The EFQC Enquirer: 6 November 2024

In this edition

• Celebrating 140 Years of See Differently visionary services
• NDIS Commission’s regulatory priorities for 2024-25
• New NDIS Emergency and Disaster Resources
• Second part of NDIS legislation Getting it Back on Track Bill
• NDIS Commission Regulatory Reform Roadmap: Key Changes Ahead
• Do you know about this increasing area of non-conformance in NDIS audits – Australian data hosting requirements? (Kris O’Shaughnessy, Technology & Business Consultant)

Celebrating 140 Years of See Differently visionary services

We were honoured to attend the celebration of the 140th anniversary of See Differently with the Royal Society for the Blind, a cornerstone organisation in South Australia. A huge thanks to Jane Ford for the invitation, allowing us to participate in this wonderful event.

See Differently has been providing exceptional services and support to people with vision impairment since its inception, transforming lives and offering guidance and independence for generations. It was truly inspiring to witness the organisation’s continued commitment and evolution in delivering innovative, inclusive services. Their long-standing dedication to the South Australian community is a testament to their mission and the difference they’ve made in countless lives.

Celebrating this incredible milestone reminded us how vital community organisations are in fostering empowerment and accessibility. It was a privilege to be part of this important event.

Here’s to another 140 years of incredible impact!

1. NDIS Commission’s regulatory priorities for 2024-25

The NDIS Commission has recently announced its Regulatory Priorities for 2024-25, aimed at enhancing the quality and safety of services for NDIS participants. These priorities are designed to focus resources on areas that present heightened risks, ensuring that providers and workers maintain the highest standards of care and compliance.

Key Priorities for 2024-25:

1. Reducing and Eliminating Restrictive Practices:
   A continued focus will be placed on reducing restrictive practices through rigorous monitoring of behaviour support plans. Ensuring the quality and compliance of these plans is critical to promoting the rights and dignity of people with disabilities.
2. Provider Compliance with Registration Conditions:
   The NDIS Commission will closely monitor registered providers to ensure compliance with registration conditions, including meeting auditing requirements, having effective incident management systems in place, and adhering to reporting obligations.
3. Safety and Competency in Service Delivery:
   Both registered and unregistered NDIS providers and workers are expected to deliver services safely, competently, and with care and skill, particularly in supported accommodation settings. Ensuring participants receive high-quality care remains a priority.
4. Participant Rights, Independence, and Choice:
   The Commission will regulate provider conduct to safeguard the rights of participants, ensuring their independence and choice are respected in the delivery of supports. This priority underscores the importance of participant-centred care in the NDIS framework.
5. Combatting Unscrupulous Providers and Workers:
   Efforts to prevent and remove providers and workers engaging in misleading conduct, price exploitation, and serious or organised crime will be strengthened. The Commission is committed to keeping the NDIS free from unethical practices.

Additional Focus Areas:

For 2024-25, there will be an added focus on ensuring quality and safety of supports in regional and remote locations. The Commission will also increase its collaboration with other regulators to address complex issues that intersect across regulatory boundaries.

For assistance in understanding your compliance responsibilities, feel free to reach out to us at 1300 790 194 or email info@engelsfloyd.com to book a complimentary consultation.

2. New Website to Help You Prepare for Emergencies and Disasters

The NDIS Commission has developed new resources to assist providers and participants in preparing for emergencies and disasters, including bushfires, floods, and pandemics.

As an NDIS provider, you are required to maintain up-to-date, tested emergency management plans, and ensure that essential supports can continue during such events.

The R4NED website offers a wealth of information and resources to help you prepare for, manage, and recover from emergencies and disasters. These tools will also assist you in meeting the requirements of the NDIS Practice Standard for Emergency and Disaster Management.

Visit the Resources for NDIS Emergency and Disaster Management website to access these valuable resources.

3. Second part of NDIS legislation Getting it Back on Track Bill announced

NDIS Minister Bill Shorten has announced significant reforms through the second part of the NDIS Getting it Back on Track Bill, aimed at enhancing protections for participants and workers while improving the overall quality and safety of supports.

The proposed legislation will radically enhance the powers of the NDIS Quality and Safeguards Commission to regulate providers, raising the stakes for those who fail to meet their obligations.

Key Highlights of the Proposed Legislation:

1. Major Increases in Penalties:
   Penalties for NDIS providers will rise sharply, with the maximum fine increasing from $400,000 to over $15 million in cases where a participant is harmed. This new penalty aligns with the penalties under Work Health and Safety (WHS) legislation, addressing the current discrepancy in how much a worker’s “life” is valued compared to an NDIS participant.
2. Criminal Prosecution for Providers:
   For the first time, the NDIS Commission will be empowered to refer providers for criminal prosecution when they seriously fail to comply with registration conditions. This step is designed to act as a strong deterrent against non-compliance and will elevate protections for participants.
3. New Criminal Offences:
   The proposed legislation introduces criminal offences to address unscrupulous provider behaviour. These offences aim to prevent harm to people with disabilities and improve the quality of supports by ensuring penalties act as credible deterrents.
4. Expanded Scope of Banning Orders:
   The bill will extend the scope of banning orders to cover not only providers but also individuals involved in key areas such as auditing and consulting. This expansion ensures that bad actors in all areas of the NDIS are held accountable.
5. Strengthened Monitoring and Compliance Powers:
   The Commission will gain enhanced information-gathering powers to improve its ability to monitor and ensure compliance across the NDIS provider landscape.

