Submission to the Senate Standing Committee on Community Affairs

Executive summary

The danger of the increasingly punitive approach adopted by the Government is to risk discouraging good actors from wanting to participate in the NDIS and discourage investment.
The Bill should not commence on Royal Assent, instead NDIS providers should be given an implementation period prior to the introduction of such significant changes.
The scale of the penalties regime proposed is inappropriate and completely at odds with those elsewhere in the care economy including under Aged Care Act 2024.
The Anti-Promotion Power is inappropriate for a regulator such as the NDIS Commission which has no experience with the nuances of promotions. Further the examples cited in the explanatory memorandum to justify the need for this proposal have all been previously subject to regulatory action using existing powers.
While there might be circumstances where a reduced time period is required for the provision of certain information, the Senate should consider the precedent within the Aged Care Sector and this power should only relate to specific incidents, rather than more general requests for information.

About Attain Healthtech

Attain Healthtech is a leading health technology group that comprises Mable Technologies Pty Ltd, age care registered provider Self Managed Support Pty Ltd (trading as HomeMade) and leading plan manager Leap In!

Mable is a health tech platform that offers a complementary approach to traditional aged care at home and disability support models. Mable gives older persons and people with disabilities more choice, control and flexibility to shape the care and support they receive in their own homes and communities. This choice is made possible by over 21,000 independent contractors providing valuable and necessary care and support services via the platform. Founded in 2014, Mable now operates at some scale with support providers on the platform providing care and support services to over 28,000 people with disability and older Australians.

HomeMade is a registered aged care provider that enables older people to self-manage their home care packages. Founded in 2021, HomeMade now operates at scale, with 4,300 older people choosing HomeMade as their registered provider to access services and supports at home. HomeMade recognises the importance of effective systems and processes to provide customers with freedom and control to access services and support on their terms, combined with effective

safeguards to ensure high-quality care and compliance with support at home guidelines and requirements.

Leap in! is Australia’s leading NDS plan manager. Established in Queensland, Leap in! now supports more than 14,000 participants across Australia. Leap in! is a business driven by purpose and believes in people. Leap in! exists to help people with a disability live their best life by getting the most out of their NDS Plans.

Recommendations

Recommendation 1 – That the Government adopts a more conciliatory posture towards providers and seeks to partner with ethical providers within the NDS.
Recommendation 2 – That the Senate amend the Bill so that commencement is from 1 July 2026 to enable the NDIS Commission to undertake an education campaign for providers.
Recommendation 3 – The Senate should seek to remove all criminal penalties from this legislation, to bring the enforcement regime in line with that in Aged Care.
Recommendation 4 – The Senate should ensure that the maximum civil penalties under the Bill do not exceed the equivalent maximum penalties under Aged Care Act 2024.
Recommendation 5 – The Senate should remove the rule making power from the legislation to permit rules permitting a Minister to prescribe “regulated promotional conduct” via instrument.
Recommendation 6 – The Senate should remove the Anti-Promotion Order power in order to prevent duplication of powers already held by regulators such as the ACCC.
Recommendation 7 – The Senate should amend the Information Gathering power so that the shorter period of less than 14 days only applies where a serious incident has occurred and the request relates specifically to that incident.

Position of Attain Healthtech

Attain has serious concerns about the philosophical approach underpinning National Disability Insurance Scheme Amendment (Integrity and Safeguarding) Bill 2025 (the bill). Broadly speaking, Attain does not deny that there are bad actors, some of whom may be involved in organised crime, that have sought to exploit the National Disability Insurance Scheme (NDIS). The risk in the Government’s rhetoric is the underlying assumption that all or even most providers within the NDIS are engaging in inappropriate or illegal conduct.

However, the NDS is not a scheme populated by criminals. It is a scheme where the vast majority of people seek to provide appropriate and necessary supports to people with disabilities. The danger then of the increasingly punitive approach adopted by the Government is to risk

attainhealthtech.com.au 2

discourging good actors from wanting to participate in the NDIS and, through extreme measures such as criminal liabilities, disincentivising investment by the private sector.

5. Commencement

The main provisions of concern within the Bill commence on Royal Assent. This means that NDIS providers will have no implementation period prior to the introduction and problematic changes including the new penalties regime.1 Based on the current timeline of the bill, individuals and providers might be subject to a criminal penalties regime as soon as April 2026, without providing sufficient time for that information to flow through the more than 200,000 providers operating across the NDIS. Attain recommends that the Bill be amended so that commencement is from 1 July 2026 to enable the NDIS Commission to undertake an education campaign for providers.

