← All articles

NDIS reporting requirements: what registered providers must do

NDIS reporting requirements: what registered providers must do

Decorative title card illustration for healthcare reporting article

Registered NDIS providers must notify the NDIS Commission of every reportable incident and keep complete, accurate records to support their claims. Two forms carry this obligation: the Immediate Notification Form and the 5 Day Form, both submitted through the NDIS Commission Portal’s My Reportable Incidents function.

The timeframes are non-negotiable:

  • 24 hours for incidents causing harm, death, serious injury, abuse, neglect, or unlawful contact
  • 5 business days for other reportable incidents, measured from when your organisation became aware

In the first hour after you learn of an incident:

  1. Secure the person’s immediate safety and wellbeing
  2. Preserve evidence and assign a responsible staff member
  3. Lodge the Immediate Notification via the My Reportable Incidents portal

Key Takeaways

Meeting NDIS reporting requirements comes down to knowing your statutory timeframes, notifying through the correct portal form, and keeping seven years of audit-ready records.

Point Details
Two statutory timeframes Notify within 24 hours for harm-related incidents, 5 business days for others, from when you became aware.
Two mandatory forms Use the Immediate Notification Form first, then the 5 Day Form to add investigation detail.
Seven year retention Keep incident records, invoices, support logs, and case notes for seven years to survive audits.
Meddle supports the workflow Meddle’s live records and practice tools help clinics keep documentation current between report deadlines.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

Table of Contents

What counts as a reportable incident under NDIS reporting requirements?

Not every workplace mishap triggers a notification, but the list of what does is broader than most providers expect. The NDIS (Incident Management and Reportable Incidents) Rules 2018 sets out six categories:

  1. Death of a participant
  2. Serious injury of a participant
  3. Abuse or neglect of a participant
  4. Unlawful sexual or physical contact, or assault, involving a participant
  5. Sexual misconduct, including grooming, committed against or in the presence of a participant
  6. Unauthorised use of a restrictive practice

An alleged incident is enough to trigger the obligation. You do not need proof, a completed internal investigation, or a police finding before you notify. If a staff member reports something that sounds like it fits one of these six categories, the clock has already started.

This catches providers out constantly. An incident recorded, resolved, and filed internally still needs reporting to the Commission if it fits these categories, regardless of how well you think you handled it.

How do you calculate NDIS reporting timeframes?

The clock starts the moment your organisation becomes aware, not when the incident happened. A support worker who witnesses an incident on Saturday afternoon starts your 24 hour countdown at that moment, weekend or not.

Incident type Notification window Clock starts
Death, serious injury, abuse, neglect, unlawful contact, sexual misconduct 24 hours When provider becomes aware
Unauthorised restrictive practice, other reportable incidents 5 business days When provider becomes aware

Worked example: A support worker becomes aware of a serious injury at 6pm Saturday. The 24 hour notification deadline falls at 6pm Sunday, regardless of office hours. Weekend rosters need a clear line to whoever holds authority to submit the Immediate Notification Form, because “we’ll deal with it Monday” is already a breach by the time Monday arrives.

How do you notify the NDIS Commission of an incident?

Notification happens through the NDIS Commission Portal, under My Reportable Incidents. The process is straightforward once your team knows the steps:

  • Log in to the NDIS Commission Portal with your provider credentials
  • Navigate to My Reportable Incidents and select “new notification”
  • Complete the Immediate Notification Form with the details available to you at the time
  • Save your confirmation reference as proof of timely lodgement

Two forms, two purposes:

  • The Immediate Notification Form captures the essentials fast, within the 24 hour or 5 business day window, even if your information is incomplete
  • The 5 Day Form follows up with fuller detail, investigation findings, and remedial actions once you’ve had time to establish facts

Pro Tip: Don’t wait for a complete picture before you notify. Submit what you know inside the deadline, then use the 5 Day Form to add detail as your internal investigation progresses.

What records must you keep to meet NDIS documentation requirements?

An incident management system isn’t a policy document sitting in a drawer. The NDIS Rules 2018 require a working system for identifying, assessing, and resolving incidents, with procedural fairness built in for anyone involved.

Your record-keeping checklist needs to cover:

  • Invoices, showing provider business name, ABN, support item number, claim type and GST component where applicable
  • Signed support logs, confirmed by the participant or their authorised representative
  • Rosters matching actual hours delivered against hours claimed
  • Case notes with enough detail to reconstruct what happened and why
  • Service agreements current for the relevant plan period

Every record needs minimum identifying information: participant name, NDIS number, date, hours or quantity delivered, support type, and the relevant support item number from the NDIS Support Catalogue.

Incident records specifically must be retained for seven years. That retention period matters beyond compliance box-ticking: the Provider Payment Assurance Program reviews claims against documentation, and mismatches between what you billed and what your logs show can trigger repayment demands years after the support was delivered.

What reports do you need to submit for NDIS participant funding reports?

Beyond incident reporting, most providers carry a separate stream of scheduled reports tied to plan management. Support coordinators face the tightest early deadline: the initial plan implementation report is due eight weeks after a plan starts or a service is accepted.

