).
Do I need to record contact details of my staff?
Yes. You are required to record the contact details of your staff, and any volunteers or contractors. This can be in the form of staff records, such as a roster, as long as it captures the required information.
Does the SafeWA app have a confirmation screen that staff at a venue can check to ensure patrons have scanned the QR code on entry? If so, are staff obliged to check this has been done?
If patrons use the SafeWA app to check-in at a venue, a confirmation screen will appear on their device once they have successfully checked-in.
The occupier or person apparently in charge of a business is required to request the contact details of each person that enters their premises, but are not required to verify or confirm the accuracy of the information provided.
Where possible, other staff are encouraged to ensure patrons have checked-in either through the SafeWA app or the venue’s contact register.
Am I able to use my own QR code system that I have set up for my business?
The WA Government strongly encourages the use of the SafeWA App. If you use your own QR code system to register patrons, you must:
- Comply with the use, disclosure, storage and destruction requirements of the Protection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021 and the Contact Register Directions (No 3). Note, this doesn’t apply to multi-use registers where the information otherwise would have been captured through ordinary course of business.
- Provide SafeWA as an option for patrons, and clearly identify and display it next to your own QR code.
- Be able to produce contact information in response to a request from the responsible officer and an authorised officer, and otherwise meet the requirements of the Contact Register Directions (No 3).
Where do I put the QR code at my business?
Your QR code should be displayed in a prominent position at your premises where your patrons can easily view and scan the code, preferably at the entrance/s.
You may display the QR code in multiple locations to make it easy for your patrons to check-in, for example at the entrance/s to the premises and at the service counter.
What happens if patrons visiting my premises don’t have a smartphone that supports using the QR code system?
For this reason, you are also required to provide a paper register for patrons to provide their contact details in case they cannot or choose not to use the SafeWA app. A template for a written contact register form is available on the Contact registers stakeholder toolkit page.
Privacy and compliance
How do I store contact information and protect the privacy of patrons?
Where your business keeps paper or electronic records, you are required to protect (using reasonable steps) patrons’ contact details from misuse or loss, and unauthorised access, modification or disclosure. The WA Government has developed a suggested format for paper-based contact registration that involves placing completed paper slips into an enclosed container. Businesses should ensure registration details are kept out of the view of other patrons.
This information must be securely stored for 28 days, unless required for longer for contact tracing purposes. After that 28-day period, the records must be destroyed as soon as reasonably practicable.
What happens if my business does not maintain a contact register? What are the penalties?
Not having a contact register may put the Western Australian community at risk, as it will slow the process for contact tracing if a COVID-19 affected patron visits your premises.
Businesses that put the community at risk in this way risk penalties under the Emergency Management Act 2005, including a fine of up to $50,000 for an individual and $250,000 for a body corporate, or 12 months’ imprisonment. Infringement notices can also be issued.
Penalties also apply to businesses for:
- not providing a record of the contact information within three hours of a request made by a responsible officer
- not being able to produce a record of the contact information for inspection by an authorised officer on request for the purpose of checking compliance with the contact register requirements
- using or disclosing contact information for purposes other than contact tracing, unless permitted by law or if a person expressly provided their contact details for other purposes.
Individual patrons can also face penalties for:
- providing false information in connection with the provision of their contact details
- entering and remaining at a place after being requested to provide contact details and refusing to provide these details.
There are also penalties for failing to comply with obligations under the Protection of Information (Entry Registration Information Relating to COVID-19 and Other Infectious Diseases) Act 2021. That act contains obligations around the use, disclosure, storage and destruction of information. Businesses should ensure that they are aware of their obligations under this Act.
How will compliance be checked?
Authorised officers may inspect premises to monitor compliance with contact register requirements. Where information has been provided directly (e.g. on a paper register), a business must produce a record of the contact information for inspection by an authorised officer on request for the purpose of checking compliance with the contact register requirements.
A business should only disclose contact registration information for purposes related to contact tracing. There are penalties for providing this information for any purpose other than contact tracing.
Am I responsible for ensuring contact information provided by patrons is accurate?
There is no requirement for businesses/occupiers to verify the accuracy of contact details provided.
What if patrons refuse to provide contact details?
Individuals can face penalties of up to 12 months’ imprisonment or fines of up to $50,000 for entering a premises after refusing to provide their contact details.