The proposed legislation will undergo a broad consultation process, beginning in November 2024. This will include formal submissions, questionnaires, ministerial roundtables, stakeholder workshops, and targeted engagement with participants, state and territory disability officials, disability organisations, and provider bodies.

NDIS Commission Regulatory Reform Roadmap: Key Changes Ahead

The NDIS Commission has released its Regulatory Reform Roadmap, outlining planned reforms over the next year to improve the quality and safety of services delivered to NDIS participants.

Key initiatives include:

• Mandatory Registration: From July 2025, platform providers, Supported Independent Living (SIL) services, and support coordinators will transition into mandatory registration.
• NDIS Act, Rules, and Standards Review: Revised NDIS practice standards and legislation, with public consultations starting from November 2024.
• Self-Directed Supports: Ongoing consultations on provider definitions and regulatory frameworks for self-directed support.

The roadmap ensures inclusive, transparent consultation and collaboration with state governments and the disability sector to address quality and safeguarding issues​.

The consultation schedule includes:

Mandatory Registration

• Step 1: Consultation (October 2024 – March 2025)
• Step 2: Decisions and Transition Plans (April 2025 – June 2025)
• Step 3: Commence Transition to Mandatory Registration (not before 1 July 2025)

Changes to NDIS Bill No. 2 Roadmap

• Step 1: Consultation (October 2024 – December 2024)
• Step 2: Proposed NDIS Bill No.2 considered by Parliament no earlier than March 2025
• Step 3: Implementation will commence after the Bill is passed by the Parliament of Australia.

NDIS Practice Standards & NDIS Rules Reviews

• Step 1: Consultation commences (March 2025)

ASK THE EXPERTS

Do you know about this increasing area of non-conformance in NDIS audits – Australian data hosting requirements? (Kris O’Shaughnessy, Technology & Business Consultant)

Data management can seem like a dry topic, but staying compliant with NDIS Practice Standards and Australian legislation is crucial for providers. There are a range of requirements covering consent, disclosure of information, access, storage, security and retention.

One area often overlooked is data sovereignty—the requirement to store sensitive data within Australia. Kris O’Shaughnessy from Techturn shared insights on this growing area of non-conformance, emphasising the need to ensure all client data remains on Australian servers.

Data sovereignty refers to the jurisdictional or legal control over data because the data physically resides within a specific country. This is important for both regulatory reasons and data security, in particular when data is collected in one country but resides elsewhere.

For Australian companies, when you collect and store your data in Australia you fall under the jurisdiction of Australian laws (Privacy Act 1988), making it easier to manage, access, and protect your data.  

Data sovereignty implies that data collected by Australian companies but which is then stored abroad may be subject to the other country’s laws too. For this reason, Australian companies should understand that where they host their data is not just a question of cost and convenience; there are legal considerations too.

Due to the challenges of cyber security, Australian companies need to seriously consider their data sovereignty obligations.

While bigger solutions keep their data in Australia by default, not all of them do. For instance, Survey Monkey do not have any Australian data centres. 

To keep your data truly compliant, you must look at how each product, service and website in your business stores and delivers data. But how do you do this?

1. Building a Software Asset Register:

A software asset register is as simple as noting down all the software you use within your business. However, it’s important to ensure that you are assessing this holistically:

We recommend you sit down with each area in your organisation and have them show you through their workday. We often find that departments will open new software and service accounts without business leaders knowing. Look at what they have bookmarked in Edge and Google Chrome.

2. Check your providers policies:

Once you have built out this register, you can look through each piece of software to ensure that it has all of its services located within Australia. It’s important to read through carefully however as they can often process data through multiple regions: 

3. Establish regular checks:

Your software providers change and evolve as much as you do year after year. Because of this it’s important to regularly be reviewing the above at least annually. We recommend a quarterly basis as you may have a new solution or product that needs to be checked.

A common place where organisations get caught is that your website & printer must relay via a server to send emails. This can be located offshore and hold important client data. Reach out to your IT provider to make sure that these items are compliant as there are many services that solve this issue for free.

It’s also important to consider that a 3^rd party can find things that staff can hide from your organisation’s leaders. Other times, a fresh set of eyes can help paint a more holistic picture of your business’s technology.

For help navigating this complex area, consult with your IT provider or expert like Kris to safeguard your data practices!