Providers that are registered with the NDIS Quality and Safeguards Commission (NDIS Commission) are required to have a system in place for recording and managing incidents that occur and to lodge notifications with the NDIS Commission about serious incidents that have, or are alleged to have, occurred in connection with the delivery of supports or services to people with disability.  This article discusses the criteria that determine whether the duty to give notification of an incident is triggered.  In particular, whether an incident occurred in connection with the provision of supports or services by the registered NDIS provider.

Details of the legislation and resources cited in this article are available in the full text guidance note here.

Background to the NDIS Reportable Incidents Regime

In order to obtain and remain registered as a “registered NDIS provider” businesses must be assessed by third party auditors (“approved quality auditors”) as meeting outcomes identified in the new NDIS Practice Standards (‘the NDIS Practice Standards’). The NDIS Practice Standards define core regulatory obligations that all registered providers must comply with, including requirements for managing incidents and reporting of serious incidents or reportable incidents.

The National Disability Insurance Scheme Act 2013 (NDIS Act) and NDIS Incident Management and Reportable Incidents Rules 2018 (Reportable Incidents Rules) establish nationally consistent legal standards for incident management, incident records and the reporting obligation.  Under the new system, registered providers must establish procedures that specify how impacted persons are involved in resolving incidents (including those that are not reportable) and keep records about incidents that occur. Importantly, the obligation to lodge an incident notification is triggered by allegations.

Assessing whether an incident is reportable to the NDIS Commission

Section 73Z(4) of the NDIS Act defines the categories of incidents that are reportable.  The Reportable Incidents Rules establish the duty of workers to make a report when an incident has “occurred in connection with the provision of supports or services by a registered NDIS provider”.

Reading the NDIS Act and the Reportable Incidents Rules together, the following criteria are relevant when determining whether a worker’s reporting duty is activated:

  1. Is there, might there be, or has an allegation been made of, a circumstance that is listed in s 73Z(4) of the NDIS Act?
  2. Has a person who was employed or otherwise engaged by a registered NDIS provider become aware that the circumstance in question exists, may exist, or has been alleged?
  3. Did the relevant circumstance occur, or is alleged to have occurred, “in connection” with the provision of supports or services to a person with disability?
  4. If so, were those supports or services delivered by a registered NDIS provider?
    1. Circumstances listed in the legislation

Subsection 73Z(4) of the NDIS Act and r 16(1) of the Reportable Incidents Rules list six categories of incidents that are reportable:

a.      the death of a person with disability; or

b.      serious injury of a person with disability; or

c.      abuse or neglect of a person with disability; or

d.      unlawful sexual or physical contact with, or assault of, a person with disability; or

e.      sexual misconduct committed against, or in the presence of, a person with disability, including grooming of the person for sexual activity; or

f.       the use of a restrictive practice in relation to a person with disability, other than where the use is in accordance with an authorisation (however described) of a State or Territory in relation to the person.

The circumstances that are reportable may result from a random event, an action or an omission, but it is not necessary for a person to have engaged in conduct or to have failed to comply with a legal obligation to act.  When assessing an incident, the most important consideration is the impact on the person with disability.

Key terms in s 73Z(4)(b)-(e) are not defined in the legislation and despite the potential for technical meanings in criminal law to apply, these terms are to be interpreted according to their ordinary, everyday meaning and with reference to guidance published by the NDIS Commission.


  • Has a person who was employed or otherwise engaged by a registered NDIS provider become aware that an act, omission or event occurred, or is alleged to have occurred?


There are two elements to this inquiry.  First, is the relevant person aware that an incident has or may have occurred, or has been alleged?  Second, was that person “employed or otherwise engaged” by the provider.

Unlike s 63-1AA of the Aged Care Act 1997 (Cth), the NDIS legislation does not explicitly impose a duty on either the worker or the provider to report suspicions formed on reasonable grounds. However, suspicions about incidents do form part of obligations under the National Disability Insurance Scheme Code of Conduct.

Is the person employed or otherwise engaged?

Guidance from the NDIS Commission confirms that, for the purposes of the Reportable Incidents Rules, a “worker” includes employees, contractors and people otherwise engaged.

The NDIS Act gives no further guidance, however the interpretive note to the definition of “other personnel” in the NDIS Worker Screening Rules 2018 suggests that a contractor’s employees and sub-contractors engaged to “perform work integral to the supports or services being provided” are not considered employed or otherwise engaged.

The term “otherwise engaged” includes persons engaged on a voluntary basis but a contractor’s employees and sub-contractors engaged to “perform work integral to the supports or services being provided” are not considered employed or otherwise engaged. These persons will not usually be considered “otherwise engaged” because of the lack of direct connection between them and the principal provider.

