Understanding Reportable Incidents Under the NDIS

Registered NDIS providers have two distinct but related obligations when it comes to incidents. The first is maintaining an incident management system that covers all incidents connected to service delivery. The second (covered in this article) is the obligation to notify the NDIS Commission of a specific subset of those incidents, called reportable incidents.

Understanding which incidents are reportable, and when they need to be reported, is one of the more practically important things a registered provider needs to get right from the outset.

Much of this information is drawn from the Commission’s Incident Management Systems: Detailed Guidance for Registered NDIS Providers, which is very much worth reading in full.

What makes an incident reportable?

For an incident to be a reportable incident, two things must be true:

1. It involves one of the defined categories set out in the legislation
2. It occurred, or is alleged to have occurred, in connection with the provision of supports or services by the provider.

Both elements need to be present, and the connection to service provision is interpreted broadly. It doesn’t require the incident to have happened during a support session, or to have been caused directly by the provider, and an incident that arose out of the provision of supports, or that is connected to service delivery even if it happened at a different time, can still be reportable.

Importantly, reportable incidents also include allegations (not just confirmed events). If a participant discloses that something happened, that disclosure triggers the reporting obligation even before any investigation has concluded. Providers shouldn’t wait for a police investigation or internal review to be completed before notifying the Commission.

The six categories

1. Death of a participant

Any death of a participant that occurs in connection with the provision of NDIS supports or services must be reported. The cause of death (i.e. whether natural or unnatural, expected or unexpected) does not affect whether it is reportable. Providers don’t need to and shouldn’t wait to establish the cause of death before notifying the Commission. The question is only whether there is a connection between the death and the service being provided.

2. Serious injury of a participant

Serious injury includes but isn’t limited to fractures, burns, deep cuts, extensive bruising, head or brain injuries, and any injury requiring hospitalisation. If a participant is admitted to hospital (including a short-stay or emergency presentation) in connection with an injury sustained during service delivery, it’s reportable to the Commission. Hospitalisations for reasons unrelated to the supports being provided are not reportable.

3. Abuse or neglect of a participant

This category covers physical, psychological, emotional, financial and systemic abuse, as well as neglect. Neglect includes inadequate care, failure to access medical care, supervisory neglect, reckless failure to act, and failure to protect from abuse. It also includes patterns of behaviour that may not appear serious in individual instances but constitute a pattern of abuse when considered together.

4. Unlawful physical contact with, or assault of, a participant

Any unlawful physical contact or assault of a participant connected to service delivery is reportable. This includes contact that does not result in physical injury, e.g. common assault can be reportable even where no harm resulted.

There is a specific carve-out: unlawful physical contact is not reportable where the contact with the participant, and the impact on them, are both negligible. The guidance from the Commission (linked at the start of this article) describes this as contact that is insignificant to the person, e.g. briefly moving someone out of harm’s way where they show no reaction, or momentarily holding someone to assist with care where they resist only briefly. The impact doesn’t have to be physical for contact to be reportable. If a participant becomes withdrawn or tries to avoid a worker following an incident, the impact may not be negligible even if no physical injury occurred.

5. Unlawful sexual contact with, or assault of, a participant

Any unlawful sexual contact or assault of a participant connected to service delivery must be reported. There is no negligible contact carve-out for this category.

6. Sexual misconduct against, or in the presence of, a participant

This category is broader than unlawful conduct. It includes behaviours of a sexual nature that may not constitute a criminal offence but still crosses professional boundaries, such as sexually explicit comments, inappropriate personal correspondence with a participant about romantic or sexual feelings, watching a participant undress when supervision is not required, and grooming behaviour. Grooming is assessed based on a pattern of conduct, no single behaviour necessarily constitutes it, but a pattern with no other reasonable explanation does.

Unauthorised restrictive practices

The use of a restrictive practice that is not properly authorised, or that is not consistent with the participant’s behaviour support plan, is also reportable. The rules around this category are more complex than the others, as they depend on the state or territory authorisation arrangements and whether a behaviour support plan is in place. In general terms: if a restrictive practice is used without the required authorisation, or in a way that is inconsistent with the person’s behaviour support plan, it needs to be reported.

If the use of a restrictive practice also results in serious injury to the participant, it falls under the serious injury category and the 24-hour timeframe applies.

Notification timeframes

Within 24 hours

All reportable incidents except for unauthorised restrictive practices that have not resulted in serious injury must be notified to the Commission within 24 hours of the provider becoming aware of them. The clock starts when a worker notifies key personnel, a supervisor or manager, or the person specified in the incident management system as responsible for Commission notifications, not when the incident actually occurred.

If the full information required isn’t available within 24 hours, the provider must still notify within that window with whatever information is available. The remaining details can be provided within five business days.

Within five business days

Unauthorised restrictive practices that have not resulted in serious injury must be notified within five business days. The five-day notification is also used as the follow-up to an immediate notification for all other reportable incidents, and must include witness details, a description of the support provided to the participant, further proposed actions, and details of any risk processes being undertaken.

Both notifications must be accompanied by copies of all relevant documents (e.g. incident reports, file notes, risk assessments, behaviour support plans where relevant, and any correspondence between relevant parties).

The final report

In some circumstances the Commission will request a final report within 60 business days of the initial notification. This includes the details of any investigation undertaken, findings made, corrective actions taken, and whether the participant has been kept informed of the process and outcomes. Not every reportable incident will require a final report, and the Commission will advise you when one is needed.

When you’re not sure whether something is reportable

If you are uncertain whether an incident meets the threshold for reporting, the safer approach is always to report it. Notifying the Commission of something that turns out not to be reportable is not a compliance breach., but failing to notify something that is reportable definitely is. The Commission can be contacted directly for guidance if you’re uncertain.

Reporting to the Commission doesn’t replace other reporting obligations. Incidents involving potential criminal offences should still be reported to police, and incidents involving children may also require mandatory reporting to child protection authorities. These are separate obligations that run alongside the NDIS Commission notification requirement.

A note on records

Every reportable incident must be recorded in your incident management system, and those records must be kept for seven years from the date of notification to the Commission. The record needs to include a description of the incident, details of the assessment undertaken, actions taken, consultations with the participant, and the details and outcomes of any investigation. This is separate from, and in addition to, the notification to the Commission itself.