Submission to the Inquiry to

NDIS (Integrity and Safeguarding) Bill 2025

February 2026

Contents

About Hireup 2

Executive Summary 3

Part 1 – Civil penalties and expanded enforcement powers 4

Section 57 – Failure to Provide Information 4

Section 59 – False or Misleading Information 5

Part 2 – New criminal offences and increased penalties for existing civil penalty provisions 5

Serious contraventions and escalation thresholds 6

Part 3 – Amendments to registration conditions and regulatory powers 6

Part 4 – Claims, payment refusal and recovery powers 8

Part 5 – Implementation, sequencing and regulatory consistency 9

Overall position and recommendations 10

Recommendations 10

Hireup

About Hireup

Hireup is a national NDIS-registered provider operating across all states and territories.

Since 2015, Hireup has grown into one of Australia’s largest NDIS registered platform providers, delivering over three million hours of NDIS-funded support each year to around 11,000 participants and employing more than 14,000 support workers.

Hireup has been registered with the NDIS Quality and Safeguards Commission since the commencement of the regulatory framework and operates under the core compliance settings that this Bill seeks to strengthen. We maintain formal governance and safeguarding systems, including incident management and reportable incident processes, complaints handling, worker screening and verification, recordkeeping and audit readiness. We routinely respond to regulatory inquiries and information requests and manage the practical demands of compliance within current administrative settings.

Because we deliver services at scale within the regulated segment of the market, the reforms proposed in this Bill have direct operational implications for our participants and workforce. In particular, changes relating to information-gathering powers, monitoring and investigation, the escalation of penalties, evidentiary mechanisms and payment refusal or recovery settings will shape how safeguarding concerns are identified, assessed and remediated in practice. Our submission draws on the realities of implementing these obligations, including the time and systems required to produce information, the need for consistent regulatory interpretation, and the importance of clear reasons and review pathways where decisions have immediate service consequences.

Hireup’s perspective is relevant to this inquiry because we operate under continuous oversight and are directly exposed to the enforcement and administrative mechanisms the Bill expands. We support stronger integrity measures that deter serious misconduct and improve participant safeguards, while emphasising that effectiveness depends on clarity, consistency and proportionate implementation across the Scheme.

Hireup

Enforcement powers are expanding in a market where registration reform is still rolling out, pricing settings remain under pressure, and administrative systems are evolving. If implementation is not carefully sequenced and clearly guided, strengthened powers may fall disproportionately on compliant and visible providers while regulatory gaps persist elsewhere. This would undermine the very integrity the reforms seek to protect.

In addition, the proposed amendments to claims processes, information requests and refusal powers must be accompanied by defined service standards and transparent reasoning requirements. Payment integrity is essential, but administrative rigidity or unclear rectification pathways risk creating avoidable delays and uncertainty for participants and providers. Similarly, the expanded penalty framework introduces new concepts, such as “significant failure” and “serious contravention”, that remain largely untested in practice. Without published guidance and consistent application, uncertainty may increase rather than reduce.

Hireup supports the direction of reform. To succeed, the Bill must operate within a disciplined framework that emphasises proportional enforcement, procedural fairness, operational clarity and alignment with broader reform streams. Integrity settings should encourage transparency and early remediation, not discourage engagement. With careful implementation, the reforms can strengthen trust in the Scheme. Without it, there is a risk of increasing compliance complexity without materially improving participant safety.

Part 1 – Civil penalties and expanded enforcement powers

Section 57 – Failure to Provide Information A civil penalty for failure to comply with a lawful notice requiring the production of information or documents is being introduced. The provision applies to registered and unregistered providers, workers, key personnel, plan managers, support coordinators and any person issued with a lawful request under the Act. This breadth reflects the reality that safeguarding obligations extend across the Scheme and are not confined only to registered providers.

Hireup supports the introduction of a civil penalty mechanism in place of exclusive reliance on criminal prosecution. A tiered enforcement pathway is more proportionate and better suited to the range of compliance matters that arise in practice. If the Commission needs information to determine whether participants are safe, services are being delivered appropriately, or the law is being followed, it must have consistent mechanisms to obtain the information.

At the same time, the effectiveness of this reform will depend on how notices are framed and administered. In operational settings, information requests frequently require the collation of extensive material across multiple systems, including rosters, case notes, incident records and internal correspondence. Where notices are broadly

Section 57 - Response Periods

drafted or involve complex factual matters, compliance may require coordination across teams and retrieval of archived data. The Act does not specify how response periods are to be determined or what considerations inform the granting of extensions. Under current legislative requirements, providers are subject to clear obligations to produce information and cooperate with investigations. In practice, this often involves the collation and submission of substantial material within specified timeframes. However, there are no equivalent statutory requirements requiring the Commission or the Agency to provide updates on the status of a matter or to notify providers of outcomes within defined periods.

