Related: NDIS Registration for Psychologists

Policies and procedures are the documents that describe how your service operates, and if you undergo the NDIS registration process, they're the main thing your auditor will review at your Verification audit. A policy sets out your position, a procedure sets out the steps you follow, and the forms and registers behind them help you maintain evidence that your procedures were followed.

The following article assumes you're registering only for 0128 Therapeutic Supports. If you're branching out into behaviour support or early childhood intervention supports, you'll need additional policies to cover those areas.

Verification audit requirements

The Verification module covers four specific standards.

Standard	What you need
Human Resource Management	A policy covering qualifications, records and training, plus your worker file: identity, right to work, AHPRA registration, qualifications, Worker Screening Check, Worker Orientation Module certificate, supervision and CPD records, and infection control and PPE training with refreshers
Incident Management	A policy and procedure meeting the NDIS (Incident Management and Reportable Incidents) Rules 2018, an incident form, and a register
Complaints Management	A policy and procedure meeting the NDIS (Complaints Management and Resolution) Rules 2018, a form, a register, and information for participants including how to complain to the Commission
Risk Management	A documented risk management system covering work health and safety, your insurances, emergency and disaster planning, risk assessments considering participant reliance on your service, and infection control standard precautions

If a policy pack you're looking at buying includes governance, participant money and property, medication management or restrictive practices, those belong to the Core Module and a Certification audit. You don't need them if you're only registering for 0128 Therapeutic Supports.

Human resource policies for psychologists

Your HR policy should state that anyone working as a psychologist in your practice holds current AHPRA registration, including you if you're practicing (as well as if you're the only worker). It's easy to leave this implied when there's one practitioner and the practitioner is you, but the policy should state it and the evidence should be on file.

Ensure you also include the process you follow that keeps it from lapsing. AHPRA registration renews annually, and while you'll receive reminders, a policy that relies on remembering won't quite cut it. Set out who checks, when they check, and where the evidence is kept, even if this is just a reminder in your Outlook calendar. The same applies to your professional indemnity insurance, your Worker Screening Check, and your first aid certificate if you hold one.

If you engage provisional psychologists or registrars, your policy should also cover the supervision arrangements they work under, and how you verify that a supervisor is approved for that role.

Registration status is publicly searchable on the AHPRA register, so your auditor can check it independently (and see if it's lapsed).

Incident policies and procedures for psychologists

The NDIS Incident Management Rules define an incident as an act, omission, event or circumstance that happens in connection with providing supports and has, or could have, caused harm to a person with disability.

If you're writing your own policies and procedures, it's worth working through your practice and considering what you may experience that would be considered an incident under the NDIS. Work out where this line sits for you and clearly include it in your procedure. Potential incidents that psychologists may need to record include:

• A participant discloses abuse, neglect or exploitation, whether by a family member, a support worker or another provider
• A participant expresses suicidal ideation or discloses self-harm
• A participant becomes acutely unwell and requires a mental health crisis response or involuntary assessment
• A mandatory reporting obligation is triggered
• A mandatory notification obligation under the National Law arises about another health practitioner
• A participant experiences significant distress or deterioration following an intervention
• A confidentiality breach, such as an email to the wrong recipient, or notes visible to someone else during a telehealth session
• An error in an assessment or report that affects a participant's funding or a decision made about them
• Test materials or protocols left accessible to someone who shouldn't have them
• An allegation about your conduct or a boundary concern
• A safety concern during a telehealth session where you don't know where the participant is

Once you're registered, the reportable incidents obligations apply to you, which is a narrower set of more serious incidents with notification timeframes to the Commission. Our guide on reportable incidents covers which incidents those are.

Risks worth having in a psychology practice risk register

Make sure you create a risk register that reflects the risks actually faced by you, your business, and participants. This may include:

• Confidentiality and information sharing across support coordinators, plan managers, therapy teams and the NDIA
• Professional boundaries and dual relationships, particularly in small communities
• Supporting a participant at risk of harm to themselves
• Assessing and responding to risk of harm to others
• Mandatory reporting decisions, and mandatory notification obligations under the National Law
• Working within your approved area of practice, and knowing when to refer
• Supervision arrangements if you engage provisional psychologists or registrars
• Security of test materials and assessment protocols
• Report writing, where your opinion informs funding or legal decisions
• Participants with impaired decision-making capacity, guardianship or nominee arrangements
• Vicarious trauma and practitioner wellbeing
• Working alone, if you do home, school or community visits
• Business continuity when you're the only practitioner
• Technology and platform failure, if you deliver by telehealth

The Verification standard also asks you to consider how much a participant relies on your service and what would happen if it were disrupted. An unplanned break in therapy can matter more than an unplanned break in a lawnmowing service, so consider this seriously and document a plan for expected and unexpected absences.

Managing complaints

It's likely that you already have a complaints process if you're already working as a psychologist, but if you're registering with the NDIS you need to make sure your documents are updated to meet the requirements of the NDIS Complaints Rules.

The NDIS requires a complaints process a participant can use with you directly, plus information telling them they can go to the NDIS Commission instead at any time (not just if they're unhappy with your response to a complaint). You'll already have obligations to tell clients about AHPRA and your state health complaints body, and there's no need to have separate complaints policies. Adding the relevant NDIS information to your existing documentation is fine.

Updating your existing documents

The following aren't Verification indicators, and you won't be assessed against them at your audit. However, you may already have existing policies in place for these areas, and it's worth making some updates to include information relevant to delivering psychological services as an NDIS provider.

Your confidentiality policy. An NDIS participant may have a support coordinator wanting updates, a plan manager seeing your invoices, and a plan review where your reports become evidence. Set out what you share, with whom, and on what basis, and make sure you explain this to all participants.

Your information privacy/consent form. Consent to treatment isn't consent to collect, use, retain and disclose information. Name who information can go to, how the participant accesses or corrects it, and how they withdraw consent. If you're used to Medicare work, your existing consent is likely built around a referral pathway that doesn't exist in the NDIS.

Your fee agreement. An NDIS service agreement should cover the supports to be provided, price guide rates, cancellation terms, whether the participant is agency-managed, plan-managed or self-managed, and what happens if their plan changes. Medicare session limits and rebate arrangements don't apply for NDIS-funded supports.

Your session notes. Progress notes should ideally show movement against the goals in the participant's plan. This matters more than it does in Medicare work, because your notes are what a therapy report at plan review draws on.

Your report templates. If you write assessments or reports for the NDIA, they serve a different purpose to a report written for a GP or a court, and they need to address the participant's plan goals and the evidence a funding decision rests on.

These become audit requirements if you later add a registration group that moves you to Certification, where privacy and dignity, information management, service agreements and support planning are all Core Module standards.

Privacy law applies regardless of turnover

Small businesses turning over $3 million or less are generally exempt from the Privacy Act 1988, and health service providers are one of the exceptions. The OAIC states that small businesses which are health service providers are covered by the Act, and a psychology practice generally holds health information and provides a health service.

Several states and territories add their own health records legislation covering retention periods and client access rights, such as Victoria's Health Records Act 2001. Your record keeping obligations under the National Law and Psychology Board guidelines sit alongside these.

This sits outside the NDIS Practice Standards, and it's why your privacy and consent documents matter whether or not an auditor asks for them. Confirm your position with the Psychology Board or a lawyer.

Our free toolkit

Paperbark's Verification Toolkit is free and helps you build the four Verification policies and their supporting forms and registers, directly from your answers about how your practice actually runs.

---

Meta description: What a psychologist is assessed against at NDIS Verification, what counts as an incident in a psychology practice, and what belongs in your risk register.