Every registered NDIS provider we talk to has heard that the NDIS Practice Standards require “secure IT systems,” and almost none of them have been told what that actually means in practice. The Standards don’t name a product, a platform or a technical control. They describe outcomes, and it’s left to the provider to work out what satisfies them — which is exactly where organisations either over-spend on the wrong thing or under-deliver on the thing an auditor will actually ask about.
This guide sets out which parts of the NDIS Practice Standards touch your IT systems, what the Information Management and Risk Management outcomes require in practice, what changed with the recent registration reforms, and how an auditor checks any of it.
Two outcomes inside the Core Module’s Governance and Operational Management division carry almost all of it.
Outcome 2.4 — Information Management is the direct one. It requires a provider to manage information — participant records and organisational records alike — accurately, securely, and so that it’s accessible only to the people authorised to see it, across its full lifecycle from collection through to disposal.
Outcome 2.2 — Risk Management is the indirect one, and it’s where backups and business continuity actually live. A risk register that doesn’t treat “our rostering and case management system becomes unavailable” as a rated risk with a documented response is incomplete, whatever the Information Management policy says.
The Core Module applies in full to every provider on the certification pathway — there’s no partial version of it. If you deliver Supported Independent Living, specialist behaviour support, high-intensity daily personal activities or early childhood supports, you’re also assessed against a Specialist Module on top of the Core Module, but the IT-relevant content sits in the Core Module regardless of which specialist group you’re in.
If you’re on the verification pathway — a sole allied health practitioner or a standard support coordinator, for example — you’re not assessed against the full Practice Standards. That’s a document review of qualifications, insurance, worker screening and a smaller set of written policies, not an on-site audit. Most organisations reading this, though, are certification-pathway providers, and it’s that audit we’re describing below.
They changed who has to be registered, more than what registered providers have to do technically. The most consequential date for many organisations is 1 July 2026: from that date, Supported Independent Living providers (registration group 0115) must hold registration and demonstrate Core Module compliance. Delivering SIL supports without registration after that date isn’t a paperwork gap — it’s an offence under the NDIS Act.
If your organisation has been operating unregistered on the basis that your supports sat outside the old registration requirements, the practical IT consequence is that your record-keeping, access controls and information management now need to be audit-ready on the same timeline as everyone else’s, often with far less lead time to get there.
For providers already registered, the Information Management and Risk Management outcomes themselves haven’t been rewritten. What has tightened is enforcement — the NDIS Commission’s audits increasingly test whether staff can describe the policy in their own words and whether participant records actually reflect it, not just whether a policy document exists on file.
Strip away the audit language and it comes down to five things, each of which has a direct IT dependency.
Information is accurate and current. Support plans, risk assessments and progress notes have to reflect the participant’s actual situation, not a version from a year ago. This is a records-management discipline more than a technology one, but it depends on a system that makes the current version easy to find and the superseded ones easy to tell apart from it.
Information is only accessible to authorised people. This is an access control requirement in plain clothes: individual logins rather than a shared password, permissions that match a person’s actual role, and no participant file open to every staff member regardless of whether they work with that participant.
Information is securely stored, in both paper and electronic form. A locked filing cabinet still counts for paper records. For anything electronic, this is where encryption, secure hosting and mobile device controls sit.
Retention and disposal follow a defined schedule, not habit. Providers need a documented retention period for each record type and a defined, secure disposal method once that period ends — including for records held on old devices and in email.
A privacy and data breach response procedure exists and is followed. Not just a document — the organisation needs to be able to show what happens practically if a laptop is lost or a record is sent to the wrong person.
None of this specifies a platform. The Commission is explicit that it doesn’t prescribe a particular technology for record keeping. What it does expect is that whatever system you use — a dedicated NDIS platform, a general-purpose cloud suite, or a mix of both — actually does these five things, and that you can point to how.
No, but it’s worth being honest about the gap between “technically compliant” and “practical to run.” A platform built for the sector — ShiftCare, CareMaster and MYP are the three we see most often in WA organisations — bundles individual logins, role-based access, audit trails and backups into the product by default. Meeting Outcome 2.4 with one of these is largely a matter of configuring it correctly rather than building the controls from scratch.
Running participant records through general-purpose tools like Microsoft 365 or shared drives can also meet the Standard, but every control listed above then has to be deliberately configured and documented rather than inherited from the platform. For an organisation of one to five staff that’s a manageable amount of configuration. Past that size, it becomes labour-intensive to keep consistent, and it’s usually where we see the biggest gap between what an organisation believes is happening and what’s actually configured.