Across the Scheme, this creates an imbalance in procedural obligations. Where the Act mandates responsiveness from providers but does not impose corresponding transparency requirements on decision-makers, uncertainty and delay can follow. Introducing clearer legislative expectations regarding notification and timeliness would strengthen procedural fairness and improve confidence in the integrity framework.

Where the Commissioner requires answers to questions, consideration should be given to how those questions are put. For larger providers, relevant information may be held across multiple teams rather than by a single individual. A compelled interview may not always be the most effective way to obtain complete and accurate information.

Allowing questions to be provided in writing, or confirmed in writing prior to an interview, would enable providers to coordinate internally and verify factual detail before responding. This would reduce the risk of inadvertent error and support the accuracy of the information provided. Procedural flexibility of this kind would strengthen the integrity of the information-gathering process.

Without clear administrative guidance, there is a risk that civil penalties may attach in circumstances where delay arises from scope or complexity rather than non-cooperation. That risk is heightened during the current transition period, in which visibility across the market remains uneven and registered providers are more readily subject to scrutiny than other actors operating within the Scheme.

For this reason, the operation of section 57 should be accompanied by published guidance addressing reasonable response periods, extension processes and the factors relevant to the exercise of civil penalty discretion where a person is engaging constructively with a notice.

Section 59 – False or Misleading Information

The Bill introduces a civil penalty for knowingly providing false or misleading information to the Commissioner. This change is intended to address situations where conduct does not meet the high threshold required for criminal prosecution but still affects the Commissioner’s ability to oversee the Scheme effectively. Hireup supports the introduction of a civil penalty mechanism in these circumstances.

Hireup

The integrity of the Scheme depends on accurate reporting, particularly in relation to incident notifications, compliance declarations and responses to regulatory inquiries. A civil penalty provision creates an enforcement mechanism capable of addressing conduct that compromises transparency without requiring proof of criminal intent.

The central issue in the operation of this provision will be the interpretation of the term “knowingly”. Providers operate within a regulatory environment that is complex and, in some areas, evolving. Reporting templates, audit standards and Commission guidance have developed over time, and providers frequently rely on layered internal systems and third-party assessors to generate required information. In that context, inaccuracies may arise from ambiguity, misinterpretation or administrative complexity rather than deliberate or reckless misrepresentation.

It is therefore important that the distinction between knowingly misleading conduct and genuine error is clearly articulated in accompanying guidance. A civil penalty regime should target deliberate or reckless behaviour that undermines oversight, not mistakes arising from unclear standards or inconsistent regulatory expectations.

Clarity in this area will strengthen the credibility of the provision and ensure that it operates as an integrity mechanism rather than as a source of compliance uncertainty.

Serious contraventions and escalation thresholds

The legislation does not set out clear thresholds for when a “significant failure” or “systematic pattern of conduct” becomes a “serious contravention”. The absence of defined criteria creates uncertainty in a regime where maximum penalties are significantly increased. Given the limited judicial precedent in the NDIS context and the fact that many enforcement matters are resolved administratively rather than tested in court, the practical meaning of these thresholds remains largely untested.

Clear guidance is therefore required on the factors that will inform escalation. These should include repetition, duration, management awareness, failure to remediate, participant harm, and the presence of deliberate disregard. Without transparent criteria, the distinction between isolated breach, significant failure and serious contravention risks becoming subjective.

Hireup also notes that, in the absence of universal mandatory provider registration, enforcement action will continue to be more readily directed toward the regulated segment of the market. Registered providers are visible, identifiable and subject to reporting obligations. Where unregistered actors remain outside equivalent oversight during transition, the expanded penalty framework may operate unevenly.

Strengthened penalties should not result in disproportionate exposure for compliant. Part 3 – Amendments to registration conditions and regulatory powers

The Bill amends a number of provisions within Part 6A of the Act, including section 73J and associated enforcement provisions in sections 73ZC, 73ZI, 73ZM, 73ZNA, 73ZE and 73ZF. These amendments expand the consequences of breaching conditions of registration and strengthen the Commissioner’s regulatory powers in relation to compliance.

Conditions of registration are a central safeguard within the Scheme. They define the circumstances in which a registered provider may operate and give effect to compliance with quality and safeguarding requirements. Hireup supports the principle that conditions of registration must be capable of meaningful enforcement and that persistent or serious non-compliance should attract proportionate regulatory consequences.

