NDIS Reportable Incidents: What Providers Must Report and When (Complete Guide)

What is a "reportable incident" under the NDIS Act?

The definition of a "reportable incident" is established in sections 73Z and 73ZA of the National Disability Insurance Scheme Act 2013 (Cth). It is a defined legal term — not every incident that occurs in an NDIS setting is a reportable incident, and understanding the distinction is critical for compliance.

A reportable incident is an event that:

1. Occurs in connection with the provision of NDIS supports by a registered provider
2. Falls within one of the six categories specified in the Act (detailed below)
3. Involves a person with disability who is receiving, or has received, NDIS supports from that provider

The phrase "in connection with the provision of NDIS supports" is interpreted broadly. An incident that occurs at a support worker's home during a scheduled shift, or in a participant's own home, or in a community setting while a participant is receiving supports, can all be reportable incidents. The key is the nexus between the incident and the delivery of NDIS supports.

The 6 categories of NDIS reportable incidents

The following six categories of incidents are reportable to the NDIS Commission under sections 73Z and 73ZA of the NDIS Act:

1. Death of a person with disability

Any death of a participant that occurs in connection with the provision of NDIS supports must be reported to the Commission. This includes deaths that occur at a supported accommodation site, during a community access support, or while the participant is under the direct care of a support worker. It also includes unexpected deaths that occur at home and appear to be related to the supports being delivered — for example, where there may have been a failure to provide adequate care or monitoring.

The death of a participant must also be reported to the coroner in your state or territory if the death is sudden, unexpected, or the cause is unknown. These reporting obligations run in parallel — Commission notification and coronial notification are separate processes with separate timeframes.

2. Serious injury of a person with disability

A "serious injury" for NDIS reportable incident purposes includes injuries that are life-threatening, require hospitalisation, or result in significant ongoing harm to the participant. Examples include:

• Fractures (particularly in participants where a fracture may indicate an unsafe environment or inadequate supervision)
• Head injuries involving loss of consciousness
• Serious burns
• Injuries requiring surgical intervention
• Serious aspiration events in participants with dysphagia

Minor injuries — small cuts, superficial bruises, or injuries consistent with normal activities of daily living — are generally not reportable incidents, but should still be documented internally. Repeated minor injuries may indicate a pattern that warrants investigation.

3. Abuse or neglect of a person with disability

Abuse includes physical abuse (hitting, restraining, pinching), emotional or psychological abuse (verbal threats, intimidation, humiliation), financial abuse (misappropriating a participant's money or property), and systemic abuse (denying a participant access to supports they are entitled to). Neglect includes failing to provide adequate care, food, hygiene, medication, or supervision.

Importantly, this category applies regardless of who committed the abuse. Abuse by a support worker, by another participant sharing accommodation, by a family member, or by any other person in connection with the provision of NDIS supports is within scope.

4. Unlawful sexual or physical contact with (or assault of) a person with disability

Any unlawful sexual contact, sexual assault, or unlawful physical assault of a participant in connection with NDIS supports is a reportable incident. This category is distinct from the sexual misconduct category (below) in that it covers unlawful acts — criminal conduct — whereas sexual misconduct covers a broader range of inappropriate sexual behaviour that may not reach the criminal threshold.

All suspected criminal conduct against a participant must also be reported to police. Commission notification and police notification are separate and both required.

5. Sexual misconduct committed by a registered provider or its workers

Sexual misconduct covers sexual behaviour by a registered provider, key personnel, or worker toward a participant that does not necessarily constitute a criminal offence. This includes:

• Inappropriate sexual comments or advances
• Showing pornographic material to a participant without their request or consent
• Establishing or attempting to establish a sexual or romantic relationship with a participant
• Any sexual contact between a worker and a participant (even if the participant ostensibly consented — consent is not a defence in the NDIS context given the power imbalance)

6. Use of unauthorised restrictive practices

A "restrictive practice" is any practice or intervention that restricts the rights or freedom of movement of a person with disability. Restrictive practices include physical restraint, mechanical restraint, chemical restraint, environmental restraint, and seclusion.

An unauthorised restrictive practice is any use of a restrictive practice that has not been authorised through the correct process under the NDIS Commission's requirements. In most states and territories, this requires a Behaviour Support Plan developed by a registered Behaviour Support Practitioner, and specific state-based authorisation processes.

Reporting timeframes: 24 hours vs 5 days

The NDIS Commission's reporting requirements establish two tiers of timeframes:

24-hour reporting

The five most serious categories of reportable incidents — death, serious injury, abuse or neglect, unlawful contact or assault, and sexual misconduct — must be reported to the Commission within 24 hours of the registered provider becoming aware of the incident.

The clock starts when the provider (or a person in a managerial role) becomes aware — not when the incident occurred. This distinction matters: a support worker may become aware of an incident during an evening shift, but if they fail to escalate it until the next morning when management arrives, the 24-hour window runs from when management became aware, not from when the shift worker first knew. Your escalation procedures must ensure that workers understand they must report serious incidents immediately — including outside business hours.

5-day reporting

Unauthorised restrictive practices must be reported within 5 business days of the provider becoming aware. This longer timeframe reflects the fact that identifying and confirming an unauthorised restrictive practice sometimes requires more investigation than confirming a death or injury. However, the 5-day window is still tight — do not delay the report while waiting for a full investigation to be completed.

