The EFQC Enquirer: 14 May 2025

In this edition

Important Information

• NDIS Commission Releases New Practice Alerts: What You Need to Know
• NDIS Commission May Contact Workers Directly – What Providers Need to Know
• Enhancing Medication Management: A Valuable Resource for NDIS Providers
• Update: Independent Review into Music and Art Therapy

Ask the Experts

• Cyber Security Is Not an IT Issue: What Every Director Must Know by Anita Gover, TechAbility

Important Information

1. NDIS Commission Releases New Practice Alerts: What You Need to Know

The NDIS Quality and Safeguards Commission has recently released a series of important practice alerts aimed at improving safety and quality in NDIS service delivery. These updates serve as critical reminders for providers and workers to review their current practices and ensure alignment with NDIS Practice Standards.

The latest alerts cover the following key areas:

• Sleepover Shifts – Clear guidance on worker responsibilities during overnight stays, and the importance of being able to respond to participant needs at any time.
• Fire Safety Measures – Emphasises the need for up-to-date fire safety systems, clear evacuation procedures, and staff training—especially in shared living environments.
• Violence Against Workers – Highlights provider obligations to prevent and respond to violence, aggression, or abuse directed at support workers.
• Emergency Management – Reinforces the importance of having detailed and regularly reviewed emergency response plans tailored to the needs of participants.

Keeping up to date with practice guidance is essential to maintaining compliance—and, more importantly, ensuring participant and worker safety.

We encourage all providers to review these resource and integrate them into your quality and compliance systems. If you need support understanding your compliance obligations or would like tailored training for your organisation, please contact us.

2. NDIS Commission May Contact Workers Directly – What Providers Need to Know

The NDIS Quality and Safeguards Commission has recently clarified its position on making direct contact with NDIS workers as part of its regulatory role.

While the Commission will usually contact providers first to arrange access to specific staff, there are situations where it may approach a worker directly—without employer involvement. This may occur when:

• A worker requests that their employer not be involved, or
• The Commission has concerns that the employer may influence the worker’s responses or statements.

This approach is consistent with the Commission’s responsibilities as a national regulator, and it ensures that investigations and interviews are conducted fairly, independently, and in the best interests of participants and worker safety.

As a provider, it’s important to be aware of this practice and to create a workplace culture where workers feel safe and

3.    Enhancing Medication Management: A Valuable Resource for NDIS Providers

Ensuring safe and effective medication management is a critical component of delivering quality care under the NDIS. Ausmed’s article, A Guide to Medication Management Under the NDIS, offers a concise and informative overview tailored for NDIS providers and support workers.

This resource aligns with the NDIS Practice Standards, specifically Core Module 4: Provision of Supports Environment, emphasising the importance of proper medication administration, storage, and monitoring. It provides practical insights into:

• Establishing robust medication management systems
• Training staff to handle medications safely
• Preventing medication errors and incidents
• Ensuring participants’ confidence in their care

By integrating these practices, providers can enhance the safety and well-being of participants while maintaining compliance with regulatory standards.

This article is a valuable tool for continuous professional development and can serve as a foundation for staff training sessions.
If you need support understanding your medication management compliance obligations, please contact our team.

4. Update: Independent Review into Music and Art Therapy

Following widespread feedback from the sector, the NDIA has now received the final report from Dr Stephen Duckett’s independent review into music and art therapy. The review was commissioned after strong concerns were raised about a proposal to reduce pricing for these therapies to the same rates as community participation.
Dr Duckett’s review carefully considered the clinical value, therapeutic role, and funding of music and art therapy within the NDIS. The NDIA has confirmed it will review and consider the recommendations in full before making any changes to operational guidelines or the Pricing Arrangements and Price Limits (PAPL).

Importantly, there are currently no changes to the existing billing rate for music and art therapy.

The final report, along with the NDIA’s response and accessible versions, will be made publicly available in the coming months. This is a positive step in ensuring transparency and continued recognition of the value that creative therapies bring to many NDIS participants.

We’ll continue to keep you updated as further information becomes available.

Ask the Experts

Cyber Security Is Not an IT Issue: What Every Director Must Know by Anita Gover, TechAbility

In today’s rapidly evolving digital landscape, cybersecurity is often mistakenly viewed as just an IT issue. In reality, it’s a business-wide responsibility that demands the attention of every director.

For business owners and directors alike, overseeing privacy and security is not simply a technical task – it’s a critical element of effective governance and risk management. With increasing regulatory scrutiny and evolving threats, it’s more important than ever for directors to take an active role in ensuring their organisation’s data and systems are protected.

Current Cyber Threat Landscape

The Australian Signals Directorate’s (ASD) Annual Cyber Threat Report for 2023–2024 highlights the increasing sophistication of cyber threats targeting Australian entities. While government sectors remain the top targets, the health sector stands out as the highest-rated non-government sector, representing 6% of all reported cyber incidents. This places it above education, utilities, and finance, underlining the urgent need for improved cyber resilience in healthcare settings. 