Monitoring and investigation powers (application of the Regulatory Powers Act)

The application of the monitoring and investigation framework under the Regulatory Powers Act clarifies the Commissioner’s authority to enter premises with consent or under warrant, inspect documents and systems, examine or record evidence, access electronic records and observe activities relating to the delivery of supports and services. It also strengthens the Commissioner’s ability to compel information and require answers to questions in the course of an investigation.

Effective oversight requires clear and consistent monitoring powers

Effective oversight requires clear and consistent monitoring powers. The capacity to inspect behaviour support plans, review incident management systems, examine rostering and service delivery records, and assess whether reportable incidents have been escalated appropriately is an important safeguard, particularly where there are allegations of unauthorised restrictive practices or failures in governance.

However, the exercise of entry and monitoring powers must be supported by clear administrative protocols. The authority to enter premises with consent or under warrant may, in practice, involve entry into a participant’s home, including SIL settings. Monitoring in these contexts may involve observation of personal behaviours, daily routines and intimate aspects of a person’s life. These circumstances require careful consideration and proportionate exercise of power. Clear national guidance should define when unannounced monitoring is appropriate, how consent is obtained and documented in residential contexts, and how privacy, dignity and confidentiality are protected during inspections.

Practical implementation considerations are also relevant. Monitoring and investigation may require the extraction of large volumes of electronic data, archived material and cross-referenced documentation across multiple internal systems. The time, effort and cost associated with compliance should be recognised in operational guidance, and Commission processes should enable providers to respond efficiently. Oversight mechanisms should support timely information provision without creating unnecessary administrative burden that detracts from frontline service delivery.

Infringement notices and enforceable undertakings

The amendments also expand the use of infringement notices and formalise the availability of enforceable undertakings. Graduated enforcement tools are appropriate within a regulatory framework of this scale. Infringement notices may provide a proportionate response to civil penalty contraventions, while enforceable undertakings allow providers to commit to corrective action within a structured and legally binding framework.

For these mechanisms to operate fairly and effectively, notices should clearly articulate the factual basis for the alleged contravention and provide defined pathways for clarification and review. Consistency in the exercise of these powers is essential. Variability in interpretation or approach between decision-makers risks perceptions of selective enforcement and undermines confidence in the regulatory framework. Clear internal guidance and consistent training for Commission officers will be necessary to ensure that similar conduct is treated alike across the Scheme and that powers are not exercised arbitrarily.

Anti-promotion orders

The Bill also introduces anti-promotion powers to address representations that mislead participants about eligibility, approval status or the nature of services provided. Hireup supports measures that prevent participants from being directed toward unsafe or non-compliant supports through misleading advertising or high-pressure promotional

Hireup

ti activity. Where an anti-promotion order is issued, the affected entity should receive clear written reasons and access to an appropriate review pathway. Transparency in decision-making will support proportionality and maintain confidence in the exercise of this power.

Where an anti-promotion order is issued, the affected entity should receive clear written reasons and access to an appropriate review pathway. Transparency in decision-making supports proportionality and maintains confidence in the exercise of this power.

Protected information (sections 67B–67D)

The Bill introduces civil penalties relating to protected information under sections 67B, 67C and 67D. These provisions prohibit the misuse or improper disclosure of protected information, the improper solicitation of such information, and the offering to sell or supply protected information.

These amendments respond to concerns that participant information has been obtained or traded in ways that undermine privacy and Scheme integrity. Hireup supports measures that address deliberate exploitation of participant data and commercial misuse of information.

The operation of these provisions will depend on the interpretation of terms such as “misuse” and “improper disclosure”. Providers routinely handle sensitive information in circumstances where disclosure may be necessary to respond to safeguarding concerns, serious incidents or risks to participant wellbeing. Information may also be shared internally across governance, compliance and clinical functions, or externally with regulators or law enforcement in good faith.

Clear guidance is therefore required to distinguish deliberate exploitation from unintentional error or disclosure made in good faith for safety or welfare purposes. Without such clarity, there is a risk of compliance uncertainty or hesitation in circumstances where timely information sharing is necessary to protect participants.

Taken together, these amendments strengthen the regulatory architecture of the Scheme. Their effectiveness will depend on clarity of conditions, consistency of monitoring practices, defined escalation pathways, transparent reasoning and proportionate application across the market. Strengthened powers should enhance participant protection while preserving procedural fairness and regulatory certainty.