6. Concerns with the penalties regime

The Bill contains three instances in which certain types of conduct (which can include both performing an act or not performing an act)2 are treated as a criminal offence. Specifically, the matters which the Government seeks to criminalise are providing supports while subject to a banning order,3 providing supports which require registration while not being registered or holding oneself out to be registered when one is not.4

There is a precedent insofar as the criminal penalties proposed in the Draft Aged Care Act were ultimately removed prior to the Senate debate,5 Attain contends the same should occur here. The bill proposes that events associated with “significant failures” and “systemic patterns of conduct” can be treated as criminal matters, and that key personnel can be held liable for these matters. However, in reality the NDIS Commission would have broad discretion to determine what it views to be criminal conduct. The Bill even proposes that a person who is required to be registered by NDIS rules but does not register is considered to have committed a criminal offence, and can face up to two years in prison.6 Attain strongly recommends that all criminal penalties should be removed from this legislation, to bring the changes in line with those that exist within Aged Care.

This is particularly concerning in a context where the Federal Government has indicated it intends to adopt an unprecedented use of Ministerial authority to determine, via instrument, which providers should be required to register.7 The notion that one can have committed a criminal offence by not registering when the NDIS Rules (which is not an Act of Parliament) require registration, fails to provide due process to – for example – a provider deemed required to be registered by rules seeking judicial review of that instrument.

  1 “Commencement”, National Disability Insurance Scheme Amendment (Integrity and Safeguarding) Bill 2025, link, p. 2.
  2 See Schedule 1, Part 2, Item 30, lines 9 - 11, link, p. 8.
  3 "73ZNA Complying with banning orders," Schedule 1, Part 2, link, p. 12.
  4 See Schedule 1, Part 2, Items 31-33,  link, pp. 10
  5 Truu, Maani; Roe, Isobel; and Manfield, Evelyn; "Aged care providers could be fined more than $1.5 million for the most serious breaches under new
 laws," ABC, 13 September 2024, link.
  6 See Schedule 1, Part 2, Items 31-33,  link, pp. 10
  7 McAllister, Jenny, "Mandatory Registration for Support Independent Living and Platform Providers to start from next year," 18 December 2025, link.

attainhealthtech.com.au 3

Civil Offences Under The Bill

There is also a substantial increase in civil offences of up to 10,000 penalty units including for matters which could easily represent innocent mistakes on the part of providers. Even where the maximum penalty isn’t likely to apply, this could result in changed behavior by provider groups, including reduced reporting.

The Bill proposes civil offences of up to $3.3 million for the following matters:

Providing false or misleading documentation in relation to a registration application$^8$
Not complying with conditions of registration (when a provider is already registered)$^9$
A breach of the NDIS Code of Conduct$^{10}$
Victimisation of a person in a way that causes detriment$^{11}$ or victimisation in a way that threatens to cause detriment to another person$^{12}$
Failing to comply with a compliance notice issued by the NDIS Quality and Safeguards Commission$^{13}$
An NDIS provider can be subject to the maximum civil infringement for permitting a worker subject to a banning order to provide supports$^{14}$

To put this in perspective, the most serious civil penalty permitted by Aged Care Act 2024 which is for a registered provider which engages in serious negligence resulting in death or serious harm to an older person is for 4,800 penalty units, less than half the total maximum which the Government intends to prescribe for less serious matters within the NDIS.$^{15}$

Significantly, this maximum penalty of up to 10,000 penalty units applies to breaches of the NDIS Code of Conduct. This is problematic because the NDIS Code of Conduct is a short document of 140 words whose requirements are written in a manner which allows for extremely broad and subjective reading.

For example, the Code requires providers to “act with respect for individual rights to freedom of expression, self-determination, and decision-making in accordance with relevant laws and conventions”$^{16}$, it is difficult to understand how a provider could ever reach a sufficient threshold to ensure that it posed no risk of breaching such broad requirements. While other matters subject to higher civil penalties in the Bill are better defined, for example the increased penalty for victimisation, Attain contends that the maximum penalties should not exceed the maximum for equivalent matters under the Aged Care Act 2024.

Examples Of Breaches

There are a number of instances where a provider could breach these provisions by accidentally putting the workers, managers and board of that provider liable for criminal prosecution:

Case Study

Example

The use of the “I Heart NDIS” trademark17 is restricted to providers that are registered within the NDS. However, many non-registered providers also utilise this trademark, likely out of ignorance about this restriction. If the legislation passes in its current form this becomes a criminal offence, meaning that providers could face jail for misusing a trademark.

