Every provider should record incidents in its own incident management system. A smaller set are reportable to the Commission. The Commission is clear that the two overlap:
Registered NDIS providers must notify the NDIS Commission of all reportable incidents.
This includes incidents you have recorded and responded to within your own incident management system.
The Commission describes a reportable incident this way:
A reportable incident is an act or event that has happened, or alleged to have happened, in connection with delivering NDIS supports or services.
The Commission's detailed guidance lists the types of reportable incident:
In determining whether an injury is 'serious', consideration should be given to the level of harm caused.
The guidance then says "A serious injury includes, but is not limited to:" fractures, burns, deep cuts, extensive bruising, head or brain injuries which might be indicated by concussion or loss of consciousness, and any other injury requiring hospitalisation. It also says that hospitalisation for reasons unrelated to a serious injury is not a reportable incident.
| Reportable incident | Notify the Commission within |
|---|---|
| Death of a person with disability | 24 hours |
| Serious injury of a person with disability | 24 hours |
| Abuse or neglect of a person with disability | 24 hours |
| Unlawful sexual or physical contact with, or assault of, a person with disability | 24 hours |
| Sexual misconduct against, or in the presence of, a person with disability | 24 hours |
| Use of a restrictive practice that is unauthorised, or does not follow a behaviour support plan | 5 business days |
The restrictive practice exception has its own limit:
If the incident has resulted in harm to a person with disability, it must be reported within 24 hours.
Missing the timeframes has consequences: "If you do not report an incident within the timeframes, this might result in an infringement notice or other compliance actions."
The Commission says its timeframes "are calculated from when a registered NDIS provider became aware of the incident". The detailed guidance explains when a provider is taken to be aware:
It is assumed that a registered NDIS provider has become aware of an incident once a person employed, or otherwise engaged by a registered NDIS provider has notified one of the following individuals:
So the clock does not wait for a weekly review. A worker who tells their supervisor on Tuesday about something that happened on Sunday has started the clock on Tuesday. This is why your escalation process matters as much as your form.
The Commission's page describes the forms in its portal. The first is the 24-hour report:
You need to submit this form within the specified timeframe. In most cases, this is within 24 hours of becoming aware of a reportable incident.
The second is the 5-day report:
You need to provide additional information and actions you've taken. Submit this form within five business days of becoming aware of a reportable incident.
This is the only form needed for incidents involving unauthorised use of a restrictive practice that has not caused immediate harm to a person with disability.
There is also a third party report, for telling the Commission about an incident connected with another registered provider's supports. The Commission's detailed guidance also has a section on any final report:
The final report needs to be provided to the NDIS Commission within 60 business days following the initial notification. The NDIS Commission may extend the period for providing the final report.
Read the current guidance, and any request from the Commission, for whether a final report applies to a particular incident.
Lodge all new incidents in the new NDIS Commission Portal, including the 24-hour report and the 5-day report.And for older ones:
For incidents you lodged before 12 October, keep using the existing portal for 5-day reports, responding to a request for information, looking up incident history and documents, and weekly unauthorised restrictive practice (URP) reporting.Incidents lodged before that date are not moved to the new portal. This can change, so read the Commission's which portal do I use? page and the reportable incidents page before you lodge.
The guidance says "Providers are required to maintain a record of the incident in their incident management system", and "At a minimum the registered NDIS provider's record must include:"
Reporting to the NDIS Commission does not replace your existing obligations to report particular events to other agencies, such as reporting any crimes to police or mandatory reporting to child protection agencies.
Participants and their families or representatives should also be told about incidents that affected them, in line with your own policy.
Many incidents go unreported because staff fear negative consequences. Make clear that reporting is expected and protected, and that its purpose is to improve safety, not to punish individuals. If a provider delivering many hours of support records very few incidents, an auditor may reasonably ask whether incidents are being recorded. For a practical workflow, see our guide to an incident management workflow from the shift to sign-off.
Records made on the shift are easier to produce than records rebuilt later. CareIQ lets you capture and manage incidents with severity, witnesses and sign-off. It does not decide whether an incident is reportable or lodge the notification: your organisation remains responsible for both. See NDIS incident management software.
The Commission says death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, and sexual misconduct must be notified within 24 hours. An unauthorised use of a restrictive practice, or use not following a behaviour support plan, must be notified within 5 business days, but "If the incident has resulted in harm to a person with disability, it must be reported within 24 hours." Check the Commission page for the current rules.
The Commission's guidance assumes a provider has become aware of an incident once a worker has notified key personnel, a supervisor or manager, or the person named in your incident management system as responsible for notifying the Commission. Fast internal escalation therefore matters.
No. Only the specific types of incident set out in the Rules, when they happen in connection with delivering NDIS supports or services. You must still record your other incidents in your own incident management system.
No. The Commission says reporting to it "does not replace your existing obligations to report particular events to other agencies", such as reporting crimes to police or mandatory reporting to child protection agencies.
The Commission's detailed guidance says a final report "needs to be provided to the NDIS Commission within 60 business days following the initial notification" and that it may extend that period. Read the current guidance, and any request from the Commission, for when a final report applies to your incident.
Capture and manage incidents with severity, witnesses and sign-off. See NDIS incident management software →
CareIQ lets you capture and manage incidents with severity, witnesses and sign-off. Your organisation remains responsible for deciding what is reportable and notifying the Commission. 2-month free trial, no setup fee.
Start Your 2-Month Free Trial