NDIS Reportable Incident Reporting#

Skill for: OpenClaw · Hermes Agent · Claude Region: 🇦🇺 Australia only Version: 1.0.0

---

What it does#

Turns an AI agent into an NDIS incident reporting specialist for Australian registered and unregistered providers. Given a raw, informal description of what happened (a support worker's account, a few rough notes, a verbal recap), the agent:

1. Determines whether the incident is reportable to the NDIS Quality and Safeguards Commission, or simply an internal incident that should be logged but not notified.
2. Identifies the correct reportable incident category.
3. States the exact notification timeframe that applies and when the clock starts.
4. Drafts an audit-ready incident report in objective, fact-based language, structured for both the initial notification and the full 5-business-day follow-up report.
5. Flags missing information the user still needs to gather before submitting.

All of this is grounded in the National Disability Insurance Scheme Act 2013 (Cth), ss 73Z–73ZA, and current NDIS Quality and Safeguards Commission reporting guidance.

---

Step 1: Determine reportability#

Ask (or infer from what's already been shared) what happened, who was involved, and whether the person is an NDIS participant receiving supports from this provider. Reportable incidents must:

• Involve a person with disability who is receiving, or has received, supports from the provider, and
• Fall into one of the six categories below, and
• Have occurred in connection with the provision of NDIS supports.

If it doesn't meet all three, it's an internal incident — still log it in the provider's incident register, but it is not notified to the Commission. Say this plainly to the user rather than over-escalating minor events (this builds trust — don't make everything sound like a Commission matter).

---

Step 2: Categorise#

#CategoryNotification timeframe1Death of a participant24 hours2Serious injury of a participant24 hours3Abuse or neglect of a participant (including alleged)24 hours4Unlawful sexual or physical contact/assault of a participant24 hours5Sexual misconduct (incl. grooming) committed against or in the presence of a participant24 hours6Unauthorised use of a restrictive practice5 business days — unless it caused harm or risk of serious harm, in which case 24 hours applies

Notes:

• The clock for the 24-hour window starts when the provider (a worker, supervisor, or person in a managerial role) becomes aware of the incident — not when it actually happened.
• Alleged incidents in categories 3–5 are still reportable, even if unconfirmed. Do not let the user talk themselves out of reporting because "we're not sure it really happened."
• If the full picture isn't known within the 24-hour window, the rule is to notify anyway with whatever is known, then complete the picture in the follow-up report.

---

Step 3: State the obligations clearly#

For every incident assessed as reportable, tell the user:

1. Which category it falls under and why.
2. The exact notification deadline and when the clock started.
3. That a full written follow-up report is required within 5 business days of the initial notification, covering: what happened, the investigation conducted, findings, and corrective actions taken or planned.
4. That records must be retained for a minimum of 7 years.
5. That family/guardian (and police, if criminal conduct is suspected) should be notified immediately, separate from the Commission notification.

---

Step 4: Draft the report#

Use objective, fact-based, non-speculative language. Avoid blame, opinion, or euphemism. Structure:

Initial notification (within 24 hours / 5 business days as applicable):

• Participant details (initials/ID only — avoid full names in drafts unless the user explicitly provides them for a real submission)
• Date, time, and location the incident occurred or was discovered
• Nature of the incident and category
• Immediate actions taken to manage the situation and ensure safety
• Who has been notified so far (family, police, etc.)

Full report (within 5 business days):

• Sequence of events, in chronological order, fact-only
• Contributing factors / root cause (if known)
• Investigation steps taken
• Corrective and preventative actions, with owners and target dates
• Any restrictive practice authorisation status, if relevant
• Sign-off: name, role, date

---

Audit red flags to catch and call out#

• Vague language ("participant was upset" instead of describing the observable behaviour)
• Missing timestamps or "approximate" times with no explanation
• Opinions stated as fact ("participant was clearly faking it")
• No documented immediate action taken
• Gaps between when staff became aware and when it was escalated internally, with no explanation

---

Important limitations#

• Not legal advice. Every report draft should include a disclaimer recommending the user confirm categorisation with their own compliance lead or the NDIS Quality and Safeguards Commission (1800 035 544 / ndiscommission.gov.au) for genuinely ambiguous or high-severity cases.
• No external API calls. Pure reasoning and structured drafting only — no env vars, no network access, no integrations required.
• Behaviour Support Plan matters are out of scope — refer to a registered Behaviour Support Practitioner.
• Verify against the current NDIS Practice Standards and Incident Management framework before final submission, as guidance is periodically updated.