Implementing providers responsible for restrictive practice are required to be registered.18 However, there are circumstances where a provider might find itself associated with restrictive practices due to support workers operating outside of their scope (often well intended). Presently such matters are treated as an incident, with responsible providers proactively reporting, but if criminal penalties apply such voluntary reporting by non-registered providers will almost certainly cease.

In order to provide supports to agency managed participants, NDIS Registered Providers must register in the category of supports which they receive.19 However, the divisions between different categories may not always be clearly understood by support workers and there is a risk that support workers might work outside of their scope creating a liability for their employer. presently such matters are treated as an incident, with responsible providers proactively reporting,

Joseph operates a local franchise of Jim’s Mowing. Joseph provides supports to individuals within the NDIS by mowing their lawns, but most of Joseph’s business comes from non-participants paying out of their own pocket. Joseph puts a “I Heart NDIS” on his van so that locals on the NDS know that he can help them with their gardens. Joseph now faces up to two years in prison for a sticker.

Margaret is a support worker, she provides domestic assistance (light house keeping) and assists the Smith family with transport for their son Aiden. Her employer WeCare is non-registered. Aiden has profound autism and is non verbal. He wears a dignity suit, and is usually dressed or undressed by his mother. One day Aiden has an accident and his mother is sick, Margaret steps in to help change Aiden to a new suit and holds his hands to stop him playing with his faeces. Margaret has provided an unauthorised restrictive practice and her employer now faces up to two years in prison because Margaret was trying to be helpful.

Catherine is a support worker, she provides low intensity personal care to Matthew (who has mobility issues from his cerebral palsy). One day Jeffrey – Matthew’s roommate – needs help because his PEG tube has become dislodged. Catherine helps Matthew, because his normal support worker is on a break. However, Catherine’s employer is only registered for “0107 - Assistance with daily personal activities” not “0104 High Intensity Daily Personal Activities”.

Proactive Reporting

proactively reporting, but if increased civil Catherine’s employer must now decide penalties apply such voluntary reporting by registered providers may cease.

All responsible providers regularly check the banning orders list and take appropriate action against employees or independent contractors subject to banning orders. However, the system which publishes these orders is not automated and providers have no choice but to manually check the register.

Further, because the system is public, no identifying information is provided so individuals with the same name can easily be mistaken for one another. For instance, a banning order imposed on a “John Smith” of Sydney 2000 could easily apply to multiple persons.

Currently, providers must self-report scope breaches and compliance breaches which enables system-wide learning. However dramatic penalty increases will discourage incident reporting as concealment becomes rational. Reduced transparency then undermines the quality framework that these amendments purport to strengthen. Participants therefore become less safe when providers hide mistakes rather from learning from them collectively.

Anti Promotion Orders

The Bill proposes that the NDIS Commission be granted a power to enable it to make anti-promotion orders which can restrict a person from engaging in certain conduct relating to promotions. The Commission is also given the power to establish Rules relating to the advertising, promotion or marketing of supports or services for people with disabilities, providers themselves and those things said to relate to these matters. The NDIS Commission is able to seek fines of up to $82,500 for each separate instance of a breach of an anti-promotion order. The definition of “regulated promotional conduct” is delegated entirely to Ministerial Rules, providing no certainty for

InnovCare is a new start-up, seeking to use AI to automate processes in the NDIS. InnovCare observes that a coding error means that new workers onboarded into its system are being listed as having an NDIS Worker Screening Check, but when this is manually checked it is found to be inaccurate. InnovCare chooses not to inform the Commission but to quietly transition those clients to other workers and dismiss the workers without appropriate checks.

Page 7

providers. Without clear statutory definitions, providers cannot assess compliance requirements or modify systems accordingly.

This proposal in effect represents two additional powers, one exercised by the Commissioner (anti-promotion orders themselves) and the other by the Minister (a rule making power). This is in spite of the fact that the NDIS Commission has no experience in matters relating to advertising, investments or competition law. This represents an entirely new policy area for a Commission that the Australian National Audit Office (ANAO) only considers “partly effective”.23 Concerningly, the recent audit by the ANAO also found that at the Commission “Regulatory decision-making is not guided by a risk-based strategy”.24

Given the Government’s successful use of existing law to undertake enforcement and even prosecution of matters described within the Explanatory Memorandum25 as requiring these new anti-promotion powers it is unclear what problems exactly the Government is seeking to address with these sweeping new powers.

