For registered NDIS providers, reportable incident notification is one of the most consequential obligations under the NDIS (Incident Management and Reportable Incidents) Rules 2018. Fail to notify, notify late, or misclassify an incident, and you risk regulatory action from the NDIS Quality and Safeguards Commission, up to suspension or cancellation of your registration. This guide sets out what is reportable, the exact timeframes, and how to lodge a notification correctly.
A reportable incident is a specific type of serious incident that has, or is alleged to have, occurred in connection with the provision of NDIS supports or services. There are six categories:
In deciding whether an injury is "serious", the Commission's detailed guidance says consideration should be given to the level of harm caused. It lists examples including fractures, burns, deep cuts, extensive bruising, head or brain injuries and any other injury requiring hospitalisation.
An incident is only reportable when it occurs in connection with the delivery of NDIS supports or services. This covers incidents during a shift, on your premises, or that arise from the way a support was, or was not, delivered. The obligation is not limited to incidents caused by your own workers.
The clock runs from when your provider becomes aware, not from when the incident occurred. The Commission's detailed guidance assumes a provider has become aware once a worker has notified a member of key personnel, a supervisor or manager, or the person named in your incident management system as responsible for notifying the Commission. This is why fast internal escalation matters: a delay in your team passing the information on does not pause the deadline.
An Immediate Notification must be lodged within 24 hours of the provider becoming aware, for:
If some required information is not available within 24 hours, you still lodge the Immediate Notification on time and provide the outstanding details within five business days. The Commission acknowledges receipt of a notification within 24 hours.
The use of a restrictive practice that is unauthorised or not in accordance with a behaviour support plan must be notified within five business days, unless the incident has resulted in harm to a person with disability. The Commission says "If the incident has resulted in harm to a person with disability, it must be reported within 24 hours." Harm is the test, not only whether an injury is classified as serious. See the Commission's reportable incidents page.
The Commission's detailed guidance says a final report needs to be provided to the Commission within 60 business days following the initial notification, and that the Commission may extend that period. Read the current guidance, and any request from the Commission, for whether a final report applies to your incident. A final report covers any internal or external investigation, your findings, the actions taken to support the impacted person, and what you have changed to prevent a recurrence. The Commission may extend this period on request.
Notifying the NDIS Commission does not replace your other obligations. You must still report crimes to police, meet any mandatory child protection reporting duties, and comply with relevant state or territory requirements.
Reportable incidents are lodged through the NDIS Commission Portal at ndiscommission.gov.au. The Commission runs more than one portal, and which one applies depends on when the incident was lodged: see which portal do I use? The forms include: the Immediate Notification, the Five Day Notification, or the Final Report. Each captures the date, time and location, a description of what occurred, the people involved, the immediate actions taken, whether police or emergency services were contacted, and whether the impacted person and their representative have been informed.
The Rules require every registered provider to maintain an incident management system appropriate to your size and the supports you deliver. In practice, a system needs:
Paper and spreadsheet systems make the 24 hour clock dangerous, because an incident written in a notebook on a night shift may not reach a manager for days. A digital incident system timestamps the report the moment it is created, so you can show when an incident was recorded. Deciding what is reportable and notifying the Commission stays with your organisation.
CareIQ lets you capture and manage incidents with severity, witnesses and sign-off. Your organisation remains responsible for deciding what is reportable and notifying the Commission. For the Commission's current wording, see our NDIS incident reporting guide. Start your free CareIQ trial, built for Australian care providers.