NDIS providers
Participant information, kept in order without slowing support.
Providers hold participant records, rosters and incident notes across the office and out on support. The NDIS Practice Standards treat information management as part of how a provider runs — who can see a record, how it is kept, and what happens when something goes wrong. Whether a particular standard applies to you is a question for your compliance adviser. We help you get the facts together.
Your IT provider does the work. You’re the one who signs the insurer’s form.
In 2024–25, the average self-reported cost of cybercrime per report for a small business was A$56,600. ASD Annual Cyber Threat Report 2024–25.
Free 10-minute check
See whether you could answer an insurer’s cyber questions today. Eight short steps, no account.
Start the free 10-minute checkA first step
If a support worker’s phone was lost with participant notes on it, could you say who had access and whether the information was protected?
In the Compliance Platform
- 1Record how participant information is stored today: the practice system, email, shared drives and anything kept on personal phones.
- 2Answer the questions on who can open those records, and send the ones you cannot answer to your IT provider.
- 3Turn a gap into an action, such as removing a leaver’s access or turning on a screen lock, with a named owner.
- 4Attach the result, so you have something to show at an audit or when an insurer asks.
What we can do for you
Cyber Guys can work through information-handling and access with you and your IT provider under an agreed scope, and leave the evidence with the answers.
Done-for-You CyberWhat staff could practise
Support staff practise what to do when a record is emailed to the wrong person, or when a participant’s details are asked for over the phone.
User Awareness TrainingOther situations we see
A shared login at the front desk
One account on the rostering computer, used by whoever is on shift, left signed in between people.
What helps: An account for each person, a short screen lock, and access that matches the role — set up so a shift change does not become a workaround.
Participant notes on a personal phone
A support worker photographs a care note or keeps a participant’s address in a personal messaging app so the shift is easier.
What helps: A written rule for where participant information is allowed to live, and a way to do the same job inside the systems you already pay for.
An incident report that also names other people
An incident note includes health information about a participant and contact details for a family member, and it is emailed to a wide list.
What helps: A short rule for who is on that email, and staff who have practised stopping and checking before they send.
Privacy duties, including the Notifiable Data Breaches scheme, may apply when personal information is involved. Whether they apply to you is a question for your adviser. Read the terms.
Could you say who can open a participant record today?
Join the founding member waitlist, or take the free 10-minute check before the next audit or insurer question.