Registered NDIS providers are audited against the NDIS Practice Standards, and most providers spend their preparation time on policies, training records and participant files. The IT side often gets less attention, even though much of the evidence an auditor asks for lives in your computers, email and file storage.
This guide explains what NDIS audits look at when it comes to participant information, and what that means for your IT. It covers the technology side only. Your auditor and any compliance adviser you work with remain the best guide to the Practice Standards as a whole, and no IT provider can make you compliant on its own.
How NDIS audits work
Audits are carried out by independent approved quality auditors, and the type of audit depends on the supports you are registered for. The NDIS Commission describes two main types:
- Verification audits are for lower-risk supports and are a desktop review of your documents.
- Certification audits are for higher-risk supports and happen in two stages. Stage 1 is a desktop review, and Stage 2 is on site, with auditors looking at records, visiting sites, interviewing staff and participants and observing how things work.
Providers with certification also have a mid-term audit partway through their registration. In every case, audits are evidence-based. The Commission notes that auditors want to see real examples of how a policy works in practice, not just the policy itself.
The Practice Standard that covers participant information
There is no separate IT standard. The part that matters most is the Information Management outcome in the Core Module of the NDIS Practice Standards. It expects each participant’s information to be accurately recorded, current and kept confidential, and to be used appropriately by the right workers. In summary, providers are expected to:
- Get consent to collect, use, keep and share participant information, and explain why it is needed
- Tell participants how their information is stored and used, and how they can access or correct it
- Have an information management system that suits the size of the organisation and records information accurately and on time
- Have processes for how information is used, accessed, transferred, stored, secured, retrieved, kept and destroyed
The Privacy and Dignity outcome and the NDIS Code of Conduct, which asks workers to respect the privacy of people with disability, point in the same direction.
What that means for your IT
Most of the words in that last point, such as stored, secured, transferred and destroyed, are things your IT either supports or undermines. When an auditor asks how participant information is protected, these are the kinds of evidence that help:
- Where records are kept. Participant records live in one managed system, such as your client management software or Microsoft 365, rather than in personal inboxes, USB drives or workers’ own phones.
- Who can see them. Every worker has their own login, access is set by role, and there is a record showing access was removed when someone left.
- How they are secured. Multi-factor authentication is turned on, laptops and phones are encrypted and managed, and email is filtered for phishing.
- How they are shared. Information sent to other providers or families goes through a secure method, rather than as an open email attachment to whoever asks.
- How they are kept and destroyed. You know how long records are kept, and old computers and phones are wiped before they are disposed of.
- How they are recovered. Participant records are backed up and a restore has been tested, so a failed laptop or a ransomware attack does not mean lost records.
Cyber incidents also belong in your incident management system. The NDIS Commission expects providers to record and manage incidents, and incident records must be kept for seven years.
An NDIS audit IT checklist
Before your next audit, it is worth working through these questions with whoever manages your IT:
- Can we show where every type of participant information is stored?
- Does every worker have their own login, with access set by role?
- Is multi-factor authentication on for email, Microsoft 365 and client management software?
- Are work laptops and phones encrypted, and can a lost device be locked or wiped?
- Do we have a record of access being removed on the day each worker left?
- How do we share participant information with other providers, and is it secure?
- When did we last test restoring participant records from backup?
- Do our incident procedures cover a lost device, a hacked email account or a data breach?
- Do our written policies match how our systems are actually set up?
That last question matters more than it looks. A policy that says files are only stored in SharePoint is undermined if the auditor sees participant notes saved on a worker’s desktop.
Privacy and data breaches
Most NDIS providers hold health information about participants, and the Privacy Act covers organisations that provide a health service regardless of their turnover. Under the Notifiable Data Breaches scheme, a breach that is likely to cause serious harm must be reported to the people affected and to the Office of the Australian Information Commissioner.
Health service providers made more data breach notifications than any other sector in 2025, with 225 of the 1,205 notifications received by the OAIC. Good IT practices will not remove that risk entirely, but they make a breach less likely and easier to respond to. Our Essential Eight guide for small business is a good place to start.
How Digitek helps
Digitek IT works with NDIS providers to set up and manage the IT behind participant records, including Microsoft 365 permissions set by role, encrypted and managed devices for field workers, multi-factor authentication, email filtering and regular backups that are checked. When your auditor or insurer asks how participant information is protected, we help you show them.
Read how we helped Caring Supports, find out more about our IT support for NDIS providers, or call 02 4504 8643 to talk about preparing your IT for your next audit.
