NDIS reportable incidents: what must be notified and when
A registered NDIS provider must notify the NDIS Commission of every reportable incident. Death, serious injury, abuse or neglect, unlawful contact or assault, and sexual misconduct are due within 24 hours of becoming aware. Unauthorised use of a restrictive practice is due within 5 business days.
Key takeaways
- Reportable incidents are notified through the NDIS Commission Portal, starting with an Immediate Notification Form.
- Most categories must be notified within 24 hours; an unauthorised restrictive practice that caused no immediate harm needs only the 5 Day Form within 5 business days.
- Timeframes run from when the provider becomes aware of the incident, so recording when and how you became aware matters.
- Every incident, reportable or not, should be recorded in the provider’s own incident management system.
Which incidents are reportable to the NDIS Commission?
The NDIS Commission defines a reportable incident as an act or event that has happened, or is alleged to have happened, in connection with delivering NDIS supports or services. Registered providers must notify the Commission of all reportable incidents, including those already recorded and responded to in their own incident management system.
| Reportable incident | Notify within |
|---|---|
| Death of a person with disability | 24 hours |
| Serious injury of a person with disability | 24 hours |
| Abuse or neglect of a person with disability | 24 hours |
| Unlawful sexual or physical contact with, or assault of, a person with disability | 24 hours |
| Sexual misconduct against, or in the presence of, a person with disability, including grooming | 24 hours |
| Use of a restrictive practice that is unauthorised by the state or territory, or does not follow a behaviour support plan | 5 business days |
Timeframes are calculated from when the registered provider became aware of the incident. If an incident has resulted in harm to a person with disability, it must be reported within 24 hours.
How does a provider notify the NDIS Commission?
A provider logs in to the NDIS Commission Portal, opens My Reportable Incidents and submits two forms. The Immediate Notification Form is due within the timeframe above, in most cases 24 hours. The 5 Day Form supplies additional information and the actions taken, and is due within five business days. For unauthorised use of a restrictive practice that has not caused immediate harm, the 5 Day Form is the only form needed.
What should be recorded in the provider’s own system?
The Commission expects registered providers to have an incident management system and to record the details and any evidence of each incident, stored in a way that keeps the privacy and confidentiality of the people affected. Its steps are to identify the incident, support the impacted person straight away, record the incident, report and assess it, investigate where needed, and use the learnings. A worker who is unsure whether something is reportable should escalate to the person responsible in the provider’s procedure.
Fictional example. No real participant data.
Participant had a fall. Bruise on arm. Okay now.
Fall in the participant’s kitchen at about 2.15 pm. Worker saw the participant slip while reaching for a cup. Bruise about 5 cm on the left forearm, no other injury visible. Participant alert and able to describe what happened. First aid applied, supervisor phoned at 2.25 pm, and the incident entered in the incident system at 2.40 pm. Supervisor to assess whether the injury is a reportable incident.
Where does NoteGate fit?
NoteGate Incident Reporting (IRA) gives workers a structured way to record an incident and links it to the related shift note and the risk register. It supports the provider’s own documentation. Notification to the NDIS Commission remains the provider’s responsibility and is made through the Commission Portal.
Frequently asked questions
Does the 24-hour clock start when the incident happens?
No. The NDIS Commission calculates timeframes from when the registered provider became aware of the incident, so record when the provider learned of it.
Do all incidents have to be reported to the Commission?
No. Only reportable incidents must be notified. Other incidents still need to be identified, recorded, assessed and managed in the provider’s incident management system.
What if I miss the timeframe?
The Commission states that failing to report within the timeframes might result in an infringement notice or other compliance actions.
How long must incident records be kept?
For 7 years. The Incident Management and Reportable Incidents Rules require an incident record to be kept for 7 years from the day it is made, and a reportable incident record for 7 years from the day the Commission is notified. Other laws may add retention requirements.
Sources
- Reportable incidents (NDIS Quality and Safeguards Commission, retrieved 19 September 2026)
- Incident management and reportable incidents (NDIS Quality and Safeguards Commission, retrieved 19 September 2026)
- Behaviour support and restrictive practices (NDIS Quality and Safeguards Commission, retrieved 19 September 2026)
- NDIS (Incident Management and Reportable Incidents) Rules 2018, sections 12 and 25 (Federal Register of Legislation, retrieved 19 September 2026)
- Incident Management Systems Detailed Guidance for Registered NDIS Providers (NDIS Quality and Safeguards Commission, retrieved 19 September 2026)
Related
Record incidents in a structured way
See how NoteGate Incident Reporting links an incident to the shift note and risk register.
Book a 20-minute walkthroughChoose a plan