Table outlining how existing laws apply to the examples of conduct intended to be caught by an anti-promotion order

| …businesses from using advertisement and In a press release dated 4 December 2025 | | promotional materials to mislead NDIS the National Disability Insurance Agency | | participants about how they can use their (NDIA) indicated that individuals that claimed | | allocated funds, particularly in relation to products were ‘NDIS approved’, ‘NDIS | | short term respite. These advertisements permitted’ or ‘100% NDIS funded’ were likely | | falsely claim that participants can use their in breach of Australian Consumer Law | | NDIS funds to pay for items such as holidays (ACL). Further the NDIA indicated $100,000 | | where they can bring their families along for had at that time already been paid in fines in| | free, which is a misrepresentation of how response to referrals by the NDIA to the | | NDIS funds are intended to be used.26 Australian Competition and Consumer | | Commission (ACCC). Over a 14 month | | period the NDIA indicated it had made 605 | | breaches of the ACL to the ACCC.27 In a | | press release dated 10 October 2025, the | | NDIA indicated it undertaken a compliance | | program which resulted in the referral of 27 | | providers to the ACCC for action due to

23 “Effectiveness of the NDIS Quality and Safeguards Commission’s Regulatory Functions,” Australian National Audit Office, 3 September 2025, link. 24 Ibid. 25 Explanatory Memorandum, November 2025, link, p. 21 26 Ibid. 27 “Cracking down on misleading promotion of ‘NDIS-approved’ products”, NDIA, 4 December 2025, link.

attainhealthtech.com.au 7

potentially false and misleading claims about using NDIS funds for holidays.28 The ACCC itself has demonstrated it is active in this space.29

…providers from making exaggerated claims As outlined in Investment in SDA guidance, conduct of this nature is addressed under ACL misleading and deceptive conduct rules in collaboration with ASIC and the NDSCommission.31 From an ACL perspective, conduct is assessed through the lens of false or misleading claims, unfair contracts and/or unfair business practices involving unconscionable conduct. In an example involving NDISP, conduct of this nature has already resulted in a revoked registration status.32

…people advertising the sale of NDIS registered businesses in an unethical way that raises concerns about the continuity and quality of care for participants, the potential for exploitation or misuse of NDIS funds by those seeking to profit from the Scheme, and the commodification of participants for profit.33

Other examples of conduct that could be the subject of an antipromotion order include where consultants make claims that they offer: assistance to respond to a compliance notice issued by the Commission; ‘audit coaching’ and a 100 percent success rate for NDIS audits and positive registration outcomes (i.e. Commission approves them as a registered provider); or ‘NDIS auditing services’, although they are not an approved auditor.

Suspensions against auditors are already made against audit specialists, as seen with recent conditions imposed on JPS Audit Specialists through collaborating with the Joint Accreditation System of Australia and New Zealand, outlined in a release dated 21 October 2025.36 Existing ACL laws also apply to any advertisement that misleads organisations into believing that the auditor is approved, when they are not.

28 “Crackdown on dodgy STA providers helps save $132 million in NDIS funds,” NDIA, 10 October 2025, link. 29 “NDIS provider in court over alleged misleading representations when selling aged care and disability products online,” ACCC, 13 December 2024, link. 30 Ibid. 31 “Investment in SDA”, NDIA, 10 July 2025, link. 32 “NDISP,” NDIA, 29 August 2025, link. 33 Ibid. 34 The NDIS Code of Conduct Guidance for NDIS Providers, NDIA, April 2024, link, pp. 25-26. 36 “Statement on conditions imposed on JPS Audit Specialists Pty Ltd,” NDSQuality and Safeguards Commission, 21 October 2025, link.

attainhealthtech.com.au 8

Changes to written notice requirements

Presently the NDIS Commission or the National Disability Insurance Agency (NDIA) must give providers 14 days to provide information or to appear to answer questions. The Bill proposes to give the Commission the power to specify a shorter time period in some circumstances in order to reduce the risk of harm to a participant. Attain recognises that there might be circumstances where a reduced time period is appropriate and encourages the Senate to consider the precedent in the Aged Care sector, where shorter time periods for provision of information to the Aged Care Quality and Safety Commission (ACQSC) apply where relevant to a specific incident, particularly those resulting or potentially resulting in serious harm or death of an older person. The rationale for this change is that Industry experience with the NDIS Commission suggests implementation challenges, including requests for extensive documentation during holiday periods with limited timeframes, indicating the need for clearer procedural safeguards.

Attain is grateful for the opportunity to provide this input on National Disability Insurance Scheme Amendment (Integrity and Safeguarding) Bill 2025 and welcomes any further opportunities to support the Committee in its important work.