Whichever path you’re on, we’d add one preference of our own: keep participant data on Australian-hosted infrastructure. It isn’t an explicit Practice Standards requirement, but it removes an entire category of cross-border disclosure question under the Australian Privacy Principles before it can come up.
Nowhere by that name, and that’s worth saying plainly because it surprises people. There’s no NDIS-specific equivalent of the Essential Eight written into the Standards. What you have instead is Outcome 2.4’s requirement for “appropriate access controls and security measures,” which is deliberately broad, and Outcome 2.2’s requirement to treat information and system risks as risks like any other — rated, mitigated and reviewed.
In practice, the technical controls that satisfy an NDIS auditor and the ones that satisfy an Essential Eight assessment overlap heavily: unique accounts, multi-factor authentication on administrative access, current patching, and controlled access to participant data all serve both. If your organisation has already worked through Essential Eight uplift — or read our guide to Essential Eight for general practice, which walks through the same eight strategies — you’re most of the way to satisfying Outcome 2.4’s security expectations as well, even though the NDIS Commission will never ask for your Essential Eight maturity level by name.
This is where “our case management system is down” has to live as a named, rated risk rather than an assumption that it won’t happen. A risk register that satisfies an auditor treats system unavailability the same way it treats a workforce shortage or a natural disaster: likelihood and consequence rated, a mitigation assigned, and a review date attached.
The mitigation an auditor wants to see evidence of, not just hear described, is a working backup:
The last point matters specifically to NDIS providers in a way it doesn’t for a general business: continuity of supports is itself one of the outcomes the Commission assesses, separate from Information Management. A backup plan that only protects the data, without a plan for keeping supports running while systems are down, only answers half the question an auditor is going to ask.
Longer than most default IT retention settings assume, and long enough that “we’ve always just kept everything indefinitely” is not the same as having a defined schedule. As a working baseline for a WA provider:
| Record type | Minimum retention |
|---|---|
| Participant service records | 7 years from creation or last service |
| Records relating to a child participant | Until the participant turns 25 |
| Incident records | 7 years |
| Worker screening and employment records | 7 years after employment ends |
| Complaints records | 7 years from resolution |
| Financial records | 7 years |
Two things trip organisations up here. First, a participant leaving your service is not a trigger to delete their file — the retention clock keeps running from their last service date, not from today. Second, these are minimums set with reference to the relevant Commonwealth and state record-keeping obligations that sit alongside the NDIS rules, not a Practice Standards number you’ll find written as a single figure — so where your organisation handles a record type that isn’t on this list, that’s a question worth putting to your own compliance adviser rather than assuming a default.
Not by asking to see your policies and taking your word for it. Certification audits under the Practice Standards work by sampling: an auditor picks a handful of participant files and a handful of staff, and checks whether what’s written in the file and what the staff member describes actually match the policy on paper.
For the Information Management outcome specifically, that means an auditor might ask a support worker to show how they’d look up a participant’s current support plan, then check whether the version they land on is actually the current one. It means checking whether a former participant’s file still exists and is still retained rather than deleted. It means asking who has access to the case management system and comparing that list against who actually needs it for their role.
The organisations that struggle at audit are rarely the ones with the wrong software. They’re the ones where the policy document says one thing and the day-to-day system access doesn’t match it — an ex-employee’s login still active, a support plan two years out of date, or a backup that’s scheduled but has never once been restored to confirm it works.
In this order, because it addresses what an auditor samples first and what protects participants most directly:
The NDIS Practice Standards don’t specify a platform or a checklist of technical controls, and that’s exactly why organisations find them harder to satisfy than a more prescriptive standard — there’s no single document to hand an IT provider and ask them to implement. What Outcome 2.4 and Outcome 2.2 actually require is that your information management is genuinely operating the way your policy says it does, and that you can show it.
Bluebird IT works with NDIS organisations across the Peel region and greater Perth, supporting the platforms this sector actually runs — ShiftCare, CareMaster and MYP among them — alongside the Microsoft 365 environment most organisations rely on for everything else. We’re a local WA team, not an overseas call centre, which matters when a support coordinator needs an access issue fixed between client visits rather than logged into a queue. You can read more about our IT support for WA NDIS organisations.
If you’d like an honest assessment of where your organisation sits against the Information Management and Risk Management outcomes — written so it can go directly to your quality auditor — we can work through it with you.
We'll learn about your organisation, your clinical systems, and what's keeping you up at night.
If we're the right fit, you'll select the IT service agreement that best suits your organisation.
With Bluebird IT managing your technology, your team can do what they do best — delivering outstanding care to your patients.
