NDIS reportable incidents: what registered providers must notify

What a reportable incident is

The NDIS (Incident Management and Reportable Incidents) Rules 2018 outline the specific events that registered NDIS providers are required to notify the NDIS Commission about. These incidents are defined within the Rules and relate to the safety and wellbeing of people with disability receiving supports.

Reportable incidents fall into several categories. These include situations involving the death of a person with disability, serious injury to a person with disability, and instances of abuse or neglect. Further categories cover unlawful sexual or physical contact, sexual misconduct, and the inappropriate use of restrictive practices.

The use of a restrictive practice is reportable if it occurs without proper authorisation or alignment with a behaviour-support plan.

• Death of a person with disability
• Serious injury of a person with disability
• Abuse or neglect of a person with disability
• Unlawful sexual or physical contact with, or assault of, a person with disability
• Sexual misconduct
• Use of a restrictive practice not in accordance with authorisation or behaviour-support plan

Who must report

Registered NDIS providers have a legal obligation to report reportable incidents. This responsibility applies directly to these providers and does not extend to other entities.

Reports must be made to the NDIS Quality and Safeguards Commission. This is the designated body for receiving and managing incident notifications.

While workers and unregistered providers are not directly subject to the reporting requirements, registered providers are required to have an internal incident-management system that covers the actions of their workforce.

Timeframes

Registered NDIS providers have specific timeframes for reporting incidents. Serious incidents, which include death, serious injury, abuse, neglect, and unlawful sexual or physical contact, require immediate notification. This means the provider must notify within 24 hours of the incident occurring. compliance calendar tool can assist with tracking these deadlines.

For incidents that are not classified as serious, such as the use of a non-authorised restrictive practice, the reporting timeframe is 5 business days. A detailed report is required, outlining investigation steps taken or planned, and immediate actions to support the person affected.

Monthly summary reporting is also required for authorised restrictive practices. This ensures ongoing monitoring and compliance. compliance calendar tool can assist with tracking these deadlines.

Beyond reporting — the wider system

Registered NDIS providers’ obligations extend beyond simply reporting incidents to the NDIS Quality and Safeguards Commission. A robust incident-management system is required, documented and covering identification, response, reporting, and review processes. This system must be actively maintained and demonstrate effective operation.

The Commission’s oversight includes assessing how incident management functions in practice. Practice Standards audits examine whether providers’ incident management systems are working as intended, evaluating processes beyond documented procedures. Workers undertaking roles involving risk assessments must hold a current NDIS Worker Screening Check.

Failure to meet reporting obligations, or demonstrating inadequate incident management, can result in serious consequences. The Commission has the authority to take action, which may include registration revocation and the imposition of civil penalties.