NDIS provider compliance hub

You must be registered by the NDIS Commission to deliver Specialist Disability Accommodation, to use regulated restrictive practices, to develop behaviour support plans, and to provide supports to NDIA-managed or plan-managed participants who require a registered provider. Registration is per registration group / service type — you register for each type of support you deliver.

The quality benchmarks a registered provider must meet. Every provider meets the Core module (rights and responsibilities; governance and operational management; provision of supports; support environment). Supplementary modules apply based on your services, including High Intensity Daily Personal Activities, Specialist Behaviour Support, Implementing Behaviour Support Plans, Early Childhood Supports, SDA and Specialist Support Coordination.

Verification is the lighter, desktop-style audit for lower-risk services (such as plan management, support coordination and community participation) — the auditor checks a defined evidence set. Certification is the full quality audit for higher-risk services (such as personal care, high intensity supports, SDA and behaviour support) — the auditor assesses conformity against the Core module and every applicable supplementary module, at initial registration and again at mid-term, on a three-year cycle.

A set of enforceable standards of behaviour for NDIS providers and workers — covering respect for rights, acting with integrity, delivering safe and competent supports, and preventing and responding to violence, abuse, neglect, exploitation and sexual misconduct. It applies to registered and unregistered providers alike, and the Commission can take action against workers as well as providers.

Registered providers must notify the NDIS Commission of reportable incidents — including death, serious injury, abuse or neglect, unlawful sexual or physical contact, sexual misconduct, and the unauthorised use of a restrictive practice — that occur in connection with the supports they deliver. Serious incidents must be notified within 24 hours, with a follow-up report, and other reportable incidents within five business days. You must also have an incident management system that records and manages all incidents.

Workers in risk-assessed roles — broadly, roles involving more than incidental contact with participants, or roles with the power to make decisions affecting participants. Registered providers must identify risk-assessed roles, ensure workers hold a clearance, and keep a worker screening record. A clearance is issued through the participating state or territory worker screening unit.

If your supports involve regulated restrictive practices you must meet additional rules: behaviour support plans must be developed by an NDIS behaviour support practitioner and lodged with the Commission, each regulated restrictive practice must be authorised under the relevant state or territory framework, and providers must report monthly on the use of regulated restrictive practices. Unauthorised use of a restrictive practice is a reportable incident.

Yes. The NDIS Review recommended a new graduated registration model with provider risk tiers, and the NDIS Commission and the Department are progressively implementing reforms. Registration categories, provider risk tiers and audit requirements may change — so confirm the current model and your specific registration groups directly with the NDIS Commission before you plan your audit.