  1. Did the act, omission or event in question occur, or is alleged to have occurred in connection with the provision of supports or services to a person with disability?

    In connection with the provision of supports or services

    To meet the “in connection” requirement, the incident must occur (or be alleged to have occurred) as some part of the overall provision of supports or services (to a person with disability) by a provider who is registered.

    The phrase “in connection with” is intended to be broad and includes incidents that arise out of the provision, alternation or withdrawal of supports or services. Note that “in connection with” does not imply that the provider must directly cause the incident.

    An incident may meet the “in connection” requirement where it did not occur at the time of service delivery, but the provision of services contributed to the incident in some way. In these circumstances, assessment of the “in connection” requirement is guided by analysis of whether the incident has a causal relationship with, or nexus to, the delivery of supports. Considerations relevant to this inquiry may include:

    • the location at which the incident occurred;
    • the nature of the incident;
    • the nature and extent of services being provided;
    • whether the nature of services that were delivered and the characteristics of the harm or impact are related or linked; and
    • whether service provision contributed to the incident.

    Reportable incidents typically occur at the time the person is receiving supports from a registered NDIS provider. However, if the incident was coincidental to service provision, it is not “in connection with” service delivery.  For example, where a person has suffered food poisoning after eating food delivered to a supported accommodation premises. In this example, the incident is not reportable because the nature of the harm is coincidental and unrelated to the provision of services.

    Provision of services to a person with disability

    The expression “person with disability” is not defined in the NDIS Act and it does not appear that the person with disability involved in the incident needs to be an approved NDIS participant for the notification duty to arise. In other words, incidents involving persons with disability who are not eligible for entry to the scheme are still reportable (although the powers exercised by the NDIS Commission in relation to such incidents may be limited). This is consistent with the broad ambit of the “in connection” requirement and the provisions in the legislation that extend the NDIS Commissioner’s  regulatory functions relating to health, safety and wellbeing of participants to all persons with disability receiving supports or services, including those received under the NDIS.

    Since providers are not expected to determine whether impacted persons are NDIS participants before making an incident report, characterisation of the impacted person as “a participant” may be of little practical importance.  This question may however, be relevant where the NDIS Commission has been unable to verify a person’s identify and seeks to obtain information about an impacted person who is not an NDIS participant.

    4.     Were the supports and services provided by a registered NDIS provider?

    Any person or entity registered under s. 73E of the NDIS Act is a registered provider.  This contrasts with the broad definition of “NDIS provider” which includes any person who receives funding from the NDIA and any person or entity who provides supports or services to people with disability under arrangements separate from the NDIS.

    Incorporated bodies and unincorporated entities are treated as if they were a person for the purposes of the Reportable Incident Rules and the provisions in Part 2 and Division 2 of Part 1 of Chapter 4 of the NDIS Act. In the case of a partnership or unincorporated association, any obligation that would be imposed on the entity is imposed on each partner or member of the management committee.

What happens if an incident is reportable?

If an incident is reportable, the worker is responsible for informing a member of the key personnel, their supervisor or manager, or the person who is responsible for lodging incident notifications with the Commission (the incident officer) as soon as possible. The Explanatory Statement for the Reportable Incidents Rules confirms that:

‘as soon as possible’ will be considered with a sense of urgency. For example it would not be appropriate for a worker who becomes aware of a reportable incident at the end of a shift to wait for the next shift to notify the relevant person.

Once advised, key personnel and the incident officer (whoever is informed) must take all reasonable steps to ensure incidents are notified to the Commission. Aside from unauthorised use of restrictive practices, the provider is required to provide information about the incident to the Commission within 24 hours.

It is clear from the Explanatory Statement that while workers have a duty to comply with the incident management system and to notify relevant persons of reportable incidents, the responsibility for ensuring that incident notification and management requirements are met lies with key personnel and the incident officer.

Refer to the full text version of this guidance note for further analysis on the duty of workers under the Reportable Incidents Rules.


What happens if someone does not comply with obligations under the Reportable Incident Rules?

Failure to comply with the requirements for reportable incidents set out in the Reportable Incidents Rules is a breach of a condition of registration. The maximum civil penalty that a court can impose on an unincorporated provider for breach of a condition of registration is 250 units ($52,500*) or 1,250 units ($262,500*) if the provider is an incorporated entity. The Commission has powers to issue infringement notices up to one-fifth of the maximum amount that a court could impose.

*Figures calculated per prescribed penalty rate as at January 2020.


This article does not replace professional judgement and we strongly encourage providers to seek legal advice and contact the Commission’s reportable incidents team if they are unsure about whether to report a particular incident.

Refer to the full text version of this guidance note here for details of the legislation and resources cited in this article.

For further information, contact Michael Pagsanjan at