Cocoon SDA Care: Employees say banned NDIS provider shared personal data with staff in Pakistan

Australian employees of disgraced NDIS company Cocoon SDA Care have revealed more alleged failures involving offshore staff that affected its ability to help clients.

EXCLUSIVE: Employees of disgraced NDIS company Cocoon SDA Care claim their personal data was shared and accessible to staff in Pakistan.

They also claim that participants’ sensitive information was available to staff working overseas, in particular a mysterious man called ‘Jack Miller’.

Out of hours calls were also diverted offshore, first to a team in the Philippines, and then to another in India, and was an “unmitigated disaster” because they didn’t understand how the NDIS worked, according to multiple sources.

Last week Cocoon’s parent company Horizon SolSolutions was permanently banned from working in the NDIS, along with the company’s sole director Muhammad Latif, following allegations that it made NDIS claims for prisoners and dead people and that some participants did not receive the correct supports outlined in their plans.

Horizon SolSolutions sole director Muhammad Latif. Picture: Julian Andrews

Mr Latif has said errors were made in a small number of cases, but it was not systemic.

Multiple sources have come forward to share concerns about the way the company operated, including that a Pakistani man who called himself Jack Miller onboarded staff, which involved them sharing their 100 points of ID.

“Everyone knew Jack Miller was not Jack Miller,” said one, who said they voiced concerns about the data being sent offshore. “Jack told us that was not his real name, but used it because people were uncomfortable with a foreign name.”

Another insider said access to payroll staff only came online everyday from 2pm Australian time.

Cocoon SDA Care's corporate strategist and ex-bankrupt Zaffar Khan promotes himself as an expert in business on a billboard at Lahore Airport, Pakistan. Picture: Supplied

“It was not uncommon for staff to be getting calls about payroll issues and emails at 7pm our time here in Australia,” they said.

Another said senior company staff were allegedly asked to email documents about participants to someone called Jack, who was part of an “audit” team.

“We figured out that he (Jack) was actually the team in Pakistan and they just had that one email which was where he signed his name Jack,” said one well placed source.

Meanwhile, multiple former employees said the out-of-hours call centre was a “24/7 nightmare” and calls were often not actioned or followed up.

“Service managers, who were not on call, often fixed the issues themselves, or went in and covered shifts so that participants were safe,” one said.

NDIS firm Cocoon SDA Care’s co-founder Zaffar Khan. Picture: LinkedIn

Cocoon’s corporate strategist Zaffar Khan said while the company collaborates “with global support teams for limited administrative functions, participant data is stored securely in Australia, remains under the control of authorised personnel, and has never been sent to or processed by overseas employees”.

“All personal information of participants and employees is handled in accordance with Australian privacy laws and our obligations under NDIS legislation, the Fair Work Act and the Privacy Act.

“We have strict protocols in place to manage sensitive information, and our systems are

designed to ensure that data is accessed only by specific, authorised personnel under secure conditions, with full accountability.”

The NDIS Commission does not currently prohibit offshore data processing, but providers must ensure participant information is kept secure and confidential, with robust systems and processes in place.

Horizon SolSolutions called in the liquidators last week.

One employee, who is allegedly owed $30,000 in unpaid wages and superannuation payments, said staff had been invited by Deloitte to a town hall meeting on Monday afternoon.

Originally published as Cocoon SDA Care: Employees say banned NDIS provider shared personal data with staff in Pakistan