NDIS reportable incidents: the complete guide for providers

What a reportable incident is (short answer)

A reportable incident is a serious incident, or an allegation of one, that happens in connection with the supports or services a registered NDIS provider delivers. There are six kinds: death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct (including grooming), and the unauthorised use of a restrictive practice. Registered providers must notify the NDIS Quality and Safeguards Commission through the Commission portal, within 24 hours for most types and within 5 business days for an unauthorised restrictive practice that caused no harm.

The definition sits in section 73Z(4) of the NDIS Act 2013 and is refined by section 16 of the NDIS (Incident Management and Reportable Incidents) Rules 2018. Two points trip providers up most often:

• Allegations count. Section 17 of the Rules says a reportable incident includes one that is alleged to have occurred. You do not wait until you are sure it happened.
• "In connection with" is broad. The Commission's Reportable Incidents Detailed Guidance says it covers incidents during a support, incidents arising from how supports were provided, altered or withdrawn, and incidents that happen outside a shift but arise out of the support. In supported accommodation, most incidents will be connected because the provider is responsible for residents' supervision, health and safety.

You must notify even when you believe you responded well. Notification is not an admission of fault. It is how the Commission oversees what happened next.

The categories of reportable incidents

The table below summarises each category with the thresholds the Commission's guidance uses. Read the guidance itself for the full definitions before you train staff on them.

The five regulated restrictive practices are seclusion, chemical, mechanical, physical and environmental restraint, defined in section 6 of the NDIS (Restrictive Practices and Behaviour Support) Rules 2018. Authorisation rules differ between states and territories, so check your jurisdiction's process. The free restrictive practice checker walks through the common questions, and the reportable incident checker helps a coordinator test an incident against the six categories.

Notification timeframes and forms

The Commission's reportable incidents page sets out the timeframes, calculated from when the registered provider became aware of the incident.

Both forms are lodged in the NDIS Commission Portal under "My Reportable Incidents". Under section 20 of the Rules, the immediate notification covers the provider's details, a description of the incident, the impact on the person (except for a death), immediate actions taken including whether police or another body were told, the notifier's details, the time, date and place if known, and the people involved. If you do not have all of this within 24 hours, you must still lodge the provider, description, impact, actions and notifier details on time, and supply the rest within 5 business days.

The 5 Day Form adds witnesses, further actions proposed and supporting detail. The Commission's guidance asks you to attach relevant documents, such as incident reports, file notes, risk assessments and the person's behaviour support plan where relevant.

Two further duties are easy to miss:

• Significant new information. If you learn that the incident is a different kind than you reported, or that a further reportable incident occurred, you must tell the Commission in writing as soon as reasonably practicable (Rules s 23).
• Information you can withhold. You are not required to obtain or notify certain details if doing so would prejudice a criminal investigation or expose a person with disability to risk of harm (Rules s 22).

Missing a timeframe can lead to an infringement notice or other compliance action, according to the Commission's reportable incidents page.

Investigation and final reporting

After notification, the Commission assesses the incident. Under section 26 of the Rules it may refer the incident to another body such as police or child protection, require or request remedial action, require you to carry out an internal investigation, require you to engage an independent expert at your expense, or run its own inquiry.

The Commission may also require a final report. Under section 24 of the Rules this is due within 60 business days after the 5 Day notification, or a longer period the Commission specifies. It must cover:

1. Who carried out any investigation or assessment, their position and when it happened.
2. The findings made.
3. Corrective or other action taken afterwards.
4. A copy of any investigation or assessment report.
5. Whether the affected person or their representative has been kept informed of progress, findings and actions.

Even when the Commission does not ask for an investigation, your own incident management system must assess every incident: whether it could have been prevented, how well it was managed, what remedial action is needed and whether anyone else must be told (Rules s 10(3)). That assessment must consider the views of the people with disability affected.

Remember parallel obligations. Reporting to the Commission does not replace reporting crimes to police or making mandatory child protection reports, and those requirements differ between states and territories.

Building an incident management system

Every registered provider must implement and maintain a documented incident management system that is proportionate to its size and the supports it delivers (NDIS Act s 73Y and Part 2 of the Rules). Auditors assess it against the incident management outcome in the Practice Standards core module. Use this checklist to test yours.

1. Written procedures covering how incidents are identified, recorded and reported, who they are reported to, and the named person responsible for notifying the Commission (Rules s 10(1)).
2. Support for the person affected, including information about access to independent advocates, and how they will be involved in resolving the incident.
3. Investigation triggers: when an investigation is required and what kind.
4. Corrective action rules: when action is required and what form it takes.
5. Minimum record fields for every incident, as listed in section 12(2) of the Rules, kept for 7 years from the day the record is made.
6. Statistics that let you review issues and identify systemic problems (Rules s 12(5)).
7. Accessible copies of the documented system provided to participants, workers, and families, carers and advocates, with help to understand it (Rules s 12(1)).
8. Worker roles and training in using and complying with the system (Rules s 13).
9. Procedural fairness for everyone involved, including workers who are the subject of an allegation (Rules s 11).
10. Periodic review of the system itself (Rules s 10(6)).

The Commission's Incident Management Systems Detailed Guidance explains each element and includes a table of indicators of abuse and neglect that is worth building into staff training.

Common mistakes

• Waiting to confirm an allegation before notifying. The obligation attaches to the allegation.
• Treating the 24-hour clock as starting at the next business day. The 24-hour window runs in hours, including nights and weekends. Your on-call arrangements need to cover it.
• Assuming an authorised practice is always fine. An authorised practice used outside the behaviour support plan, or where no plan exists, is still reportable.
• Recording each minor incident in isolation. The Commission expects your system to surface repeated minor behaviour so a pattern of abuse can be recognised and reported.
• Closing the incident at notification. Notification is the start. Assessment, participant follow-up and corrective action are what auditors look for.

How providers handle this in Suppora

Suppora's incident management module is built around the Commission timeframes. Workers complete the full incident form from the app at the time, capturing what happened, who was involved, injuries, immediate actions and witnesses.

Choosing a reportable incident type flags the incident and opens a reportable assessment straight away. Suppora counts the 24-hour immediate notification and the 5-business-day report, business days included, and shows every open reportable incident in one queue with the soonest deadline first.

Managers then record follow-up, including what was done, who was told and what changes next, before closing the incident. Incidents can be printed as PDFs on your letterhead. Suppora does not submit to the Commission for you: notifications still go through the Commission portal, and Suppora gives you the report to copy across.