Follow-up incident report requirements

The initial report to the Commission within 24 hours (or 5 days) is a preliminary notification — it provides the basic facts of what occurred. The Commission then requires a follow-up report within 14 days that provides more detailed information about the incident, the investigation conducted, and the corrective actions taken or planned.

The follow-up report should include:

• A detailed factual account of the incident based on the investigation
• The names (or roles) of workers involved
• Any immediate actions taken to protect the participant
• The outcome of any internal investigation
• Root cause analysis findings
• Corrective actions implemented or planned (with completion dates)
• Any changes to policies, procedures, or practice as a result of the incident
• Whether the incident was also reported to police, the coroner, or another authority

The 14-day timeframe is also strict. If your investigation is not complete within 14 days — which may happen for complex incidents — submit the follow-up report with the information you have and note that the investigation is ongoing, with a revised completion date.

How to submit a reportable incident to the Commission

All reportable incident notifications must be submitted through the My NDIS Provider Portal (provider.ndis.gov.au). The portal has a specific incident notification section where you select the incident category, enter the required information, and submit.

Before submitting, ensure you have:

• The participant's details (name, NDIS number if available)
• The date, time, and location of the incident
• A factual description of what occurred (based on the initial information available)
• The names of workers present or involved
• Immediate actions taken

For the initial 24-hour report, you do not need to have completed a full investigation — the Commission understands that early notifications are based on preliminary information. What matters is that you report promptly and accurately with the information available at the time.

Post-incident review requirements

Beyond the Commission notification requirements, the NDIS Practice Standards (Quality Indicator 2.4 — Incident Management) require providers to conduct a post-incident review for all reportable incidents. The purpose of the review is to understand what happened, why it happened, and what can be done to prevent recurrence.

Root cause analysis

A root cause analysis (RCA) goes beyond the immediate cause of an incident to identify the underlying systemic factors. For example, if a participant fell because a support worker was not present as required, the immediate cause is the fall — but the root cause may be a rostering failure, inadequate supervision procedures, or insufficient risk assessment for the participant's needs.

Corrective action plan

Every post-incident review should produce a corrective action plan that identifies:

• Specific actions to be taken
• The person responsible for each action
• The completion date
• How the effectiveness of each action will be assessed

Record corrective actions in your Continuous Improvement Register so that they are tracked to completion and do not fall through the cracks. An auditor examining your incident management system will look for evidence that corrective actions from past incidents have actually been completed.

Staff obligations and duty of care

Support workers have an individual obligation to report incidents, near misses, and concerns about participant safety — both to their employer and, in certain circumstances, directly to the Commission. The NDIS Code of Conduct (obligation 6) requires workers to take reasonable steps to protect participants from abuse, neglect, and exploitation — and reporting suspected incidents is a core component of this obligation.

Workers should be trained to:

• Recognise the indicators of abuse, neglect, and exploitation
• Know how to complete an internal incident report
• Know who to escalate to within the organisation and how quickly
• Understand that they have a right to raise concerns with the Commission directly if they believe their employer is not responding appropriately
• Understand whistleblower protections — they cannot be victimised for reporting in good faith

Documentation of the incident is critical. Support workers should complete an Incident Report Form as soon as possible after the incident — while their recollection is fresh. The Notes Rewriter tool can help support workers write clear, factual incident descriptions that meet NDIS documentation standards.

Protecting participants after an incident

The immediate priority after a reportable incident is the safety and wellbeing of the participant. Before, during, and after the administrative reporting process, providers must ensure:

• The participant receives any necessary medical care immediately
• The participant is not left in the care of anyone involved in the incident pending investigation
• The participant is informed of the incident (in a manner appropriate to their communication needs) and of the provider's response
• The participant's guardian, nominee, or carer is notified as appropriate
• The participant's support is maintained without disruption while the incident is investigated

Participants have the right to access an independent advocate during an incident investigation. Your Incident Management Policy should include a provision for facilitating access to advocacy, and workers should know how to connect a participant with their state advocacy service.

Worker-on-worker incidents

A common question is whether incidents between co-workers — for example, a physical altercation between two support workers — are reportable incidents under the NDIS Act. The answer depends on the circumstances.

Worker-on-worker incidents are not NDIS reportable incidents unless:

• The incident occurs in a participant's home or accommodation and the participant is present or affected
• The incident involves conduct that directly affects a participant's safety or wellbeing (e.g., workers arguing loudly in front of distressed participants)
• The conduct constitutes a breach of the NDIS Code of Conduct in a way that affected a participant

Worker-on-worker incidents that do not involve or affect participants are workplace health and safety matters governed by the relevant WHS legislation in your state or territory. They should still be recorded in your internal incident register and managed through your HR processes, but they do not trigger the Commission reporting obligation.

A robust incident management system is one of the most important compliance investments a small NDIS provider can make — not just because it satisfies the auditor, but because it protects participants from harm and protects your organisation from the consequences of getting it wrong. The system only works if every worker knows their reporting obligations, management receives reports promptly, and corrective actions are actually implemented and tracked.