NDIS Documentation Compliance for Allied Health Providers

NDIS documentation compliance means keeping complete, accurate and timely records of every NDIS support you deliver, and being able to show them when the NDIA or the NDIS Commission asks. For an allied health clinic, that covers service agreements, case notes, support logs, invoices and reports. It also covers the worker records behind them. This guide sets out what the NDIS requires, how long to keep it, what auditors look at and how to build habits that make the paperwork routine.

TL;DR

• Keep invoices, support logs, rosters, case notes and service agreements for every NDIS participant you support, with the participant’s name, NDIS number, dates, quantity and support type.
• Write case notes during or soon after the session, and link each one to the support item and the participant’s goals.
• Keep participant records for at least seven years after service provision, and worker-screening records for seven years from the date the record is made.
• Incomplete records can mean held claims, repayment of funds and, in serious cases, enforcement action.
• Documentation starts at referral. A structured intake gives every later record a clean starting point.

Table of Contents

• What NDIS documentation compliance means for a clinic
• Which rules apply to you: registered or unregistered
• The records an allied health provider should keep
• What a compliant case note looks like
• How long to keep NDIS records
• Preparing for an NDIS audit
• What happens when records are incomplete
• Documentation starts at referral
• Building a routine that holds
• See how structured intake works at Meddle
• FAQ
• Sources

What NDIS documentation compliance means for a clinic

The NDIA describes record keeping as keeping invoices, support logs, rosters, case notes and service agreements, and making payment claims that are complete, truthful and accurate. That is the practical definition. If you claimed for it, you can show it was delivered, to whom, when, for how long and why.

There are two jobs in one document set:

1. Proof of delivery. Records support your claims and show the support you billed was the support you provided.
2. Evidence for future decisions. The NDIA’s report-writing guidance shows that allied health reports inform decisions on a participant’s next plan, so thin records can affect the participant as well as the clinic.

The NDIS Commission also treats records as part of safe care. Its Code of Conduct guidance frames secure, respectful and sufficiently detailed records as part of competent support. They are not a formatting preference.

Which rules apply to you: registered or unregistered

Your obligations depend partly on whether you are registered.

• The Code of Conduct applies to everyone. The NDIA’s guide to becoming a provider says it covers registered and unregistered providers.
• The Practice Standards apply to registered providers. The NDIS Commission says they include a core module, supplementary modules for particular supports and a verification module for lower-risk or lower-complexity supports.
• Registration decides who you can serve. The Commission’s registration guidance says unregistered providers may only support self-managed or plan-managed participants. Registration is required for NDIA-managed participants, plan management, SDA, SIL, specialist behaviour support and regulated restrictive practices.

Many physiotherapy, occupational therapy, psychology, speech pathology, dietetics and podiatry clinics sit in the registered group because they take NDIA-managed participants. Either way, the record keeping basics below apply to you. If you are registered, the audit material later in this guide applies as well. Our overview of NDIS reporting requirements for registered providers covers the reporting side in more depth.

The records an allied health provider should keep

The NDIA sets a baseline. For each support, your records should show the participant’s name and NDIS number, the dates of support, the amount, quantity or hours, and the type of support. Group them like this.

Participant and service records

• Service agreement and any variations
• Referral and intake information, including who referred and when
• Consent records, including consent to share reports
• Support logs and rosters showing who delivered each session
• Case notes for each session
• Feedback, complaints, incidents and allegations

Financial records

The NDIA says invoices should include your business name and ABN, relevant participant address details, the support-item number, the claim type, the total amount and the GST component where applicable. Where a third-party provider is involved, include their ABN too. These details come from the NDIA record keeping page. Check them against the current page when you update your invoice template.

Reports

For plan reassessments, the NDIA’s guide to report writing lists what a report should cover:

• Service details and the participant’s goals
• Baseline functional capacity and the assessment tools used
• Supports provided and progress against goals
• Barriers and risks
• Recommendations for the next period
• Justification for any more or different supports

The NDIA says to share the completed report with the participant. With their consent, you can upload it through the provider portals.

