NDIS Compliance & Provider Obligations

Every NDIS provider and worker - registered with the NDIS Quality and Safeguards Commission or not - has to follow the NDIS Code of Conduct. Providers registered with the Commission also have to meet the NDIS Practice Standards, which the Commission audits them against. This page is a plain-language summary to help you recognise what good practice looks like, and what to do if something seems off - it isn't legal advice, and the rules can change, so check ndiscommission.gov.au for the current detail.

Applies to every provider and worker, no matter how they're engaged:

• Respect your rights

  Act with respect for your right to freedom of expression, self-determination, and to make your own decisions - including decisions others might not agree with.

• Respect your privacy

  Only collect, use and share your personal information as needed to provide supports, and keep it secure.

• Provide supports safely and competently

  Deliver services with care and skill, and raise or act on any concern that could affect the quality or safety of your supports.

• Act with integrity, honesty and transparency

  Be upfront about what's being provided, what it costs, and any conflicts of interest.

• Prevent violence, exploitation, neglect and abuse

  Take all reasonable steps to prevent and respond to violence, exploitation, neglect and abuse of people with disability.

• Prevent and respond to sexual misconduct

  Take all reasonable steps to prevent sexual misconduct, and respond appropriately if it happens or is disclosed.

• Search the NDIS Provider Register on the NDIS Commission website. It shows if a provider is registered, and what types of support they are registered for.
• The NDIS Commission website also lists compliance actions, such as providers or workers who have been banned.
• If the NDIA manages your plan, you can only use registered providers. If you self-manage or have a plan manager, you can also use unregistered providers. They still have to follow the Code of Conduct.
• You can ask any provider to show you their registration. A good provider won't mind.

A proper service agreement should set out, in a format you can understand:

• What supports will be provided, and how often
• What everything costs
• The cancellation policy, in plain language
• How either side can end the agreement

You're entitled to ask for this in an accessible format - Easy Read, another language, or read aloud to you - and to take your time deciding before you sign anything.

Registered providers can only charge within the current NDIS Pricing Arrangements, and can only charge a short-notice cancellation fee in limited circumstances set out in those rules. If a cancellation charge doesn't match what's in your service agreement, or seems to happen every time regardless of notice given, it's worth asking about it directly.

Anyone in a "risk-assessed role" at a registered provider - working alone with you, or with more than incidental contact - is required to hold a valid NDIS Worker Screening Check. You can ask a provider whether a worker holds one.

Registered providers must have a system for managing incidents, and must report certain serious incidents (like abuse, neglect, serious injury, or an unauthorised restrictive practice) to the NDIS Commission as a "reportable incident."

A regulated restrictive practice (like restraint or seclusion) should only ever be used as a last resort, be authorised under your state or territory's process, be written into a behaviour support plan, and be reported to the NDIS Commission. If a restrictive practice is being used that isn't authorised or in a plan, that's worth raising as a concern.

Registered providers must have an accessible way for you to make a complaint, and can't retaliate against you (for example, by withdrawing supports) for making one.