Incident reporting is one of the most misunderstood compliance obligations in the NDIS sector. Providers often aren’t sure what counts as a reportable incident, when to report it, and what happens if they don’t. The consequences of getting it wrong, whether by over-reporting, under-reporting, or reporting too late, can range from a formal warning to suspension of registration.
This guide cuts through the confusion and gives you a clear, practical breakdown of your incident reporting obligations as a registered NDIS provider.
Why Incident Reporting Matters
The NDIS Quality and Safeguards Commission requires all registered providers to have a robust incident management system, not just to tick a compliance box, but because it directly impacts participant safety. The Commission uses incident data to identify systemic risks, investigate individual providers, and intervene when participants are at risk of harm.
When providers fail to report serious incidents, it’s not just a documentation problem. It signals to the Commission, and to auditors, that your organisation may not have adequate safeguards in place.
What Is a Reportable Incident?
Under the NDIS (Incident Management and Reportable Incidents) Rules, registered providers must report specific categories of incidents to the NDIS Commission. These are known as reportable incidents.
The five categories of reportable incidents are:
1. Death of a Person with Disability
Any death of an NDIS participant while receiving supports or services from your organisation must be reported. This includes expected deaths (e.g., from a terminal illness) if the participant was in receipt of your supports at the time.
2. Serious Injury of a Person with Disability
A serious injury is one that requires medical treatment beyond basic first aid, for example, a fracture, hospitalisation, or an injury that causes lasting impact. Minor injuries (a graze, a bruise) treated with basic first aid are not reportable, but you should still log them in your internal incident register.
3. Abuse and Neglect of a Person with Disability
This covers physical abuse, sexual abuse, emotional or psychological abuse, financial abuse, and neglect. It includes incidents involving your workers, but also situations where a participant is abused by another participant in a shared accommodation setting.
4. Unlawful Sexual or Physical Contact or Assault
Any unlawful sexual contact with a participant must be reported, regardless of whether the perpetrator is a worker, another participant, or a third party. Physical assault (beyond reasonable force used in behaviour management) is also reportable.
5. Use of a Restrictive Practice Not Authorised Under the NDIS Rules
If a restrictive practice is used that hasn’t been authorised, or is used in a way that goes beyond what’s been authorised, this must be reported. This is a particularly common source of reportable incidents for behaviour support providers.
What Is NOT a Reportable Incident?
This is where providers often get confused. Not every adverse event needs to go to the Commission, but everything should be recorded internally.
The following are generally not reportable incidents (though you must still document them):
– Minor injuries requiring basic first aid only
– A participant expressing dissatisfaction or making a complaint
– Near-miss events with no actual harm
– Incidents unrelated to the provision of NDIS supports
The key question is: did the incident occur in connection with the provision of NDIS supports? If yes, and if it falls into one of the five categories above, it must be reported.
Timeframes: When Do You Need to Report?
The NDIS Commission operates on a two-stage reporting model:
Stage 1: Immediate Notification: Within 24 Hours
For the most serious incidents (death, serious injury, abuse, assault, and unauthorised restrictive practices), you must notify the NDIS Commission within 24 hours of the incident occurring, or within 24 hours of becoming aware of it.
This is a preliminary notification, you don’t need to have all the details at this stage. The Commission understands that information is still being gathered. What matters is that you’ve flagged it promptly.
Stage 2: Full Written Report: Within 5 Business Days
A detailed written report must be submitted within 5 business days of the incident. This should include:
– What happened
– Who was involved (workers, participants, witnesses)
– What immediate actions were taken
– What follow-up actions are planned or have been completed
If a death is involved, additional requirements apply and the timeframe may be tighter depending on the circumstances.
How to Report to the NDIS Commission
Reportable incidents are submitted through the NDIS Commission Portal (myplace provider portal). You’ll need to:
- Log in to the NDIS Commission Portal
- Navigate to the Incident Management section
- Submit the initial notification (within 24 hours)
- Follow up with the full written report (within 5 business days)
Make sure the staff member responsible for incident management in your organisation knows how to access and use the portal before an incident occurs. The worst time to figure out the process is in the middle of a crisis.
Your Internal Incident Management System
Reportable incidents are just the tip of the iceberg. A robust incident management system covers all incidents, including those that don’t need to go to the Commission.
Your internal system should include:
An incident register that captures:
– Date and time of the incident
– Location and context
– People involved (use codes or initials if privacy is a concern)
– Incident type and severity classification
– Immediate response taken
– Follow-up actions and outcomes
– Date the incident was closed out
An escalation process: who in your organisation gets notified for different levels of incidents, and who is responsible for Commission notifications.
Post-incident review for serious incidents, what happened, why it happened, and what systemic changes (if any) are needed to prevent recurrence.
One critical thing many providers miss: closing out incidents. Logging an incident and then leaving it open indefinitely with no outcome recorded is a red flag in any audit. Every incident should have a resolution and a close-out date.
What Are the Penalties for Non-Compliance?
The NDIS Commission takes incident reporting seriously. If you fail to report a reportable incident, or report it late. The following can apply:
Civil penalties: The Commission can issue infringement notices with financial penalties for failure to notify or report within required timeframes.
Compliance notices: The Commission can issue a compliance notice requiring you to take specific actions within a set timeframe.
Registration conditions: Non-compliance with incident reporting obligations can result in conditions being imposed on your registration, such as increased auditing or mandatory external oversight.
Suspension or cancellation of registration: In serious cases (particularly where failure to report is linked to a pattern of non-compliance or a cover-up of harm), the Commission can suspend or cancel your registration entirely.
Beyond formal penalties, there’s also the practical risk of a Commission investigation being triggered. An unannounced investigation following a serious unreported incident is significantly harder to manage than a standard audit, and the reputational damage can be lasting.
Common Mistakes Providers Make
Waiting to see how things develop before reporting. If an incident meets the reportable threshold, you must report it within 24 hours, not once you’ve worked out what happened or consulted a lawyer.
Under-classifying incidents to avoid reporting. Describing a serious injury as a “minor incident” or failing to characterise abuse as abuse is a significant compliance risk. If an auditor or the Commission later reviews your records, inconsistencies between your internal documentation and what was reported are very difficult to explain.
No incident management training for frontline staff. Your support workers are usually the first to know about an incident. If they don’t know what to record, who to tell, or what the timeframes are, your system will fail at the most important point.
Not reporting incidents that occur after hours. Reportable incidents don’t pause on weekends or public holidays. Your organisation needs an out-of-hours escalation process so that incidents occurring outside business hours are still notified to the Commission within 24 hours.
Building a Culture of Reporting
The best compliance posture isn’t one where staff are afraid to report incidents, it’s one where they feel confident and supported to do so. Providers with strong incident cultures:
- Train all staff on incident identification and reporting at onboarding
- Conduct regular refreshers (at least annually)
- Make it easy to report, simple forms, clear escalation paths
- Never penalise staff for reporting incidents in good faith
- Use incidents as learning opportunities, not blame exercises
If your team is reluctant to report, that’s usually a sign of a cultural or leadership problem, not a compliance one. Fix the culture first.
Final Thought
Incident reporting isn’t just a regulatory box to tick, it’s how the sector identifies risks and protects participants. Providers who have strong incident management systems tend to be better operators overall: they catch problems early, they learn from them, and they’re better prepared when auditors come knocking.
If you’re not confident your incident management system meets NDIS Commission requirements, it’s worth reviewing it now, not after an incident occurs.
Need help building a compliant incident management system? Talk to the HPA team, we help providers build the systems and documentation they need to stay compliant and audit-ready.