Workforce records

Registered providers also hold records about people, not only participants. Under the worker-screening rules, you maintain records about risk-assessed roles and workers. These include role details, worker identity, screening application and check numbers, expiry dates and any suspension or revocation. The records must let an auditor identify who held risk-assessed roles on any day in the preceding seven years.

What a compliant case note looks like

The NDIA says case notes should outline the activities and how they relate to the support item and the participant’s goals. They may include progress and plans for future sessions. That link between activity, support item and goal is what separates a billing record from a clinical story.

The Code of Conduct guidance adds more. Accurate records should:

• Support continuity and future service delivery
• Avoid demeaning language
• Record relevant service history, medication and support needs
• Document feedback, complaints, incidents and allegations

A simple note structure

A consistent structure keeps notes quick to write and easy to audit. One approach:

This table is a suggested layout, not an NDIS-mandated form. Match it to your own clinical standards and professional body requirements.

Timing matters

The Code of Conduct guidance says records should be created at the time of the event or action, or as soon as possible afterwards. A note written during or right after a session is stronger evidence than one rebuilt from memory weeks later, especially when a claim is queried. Build note time into the diary rather than leaving it to the end of the day or week.

How long to keep NDIS records

The same guidance says participant records should be kept for at least seven years after service provision. Worker-screening records covered by the rules are kept for seven years from the date the record is made.

Seven years is a sensible baseline for the whole clinic. Your state or territory, your professional body, and privacy law can add requirements, and some records, such as those for children, may need to be held longer. Our data retention guide for Australian clinics gives a checklist, and our 12 steps to secure patient records cover how to protect what you keep under APP 11.

Preparing for an NDIS audit

Auditors assess against outcomes and quality indicators, and the modules that apply depend on the supports you deliver, according to the NDIS Commission. The audit type depends on the risk and complexity of your supports, and the Provider Pack says you choose an approved quality auditor.

Verification (lower-risk supports)

The Commission says verification evidence is reviewed through a desktop audit and should be proportionate to your size, scale and the risk and complexity of your supports. Its required documentation list covers:

• Evidence of identity, qualifications and experience
• Professional development
• Checks and insurance
• Worker orientation
• Proportionate human resources, work health and safety, incident and complaints systems

Mid-term audits

The registration rules provide for a mid-term audit for certain providers. It must start no later than 18 months after registration begins, unless the Commissioner allows longer. Confirm with your auditor whether it applies to your registration group.

An audit-ready folder

Keep one evidence map that points to where each requirement lives, instead of rebuilding it before each audit:

1. A register of policies with review dates and owners
2. A staff matrix: qualifications, screening, insurance and training, with expiry dates
3. An incident and complaints log with outcomes
4. A sample of de-identified service agreements, case notes and invoices that show the full chain from agreement to claim
5. A record of who accessed participant files, and why

What happens when records are incomplete

The consequences run from admin friction to enforcement.

• Held or rejected claims. The NDIA’s guide to getting paid says it may review claims before or after payment, place claims on hold while it requests evidence, and reject claims that are not valid or compliant. You get at least 14 business days to provide the information.
• Late claims. Claims submitted more than six months after service delivery may be held for review, which can take up to 28 days.
• Repayment. Failing to provide complete and accurate records in a Provider Payment Assurance review may result in funds having to be repaid.
• Regulatory action. The Code of Conduct guidance says responses to record-related breaches can include education, warnings and directions. Serious cases can lead to civil-penalty proceedings, deregistration, or banning of providers, key personnel or workers.

Most of these start the same way: a gap between what was delivered and what was written down. Claim promptly, and keep notes that match invoices line by line.

Documentation starts at referral

Most clinics think of compliance at the point of care and billing. The trail actually begins earlier, when a referral arrives by GP fax, email or web form. If the participant’s details, funding type, goals and urgency are scattered across inboxes, every later record inherits the gaps.

A few habits fix this at the source:

• Use one intake format, whichever channel the referral comes through
• Capture funding management type and referrer details at first contact
• Record why a participant was matched to a practitioner: specialty, location and appointment type
• Log consent and the date it was given
• Keep the referral attached to the participant’s file, not in a personal inbox

This is where we work. Meddle turns referrals from GPs, email and web forms into structured intake, triage and practitioner matching on specialty, travel radius and appointment type. Your team starts with a consistent record and spends less time retyping.

