How providers handle your information
NDIS providers need to record information about the supports they deliver. That can feel uncomfortable, especially if you have had services write about you in a way that felt judgemental, inaccurate or out of your control.
Good records should protect you. They help workers understand what support was agreed, what happened during support, what risks need attention, what progress is being made, and what should change. They also make providers accountable for the supports they claim and the decisions they make.
You have the right to ask what is recorded, who can see it, how it is used, and how you can get a copy.
What providers usually record
Different providers record different things, but common participant records include:
- intake information, such as contact details, support needs and preferences;
- NDIS plan details that are relevant to the service;
- consent records;
- service agreements and support schedules;
- support plans, safety plans or communication preferences;
- progress notes after shifts or appointments;
- incident reports if something goes wrong or nearly goes wrong;
- invoices and claim information;
- provider reports for plan reassessments, where agreed.
The level of detail should match the support. A daily-life support note might record what support was provided, how it related to your goals, and any follow-up. A support coordination note might record providers contacted, barriers, decisions and next steps. A psychology note will have different privacy and clinical record requirements.
Records should be factual, respectful and relevant. They should not be gossip, labels or guesses about your character.
Why records matter
Records can feel like surveillance when they are poorly explained. In good practice, they serve practical purposes.
They help keep support consistent. If your regular worker is away, a backup worker may need to know your communication preferences, access needs, current goals and safety plan. That does not mean they need your whole life story.
They help show what support has actually happened. This matters for invoices, plan spending, progress reporting and provider accountability.
They help notice patterns. If support keeps being cancelled because mornings are too hard, that might mean the schedule needs to change. If community access works better after a shorter first visit, that should shape the plan.
They help respond to incidents. If something unsafe happens, a clear record can show what happened, who was present, what was done, and what follow-up is needed.
They help you prepare for plan reviews. A useful provider report can explain the support delivered, the barriers that remain, the progress made, and why ongoing or changed support may be needed.
Who can see your information
Inside a provider, access should be need-to-know. The people who need information to deliver, supervise, roster, invoice, review or safeguard your support may see relevant parts of your file. Not every worker needs every detail.
For example, a support worker may need your support plan, communication preferences and safety information for a shift. An accounts worker may need invoice and plan-management details. A supervisor may need to review notes for quality and safety. Those are different access needs.
Outside the provider, information generally should not be shared without your consent unless there is a serious safety reason or a legal obligation. A provider might need to share limited information if there is immediate risk to life, health or safety, if a court requires it, or if another law requires reporting.
Good providers explain these limits before support starts. They do not use "privacy" to avoid involving people you have chosen, and they do not use "consent" as a blanket permission to tell everyone everything.
Consent is specific and can change
Consent should answer four plain questions:
- Who can the provider talk to?
- What information can be shared?
- Why is it being shared?
- How long does the consent last?
You might consent for your provider to send invoices to your plan manager. That does not automatically mean the plan manager receives support notes. You might consent for a family member to help with scheduling. That does not automatically mean they receive private information about sessions. You might consent to a warm handover to a new provider. That does not automatically mean every old record is sent.
You can withdraw consent or change it. If you withdraw consent, ask the provider what that means in practice. Some information may still need to be kept because the provider has legal record-keeping obligations, but ongoing sharing can usually be changed.
Families and carers often need this explained clearly. Our guide to NDIS supports for families and carers covers the consent balance in more detail.
Your right to access and correct records
You can ask for access to your own information. The provider may need to confirm your identity, check whether any third-party information needs to be managed, and provide the records in a secure way. But the starting point should be that your information is yours to understand.
You can also ask for corrections. If a record is wrong, incomplete or misleading, ask the provider to fix it or add a note that records your concern. Be specific. Name the date, the record if you know it, what is wrong, and what you think should be corrected.
Sometimes a provider may not agree to change a professional note exactly as requested, but they should still take your concern seriously and explain the outcome. You can ask for a written response.
Ellira's public privacy page explains how we handle privacy requests, complaints and contact points.
How long records are kept
Providers cannot simply delete participant records whenever support ends. NDIS, privacy, health, financial and other legal rules can require records to be kept for several years. Some records may need to be kept longer depending on the participant's age, the kind of record, cultural considerations or legal requirements.
That does not mean everyone can keep using or sharing the information. Storage and sharing are different. A provider may need to store a closed file securely, but they still need a lawful reason to access or disclose it.
You can ask:
- how long will my records be kept?
- where are digital records stored?
- who can access closed files?
- how do I request a copy later?
- how are paper records destroyed when they are no longer needed?
A provider should be able to answer without making you feel difficult.
Practical questions to ask any provider
Before starting, or any time you are unsure, ask direct questions:
- What will you write down after each support?
- Can I see an example of a progress note style?
- Who inside your organisation can see my file?
- What information does my worker need before the first shift?
- What information does accounts or rostering see?
- Who will you contact in an emergency?
- Who can you speak with from my family or support network?
- How do I change or withdraw consent?
- How do I get a copy of my records?
- How do I ask for a correction?
The answers should be plain. If the provider cannot explain privacy in ordinary language, ask again before signing.
Common questions
Are support notes about me private?
Yes. They are participant records and should be handled confidentially. Relevant staff may access them for support delivery, supervision, billing, safety or quality reasons, but they should not be shared casually or with external people without consent or a lawful reason.
Can my family read my file?
Only if you consent, unless a formal legal authority applies or a serious safety or legal obligation changes what must happen. You can choose what family members can know and what stays private.
Can I stop a provider sharing information?
You can change or withdraw consent for many kinds of sharing. Ask the provider to record the change. Some safety, legal or record-keeping obligations may still apply, and the provider should explain those limits clearly.
What if a note is wrong?
Ask for a correction in writing. Include the date, what you believe is wrong, and what should be changed or added. Keep a copy of your request and ask for the outcome in writing.
Why do providers keep records after I leave?
Providers are required to keep participant records securely for several years. This supports accountability, legal obligations, audits, complaints, plan reviews and continuity if information is later needed.
Where to from here
For Ellira's privacy contact details, start with our privacy page. To discuss a new support or ask how information would be handled before you proceed, book a call or send a referral.
This article is general information, not medical or clinical advice. For support with your situation, talk to your GP, treating team, or call us on 1300 487 996. In an emergency call 000. For urgent mental-health support call Lifeline on 13 11 14.