Part 4 – Claims, payment refusal and recovery powers

nThe Bill expands the circumstances in which the NDIA may refuse, vary, suspend or recover payments where there are concerns regarding non-compliance, ineligible supports or integrity risks. These amendments are intended to strengthen payment

Hireup

tegrity and ensure that Scheme funds are expended in accordance with legislative requirements.

From a provider perspective, the operation of these powers has immediate and practical consequences. Payment is not simply an administrative process. It directly supports workforce continuity, stable rostering and the consistent delivery of participant supports. Delays or uncertainty in payment flow through to staffing decisions and service delivery, affecting participants in real and tangible ways. Where a claim is refused or suspended, the financial and operational impact is felt in real time. Providers must continue to meet payroll obligations, manage workforce commitments and maintain service continuity while disputes or clarifications are resolved.

Hireup supports strong measures to address fraudulent or deliberately improper claims. However, the legislation should recognise the distinction between intentional misuse and administrative or interpretive complexity. The NDIS claims environment involves evolving guidance, varied funding categories and technical compliance requirements. Documentation deficiencies or classification ambiguities may arise despite good faith attempts to comply. A rigid or automated application of refusal or recovery powers in such circumstances risks penalising compliant providers rather than addressing deliberate misconduct.

The expansion of payment refusal and recovery mechanisms also heightens the importance of clear written reasons and defined review pathways. Providers must understand precisely which legislative requirement is said to have been breached, what factual basis underpins the decision and what steps are required to rectify the issue. Without clarity, disputes may prolong unnecessarily, increasing financial exposure and administrative burden.

Refusal decisions should be clearly linked to the specific claim, invoice or legislative requirement in question. Where non-compliance relates to a failure to provide further information or supporting documentation, the consequence should attach to the relevant claim rather than operate as a broader suspension of payment unless expressly authorised by the Act. Precision in application will reduce uncertainty and ensure that enforcement responses are proportionate to the issue identified.

Timeframes are equally significant. Extended payment suspensions pending investigation create uncertainty not only for providers but for participants whose supports depend on stable service arrangements. Clear resolution timeframes and prioritisation of participant continuity are essential. Where concerns are systemic or serious, targeted intervention may be appropriate; however, precautionary suspension should not operate as an open-ended holding position.

Recovery powers similarly require proportionate application. Retrospective recovery of funds can materially affect a provider’s financial viability, particularly where services have already been delivered and workforce costs incurred. The legislation should be administered in a manner that distinguishes between deliberate misconduct and good

Hireup

ti faith reliance on prevailing guidance. A graduated response, including clarification and remediation prior to recovery, supports both integrity and market stability.

These powers will operate within a market that is still undergoing significant reform, including changes to registration settings, pricing pressures and administrative system adjustments. In this environment, clarity of expectation, transparency of reasoning and consistency of application are critical. Payment integrity mechanisms should deter intentional misuse while maintaining a regulatory framework that supports lawful providers to continue delivering services without unnecessary disruption.

Part 5 – Implementation, sequencing and regulatory consistency Scale of reform and market context The amendments made by this Bill materially expand the Commission’s statutory powers and increase the consequences of non-compliance. They strengthen monitoring and investigation provisions, introduce new and escalated civil and criminal penalty tiers, expand the operation of conditions of registration, formalise anti-promotion orders, broaden powers to require information and explanations, and enhance evidentiary mechanisms available in proceedings. Taken together, these changes represent a significant shift in the compliance and enforcement framework under the Act.

The operation of these provisions must be considered in the context of ongoing registration reform and transitional arrangements across the market. During this period, not all service providers will be subject to identical regulatory settings. Registered providers are already subject to reporting obligations, conditions of registration and compliance oversight. Where enforcement expansion precedes uniform regulatory coverage, there is a risk that strengthened powers will be applied predominantly to the regulated segment of the market.

Sequencing and regulatory consistency Careful sequencing is therefore important. Enhanced enforcement provisions should operate alongside measures that ensure consistent regulatory coverage, so that compliance obligations and consequences are applied evenly across providers delivering like supports.

The amendments of this Bill should apply consistently to all persons exercising functions within the Scheme, not only employees or officers of registered providers. The Act refers to “a person”, and this should be interpreted and administered as extending equally to sole traders, individual practitioners, key personnel and other actors operating within the NDIS market.

Given the significant growth in sole trader and independent contractor models, it is essential that the scope of the legislation is uniformly applicable across the market.

Hireup

ti None of the intended mechanisms should fall disproportionately on registered entities while other participants in the Scheme are treated differently in practice. Regulatory expectations regarding the provision of information, and the consequences of non-compliance, must apply consistently to all relevant actors.