Our perspective

We talk to clinic owners and practice managers who say the same thing: the compliance problem is rarely a missing policy. It is a missing detail, a referral buried in an inbox, a note that never linked to a goal, a file nobody can find in time.

We built Meddle around the idea that good records begin with good intake. When a referral arrives, it should become a structured record straight away: who the person is, what they need, who referred them and which practitioner fits. That is what we mean by looking for the person, not the business.

A directory tells a participant who exists. We aim to connect the person to the right care and carry their story forward, so your practitioners do not start every file from scratch. Less admin at the front door leaves more time for the clinical notes that matter.

Compliance is a team habit, and the tools should make that habit the easy path. Clinics that tidy up intake first tend to find the rest of the documentation chain easier to hold together.

Taylor

Building a routine that holds

A practical rhythm for a multidisciplinary clinic:

• Daily: practitioners finish case notes before the next day’s first session. Reception checks that every attended session has a note and a logged claim.
• Weekly: the practice manager reviews open referrals, unsigned agreements and unclaimed sessions, so nothing drifts past the six-month mark.
• Monthly: sample five files and trace each from referral to invoice. Fix gaps and note the patterns.
• Quarterly: check worker screening and insurance expiry dates, and review incident and complaints logs.
• Annually: review policies, retention and access permissions, and update your evidence map.

Two more points protect you. Keep wording respectful and factual, because participants can see what you write about them. And restrict access by role, so each person sees only what they need. If cancellations affect your claims, our clinic cancellation policy templates help you set clear, documented terms.

See how structured intake works at Meddle

If your documentation trail begins in a crowded inbox, start there. Meddle gives your clinic structured intake, triage and practitioner matching, and it writes back to your CRM. There is a free 30-day pilot, so you can see it work on your own referrals. You can read how the Progression practice management tools fit alongside intake, or see how referrers use the platform.

To see how it would work for your clinic, book a 30-minute demo.

FAQ

Do unregistered NDIS providers need to keep records?

Yes. The NDIS Code of Conduct applies to registered and unregistered providers, and the NDIA expects accurate records and truthful claims from anyone delivering NDIS supports. Unregistered providers can only support self-managed or plan-managed participants. Check your obligations with the NDIS Commission if you are unsure.

How long do I keep NDIS participant records?

The Code of Conduct guidance says at least seven years after service provision. Worker-screening records covered by the rules are kept for seven years from the date the record is made. Other laws or your professional body may require longer, particularly for children’s records.

What should an NDIS case note include?

It should describe the activities, link them to the support item and the participant’s goals, and may include progress and plans for future sessions. Write it during or soon after the session, in respectful language. Record any feedback, complaints or incidents that arose.

What happens if I cannot produce records for a claim?

The NDIA may hold or reject the claim, and if you cannot supply complete and accurate records in a payment assurance review, you may have to repay the funds. You have at least 14 business days to provide requested information. Contact the NDIA promptly if you need guidance on a specific review.

Does the NDIS Commission audit every provider the same way?

No. The audit type depends on the risk and complexity of your supports, and the modules that apply depend on what you deliver. Lower-risk providers go through verification, which is a desktop audit. Your approved quality auditor can confirm which applies to you.

Sources

• What are the record keeping requirements | NDIS
• Guide to report writing | NDIS
• The NDIS Code of Conduct provider guidance
• Guide to becoming a provider | NDIS
• NDIS Practice Standards | NDIS Quality and Safeguards Commission
• About registration | NDIS Quality and Safeguards Commission
• NDIS Commission Provider Pack
• NDIS verification module required documentation
• NDIS (Practice Standards, Worker Screening) Rules
• NDIS (Provider Registration and Practice Standards) Rules
• Guide to getting paid | NDIS

Recommended

• NDIS reporting requirements: what registered providers must do
• My Health Record compliance for healthcare providers
• 90 day compliance plan for secure document sharing in Australia

This article is general information for healthcare businesses and isn’t legal, clinical or privacy advice. Check current requirements with the relevant regulator or a qualified adviser.