NDIS Reportable Incident requirements

In plain English

A Reportable Incident is a defined category of event that registered NDIS providers must notify the NDIS Quality and Safeguards Commission about, separate from general incident management. The five categories — death, serious injury, abuse or neglect, unlawful sexual or physical contact, and unauthorised use of a restrictive practice — are set out in the National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018.

The reporting clock has two stages. First, an initial notification within 24 hours of the provider becoming aware of the incident. Second, a full report within 5 business days with the investigation findings, evidence, and corrective actions. Unauthorised use of a restrictive practice has its own 5-business-day initial reporting clock.

Failing to report a Reportable Incident is itself a civil-penalty contravention under section 73Z of the NDIS Act — up to $330,000 per breach for an individual and $1,650,000 for a body corporate. It is also one of the most common triggers for compliance action, because the Commission learns about unreported incidents through complaints, audit samples, and (increasingly) data-sharing with state coroners and health departments.

What counts as a Reportable Incident

1. Death of a participant

Any death of an NDIS participant that occurred in connection with the provision of supports or services. This includes deaths during a shift, deaths in a SIL house, and deaths where supports may have been a contributing factor — even if the immediate cause was natural.

2. Serious injury of a participant

An injury that meets one or more of: required immediate medical treatment by a medical practitioner; resulted in admission to hospital; resulted in a permanent or long-term impairment. Falls that produce fractures, medication errors leading to hospitalisation, and burns requiring treatment are routine examples.

3. Abuse or neglect of a participant

Includes physical, sexual, emotional, psychological, and financial abuse, plus neglect. Allegations count — the provider must report on a reasonable suspicion, not wait for proof. The Commission's view is that under-reporting in this category causes the most harm, so it is enforced aggressively.

4. Unlawful sexual or physical contact with, or assault of, a participant

A discrete category from #3 because it interfaces with state criminal law — sexual or physical assault triggers police notification as well as Commission reporting. The provider is expected to support the participant's choice about police involvement and not interfere with any investigation.

5. Use of a restrictive practice in relation to a participant where the use is not in accordance with an authorisation or a behaviour support plan

Any unauthorised use of restrictive practice — chemical, mechanical, physical, environmental, or seclusion — even if no harm occurred. This category has a 5-business-day initial reporting clock rather than 24 hours, reflecting that the assessment of whether use was unauthorised often requires reviewing the participant's current behaviour support plan and any state-based authorisations.

The two reporting clocks

24-hour initial notification (categories 1–4)

For deaths, serious injuries, abuse/neglect, and unlawful sexual or physical contact, the provider must submit an initial notification within 24 hours of becoming aware. The notification is filed via the NDIS Commission's online Portal or through the My Reportable Incidents form. Information required at this stage:

• Date, time, and location of the incident.
• Participant name, NDIS number, and key contact details.
• Brief description of what happened.
• Workers involved (named) and their role during the incident.
• Immediate actions taken — medical attention, police notification, family notification, removal of worker from rostering pending investigation.
• Whether the participant's representative, guardian, or advocate has been notified.

5-business-day full report (all categories)

The full report is due within 5 business days from the initial notification (or, for restrictive practice, 5 business days from awareness). It must include the investigation findings, contributing factors, any other regulators notified (police, Worksafe, state coroner), and a corrective action plan. The Commission may extend this window on request with reasons.

Restrictive practice 5-business-day clock

Unauthorised use of a restrictive practice is a single 5-business-day clock with no 24-hour initial step. The longer window reflects the time needed to verify whether the practice was authorised under the participant's current behaviour support plan and any state authorisation regime. Where the use also caused injury (e.g. mechanical restraint leaving a bruise), the 24-hour clock for the injury runs in parallel.

What the Commission does with the report

The Commission's Reportable Incidents Branch triages every report. Outcomes range from no further action (the provider's response was adequate and the incident has been resolved) through monitoring, formal request for additional information, on-site visit, formal investigation under Part 3A, conditions on registration, banning orders, and civil penalty proceedings.

The Commission also looks for patterns— repeated reportable incidents at the same provider, the same SIL house, or involving the same worker. Pattern recognition often triggers escalation even where each individual incident was handled adequately.

The penalty for not reporting

Failure to notify is a civil-penalty contravention under section 73Z of the NDIS Act. The maximum civil penalty per contravention is 1,000 penalty units for an individual ($330,000 at the November 2024 penalty unit value) and 5,000 penalty units for a body corporate ($1,650,000). Each unreported incident is a separate contravention.

The bigger risk in practice isn't the civil penalty itself — it's the cascade. The Commission treats failure to report as evidence of poor governance, which triggers a broader compliance investigation that often uncovers other systemic problems. A provider that self-reports a serious incident and demonstrates a competent response routinely closes out with no further action. A provider where the Commission learns about the same incident from a family complaint usually faces conditions on registration.

How Checkbase helps

Checkbase's Incident Register captures every incident with a structured timeline, flags incidents that meet the Reportable Incident criteria, tracks the 24-hour and 5-business-day clocks against the timestamp of awareness, and surfaces overdue close-outs before an auditor or complainant does. When the Commission asks for documentation, the export pack is one click — full incident detail, contributing factors, corrective actions, and the trail of who saw what when. The cheapest insurance against an escalating investigation is documentation hygiene.

Frequently asked questions