Consistency in decision-making will also be critical. The amendments introduce or rely upon concepts such as “significant failure”, “systematic pattern of conduct” and “serious contravention”, which carry materially increased penalty exposure. Clear internal guidance and published regulatory expectations will assist in ensuring that similar conduct attracts similar regulatory responses. Written reasons, transparent escalation criteria and accessible review pathways are essential safeguards within an expanded penalty framework.

Proportional implementation Implementation settings must also be proportionate to provider size and operational complexity. Timeframes for responding to notices, requests for information or directions should be reasonable, particularly where large volumes of material are sought or where providers are managing active incident responses. Clarity about expectations will support timely compliance and reduce unnecessary procedural dispute.

The reforms contained in this Bill are capable of materially strengthening the Scheme’s integrity architecture. Their success will ultimately depend not only on statutory power, but on careful sequencing, consistent application and operational clarity.

Evidentiary certificates and procedural fairness The amendments to section 209 and related provisions expand the Commissioner’s ability to issue evidentiary certificates stating specified administrative facts, which are treated as prima facie proof of those matters unless rebutted. These changes are intended to streamline enforcement proceedings and reduce the need for extensive evidentiary material in relation to non-contentious administrative facts.

Hireup supports measures that reduce unnecessary procedural delay. However, evidentiary certificates should not operate in a manner that displaces the need to substantiate underlying facts where those facts are contested. Affected parties must retain a clear and practical ability to access the material relied upon and to challenge or rebut a certificate in proceedings. The expansion of certificate powers should streamline proof of administrative matters, not lower the evidentiency threshold in contested enforcement actions.

Overall position and recommendations Hireup supports the objective of strengthening the integrity and safeguarding framework of the NDIS. The amendments introduced by this Bill materially expand enforcement powers, increase maximum penalties and clarify investigatory and monitoring provisions. Where deliberate misconduct, systemic non-compliance or

disregard for participant safety is established, strong and credible regulatory

consequences are appropriate.

The effectiveness of these reforms will depend not only on statutory authority but on clarity, consistency and proportional implementation. Concepts such as “significant failure” and “serious contravention” carry materially increased consequences. Monitoring and entry powers extend into sensitive residential settings. Payment refusal and recovery mechanisms have immediate operational impacts. In each case, transparent reasoning, defined thresholds and accessible review processes will be critical to maintaining confidence in the regulatory system.

Integrity reforms are most effective where they operate consistently across the market and are supported by clear guidance. With disciplined implementation and alignment to broader registration reform, the amendments in this Bill are capable of strengthening participant protection while preserving procedural fairness and regulatory certainty.

Recommendations

Section/ Part of legislation	Recommendation
Sections 56–57 (Notices to produce information and explanations)	Publish guidance on reasonable response timeframes, extension processes and factors relevant to enforcement discretion where a provider is engaging constructively with a notice.
Section 59 (False or misleading information)	Clarify the interpretation of “knowingly” in published guidance to distinguish deliberate misrepresentation from administrative error or regulatory ambiguity.
Sections 67B–67D (Protected information)	Clarify in guidance the meaning of “misuse” and “improper disclosure” to distinguish deliberate exploitation from unintentional error or good faith disclosure made in response to safety or welfare concerns.
Serious contravention provisions (including “significant failure” and “systematic pattern of conduct”)	Issue guidance outlining the factors that will inform escalation, including repetition, duration, management awareness, remediation efforts and participant harm.
Part 6A, Conditions of registration (including s 73J and related provisions)	Ensure written reasons accompany the imposition or variation of registration conditions and clearly outline available review pathways.

Monitoring and investigation powers

Develop national protocols governing

(application of the Regulatory Powers Act)

entry to residential premises,
protection of participant privacy and dignity,
handling of electronic records during inspections.

Infringement notices and enforceable undertakings

Provide internal guidance to promote consistent issuance and require clear articulation of the factual basis for alleged contraventions.

Anti-promotion orders

Require written reasons and accessible review mechanisms when issuing an order to ensure transparency and proportionality.

Section 209 and related evidentiary provisions (Evidentiary certificates)

Clarify that evidentiary certificates do not displace the need to substantiate contested facts and that affected parties retain a clear and practical ability to challenge or rebut a certificate in proceedings.

Payment refusal and recovery provisions

Confirm that refusal of payment is linked to specific claims or legislative non-compliance, clearly articulate the credential or documentary requirements relied upon, provide defined review timeframes, and allow reasonable transitional implementation periods where new compliance requirements are introduced.

Implementation sequencing

Align the commencement and application of expanded enforcement powers with universal registration to promote consistent regulatory coverage across the market.