Common report types include:

  • Initial plan implementation report due some weeks after a plan starts
  • Mid-term or progress reports throughout the plan period
  • Plan reassessment and evaluation reports near plan end
  • Early childhood and allied health reassessment reports tied to developmental milestones

Each report should summarise supports delivered, progress against goals, barriers encountered, and evidence backing any recommendations for the next plan. The NDIS guide to report writing notes these reports often influence whether a participant’s next plan looks the same or changes significantly, so vague summaries do participants a disservice. Downloadable templates exist for support coordinators, including recovery coach and support coordinator implementation report formats, and most reports get submitted as attachments through the My NDIS provider portal.

What happens after you submit a reportable incident notification?

Once lodged, the Commission typically acknowledges receipt and may request further information as your investigation develops. For more serious matters, this can extend to:

  1. Commission review of your Immediate Notification and any 5 Day Form follow-up
  2. Requests for additional evidence or clarification
  3. Internal or external investigation, potentially independent of your organisation
  4. Corrective action requirements if systemic issues surface

If the Commissioner requests a final report, providers generally have 60 business days to deliver it. Enforcement responses for poor compliance range from infringement notices through to repayment orders or a requirement to commission an independent investigation at your own cost. A documented, timely internal investigation is your best protection against escalation.

What is not a reportable incident to the NDIS Commission?

Confusion here costs providers time and, occasionally, credibility with the Commission through over-reporting or under-reporting.

Do report: anything fitting the six statutory categories connected to your NDIS supports, even alleged, even if resolved internally.

Don’t assume you’re covered by silence: general complaints, service dissatisfaction, or incidents entirely unconnected to NDIS-funded supports usually fall outside the reportable incident regime, though state mandatory reporting laws for children or vulnerable adults may still apply separately. Matters involving potential criminal conduct often need police involvement first, alongside your Commission notification, not instead of it.

Pro Tip: Build a simple triage rule: if the incident happened in connection with an NDIS support and fits one of the six categories, escalate to your authorised officer within the hour, don’t wait for a team meeting.

How do you build an audit-ready NDIS compliance workflow?

Treat reporting as infrastructure, not improvisation. A workable process runs like this:

  1. Detect the incident and secure immediate safety
  2. Capture evidence while details are fresh
  3. Submit the Immediate Notification within the statutory window
  4. Run your internal investigation with procedural fairness for all involved
  5. Lodge the 5 Day Form with findings and remedial actions
  6. Prepare a final report if the Commissioner requests one

Map responsibility clearly: one role owns portal submissions, another signs off on record accuracy, and someone maintains the incident register as a living document rather than a post-incident scramble.

  • Reconcile support logs against invoices weekly, not annually
  • Run a monthly internal incident review across all logged events, not just Commission notifications
  • Keep progress records live throughout the plan period so reassessment reports become an export, not a rewrite — following principles from Near Miss Reporting for Safety Managers: Set Up and Act can help maintain this living document approach

Pro Tip: Practices that treat documentation as a daily habit rather than a monthly catch-up rarely scramble when an audit notice lands.

A note from the editorial desk

Reporting obligations feel like paperwork until an audit lands, then they’re the difference between a clean review and a stressful one. Treat every notification and every log entry as evidence you’re building for your future self. Tools like Meddle’s practice management features can help keep that evidence current without adding to your team’s workload.

How Meddle keeps your practice audit-ready without the admin drag

Meddle is built for allied health clinics juggling exactly this kind of compliance load, live progress logs, secure records, and consistent documentation without a full-time compliance hire. Instead of scrambling to reconstruct case notes before a Provider Payment Assurance review, your team’s support logs, session notes, and scheduling data stay in one connected system, ready to export the moment a report is due.

Meddle

Practitioners using Meddle’s practitioner tools report reclaiming hours each week that used to disappear into manual documentation. If your practice is still stitching together spreadsheets, rosters, and case notes from three different systems every time a report is due, that’s the gap Meddle closes. Explore the simple rollout options for allied health clinics starting from $25 per practitioner, and see how much administrative time your team could get back.

Sources

FAQ

What are the reporting requirements for NDIS incidents?

Registered providers must notify the NDIS Commission of reportable incidents within 24 hours for harm-related events or 5 business days for others, using the Immediate Notification Form and 5 Day Form via the NDIS Commission Portal.

What are the six reportable incident categories?

The NDIS Rules 2018 list death, serious injury, abuse or neglect, unlawful sexual or physical contact or assault, sexual misconduct including grooming, and unauthorised use of a restrictive practice.

What are the requirements for an NDIS progress report?

Progress reports should summarise supports delivered, evidence of progress toward plan goals, any barriers encountered, and justification for continuing or changing supports, generally submitted via the provider portal.

What is not a reportable incident to the NDIS Commission?

General service complaints or incidents unconnected to NDIS-funded supports typically fall outside the reportable incident regime, though separate state mandatory reporting obligations may still apply.

What is not a reportable incident to the NDIS Commission? — overview diagram

How can Meddle help with NDIS reporting obligations?

Meddle keeps support logs, case notes, and scheduling data connected in one system, so practices can generate audit-ready records without manually reconstructing documentation before each report is due.