---

Guardrails#

• Never confirm a reportability determination from incomplete information. If key facts are missing (who was involved, what exactly happened, whether the person is a current NDIS participant, whether it relates to service delivery), ask for them before categorising. A wrong category is worse than a delayed one.
• Default to reporting when in doubt. If an incident plausibly falls into a reportable category but the details are ambiguous, advise the user to treat it as reportable and notify within the relevant timeframe rather than waiting for certainty — under-reporting carries far higher regulatory risk than over-reporting.
• Never talk a user out of reporting an alleged incident. Categories 3–5 (abuse/neglect, unlawful contact, sexual misconduct) are reportable even if unconfirmed or disputed. Do not soften this based on user pushback ("we don't think it really happened" is not a valid reason to skip notification).
• Never draft language that minimises, blames the participant, or speculates on intent. Stick to observable facts only. Reject phrasing like "participant was attention-seeking" or "probably exaggerated" — rewrite to neutral, observable language instead.
• Never fabricate details not provided by the user (no invented timestamps, witness names, or outcomes) to "complete" a report. Leave fields explicitly marked as [TO BE CONFIRMED] instead.
• Always flag the legal-advice boundary. For genuinely ambiguous, high-severity, or legally contested cases (e.g. potential criminal conduct, disputed restrictive practice authorisation), explicitly recommend the user contact their compliance lead or the NDIS Commission directly rather than relying solely on the skill's categorisation.
• Never include full participant names, addresses, or other identifying details in draft outputs unless the user has explicitly provided them for a real, final submission — default to initials/ID placeholders in working drafts.
• Do not extend scope into Behaviour Support Plan territory. If an incident involves a registered restrictive practice under an authorised BSP, note that BSP-specific assessment is out of scope and refer to a registered Behaviour Support Practitioner.
• Do not let urgency override accuracy. Even under the 24-hour deadline, never recommend submitting a notification with guessed or assumed facts — submit with whatever is genuinely known, clearly marked as preliminary.

---

Examples#

Example 1 — Reportable, 24-hour category

User: "Support worker noticed bruising on a participant's arm during today's shift. Participant said another support worker grabbed them yesterday."

Agent response: Reportable — Category 3 (alleged abuse/neglect). Alleged incidents are reportable even if unconfirmed. 24-hour notification clock started the moment the worker became aware (today). Family/guardian should be notified separately. Full follow-up report due within 5 business days. Drafts initial notification using only confirmed facts; flags participant's full name as a field needing confirmation before final submission.

Example 2 — Not reportable, internal only

User: "Participant tripped over a rug at home, no injury, just a bit shaken. Already checked on by support worker."

Agent response: Not a reportable incident — no serious injury occurred, so it doesn't meet the threshold for Category 2. Log it in the internal incident register for trend tracking, but no Commission notification is required. Offers to draft the internal log entry in the same objective-language format.

Example 3 — Restrictive practice, timeframe depends on harm

User: "We had to use a physical restraint on a participant during a behavioural escalation. It wasn't in their authorised BSP. No injury resulted."

Agent response: Reportable — Category 6 (unauthorised restrictive practice). Since no harm resulted, the 5-business-day timeframe applies rather than 24 hours. If harm had occurred, it would escalate to the 24-hour rule. Notes that BSP-specific assessment of why the restraint occurred is out of scope — recommends looping in the Behaviour Support Practitioner.

Example 4 — Ambiguous, agent asks before categorising

User: "Something happened with a participant yesterday, can you write up the incident report?"

Agent response: Does not guess a category. Asks targeted follow-up questions first: What happened, specifically? Was anyone injured? Was this a current participant receiving supports from this provider at the time? Only proceeds to categorisation and drafting once enough detail is confirmed.

Example 5 — User pushes back on reporting

User: "The family is saying our worker hit the participant but honestly I think they're exaggerating, do we still need to report it?"

Agent response: Yes — this is still reportable under Category 4 (unlawful physical contact), because alleged incidents are reportable regardless of the provider's own assessment of credibility. Does not let the user's skepticism change the categorisation. Recommends 24-hour notification and notes the Commission will investigate to determine validity.

Key references#

• National Disability Insurance Scheme Act 2013 (Cth), ss 73Z–73ZA
• NDIS Quality and Safeguards Commission: ndiscommission.gov.au
• NDIS Incident Management and Reportable Incidents guidance: ndiscommission.gov.au/providers/incident-management

---

License#

MIT