Incidents such as attacks involving phishing, ransomware, and compromised credentials accounted for 38% of all data breaches, making cybersecurity the leading cause. One incident alone impacted over 10 million Australians, the highest number of individuals affected since the Notifiable Data Breaches (NDB) scheme began. Human error continues to be a significant contributor to data breaches. Common errors include sending personal information to the wrong recipient via email, unauthorised disclosures, and failure to use BCC in bulk emails.

Additionally, the report highlights that health and community service providers – particularly in disability, aged care, and allied health – are among the most at-risk sectors. In fact, 1 in 5 of all reported data breaches in the latest reporting period came from this sector alone. These organisations often handle large volumes of sensitive personal and health data, making them prime targets for cybercriminals. Many operate with limited cybersecurity resources, increasing their vulnerability.

The consequences of a breach in these settings can be especially severe – exposing sensitive information such as health records, disability support details, behavioural data, and personal identifiers of vulnerable individuals. This not only compromises privacy but also undermines client trust, disrupts service continuity, and puts organisations at serious risk of non-compliance with privacy regulations.

Regulatory Expectations and Responsibilities

For directors and business owners in the NDIS and aged care sectors, regulatory expectations around cybersecurity, privacy, and digital readiness are becoming increasingly detailed and sector-specific. While broader frameworks such as those from the Australian Securities and Investments Commission (ASIC) remain relevant – particularly around cyber resilience and governance – providers must also align with mandatory standards such as the NDIS Practice Standards and Quality Indicators and the Strengthened Aged Care Quality Standards commencing from July 1, 2025.

NDIS Practice Standards: Cyber and Data Governance Expectations

The NDIS Practice Standards require providers to:

• Respect participants’ privacy and uphold confidentiality.
• Maintain secure systems for the collection, storage, and disposal of personal data.
• Obtain informed consent before using or disclosing personal information.
• Ensure staff are trained in privacy and cybersecurity protocols.
• Implement policies and procedures for breach reporting and management.

Directors are responsible for ensuring these requirements are embedded in governance structures, policies, and frontline operations. As cyber threats continue to grow in sophistication, NDIS providers – especially those supporting vulnerable individuals – must take proactive steps to safeguard data integrity and client trust.

Aged Care Quality Standards and New Aged Care Act (2025)
From July 1, 2025, aged care providers must comply with the Strengthened Aged Care Quality Standards and the new Aged Care Act 2024. These reforms increase emphasis on:

• Clinical care and information security
• Digital readiness and technology adoption
• Transparent data practices and accountability

Key obligations for directors include:

• Ensuring safe and appropriate use of assistive and monitoring technologies.
• Protecting sensitive information across clinical, administrative, and care settings.
• Supporting the digital literacy and readiness of the organisation’s workforce.
• Committing to continuous review and improvement of information systems.

These standards sit alongside the Aged Care Data and Digital Strategy 2024–2029, which outlines goals for improving care outcomes through secure, well-managed digital systems and informed use of data.

Critical Questions for Directors in NDIS and Aged Care

To align with sector expectations and evolving threat landscapes, directors should ask:

• What data do we hold, and where is it stored?
  • Map all personal, health, and sensitive information. Assess where and how it’s stored, who has access, and what protections are in place – especially for high-risk individuals.
• Are we meeting our sector’s privacy and data compliance obligations?
  • Stay updated on your responsibilities under the Privacy Act, NDIS Practice Standards, and Aged Care Quality Standards. Ensure internal policies reflect best practices.
• Do our third-party systems and vendors meet cyber security standards?
  • Assess digital supply chains and technology partners. Verify they have secure protocols and conduct regular audits or risk reviews.
• Is cyber risk embedded in our organisational risk framework?
  • Cybersecurity shouldn’t be isolated to IT – integrate it into your organisation’s risk register and ensure all staff are trained and understand their responsibilities.
• Are we prepared to respond to a breach or system outage?
  • Have a clear incident response and communication plan, with specific protocols for regulatory notifications and client communications in the event of a data breach.

With increasing scrutiny from the NDIS Quality and Safeguards Commission and the Aged Care Quality and Safety Commission, directors must treat cybersecurity and digital governance as core components of quality service delivery – not just compliance checkboxes. The consequences of inaction include regulatory and financial penalties, reputational harm, and – most importantly – loss of trust among the people and communities you serve.

Take the Lead on Cyber Resilience

Cybersecurity is no longer just an IT concern – it is a leadership responsibility. Directors in the NDIS and aged care sectors must lead with awareness, accountability, and action. With increasing digital threats and tighter regulations, the time to assess your organisation’s readiness is now.

If you would like to learn more about cybersecurity and keeping your data safe, reach out to Anita Gover at TechAbility at info@techability.net.au for expert guidance!