NDIS record-keeping requirements: what to keep, for how long, and in what state
- Published
- 9 September 2026
- Last updated
- 9 September 2026
- Sources last verified
- 9 September 2026
The short answer
Providers must keep records relating to the payment and receipt of NDIS funds for seven years, and failing to keep them attracts a civil penalty. The obligation is easy to state and much harder to meet than most providers assume, because a large share of the records that actually evidence a claim are written by workers who will not still be there in seven years.
Applies to: Providers receiving NDIS funds. Registered providers carry additional obligations under the Practice Standards.
What the official source says
Everything in these blocks is the responsible agency’s own position, with a link to check it. Everything outside them is ShiftNote’s operational reading, which is a different kind of statement.
What the rule says
Providers must keep records relating to the payment and receipt of NDIS funds for seven years, and failing to keep them attracts a civil penalty.
Applies to: Providers receiving NDIS funds.
Where this is not the whole answer
The retention obligation and the penalty come from the 2026 amendments. We have verified them against the Department’s published explanation, not against the section text, and we have not had them reviewed by an Australian lawyer. Confirm the detail — including exactly which records are captured — before relying on it.
Not yet reviewed by an Australian lawyer. We have set it out as the responsible agency states it. Get your own advice before you make a decision that turns on it.
- Official source
- National Disability Insurance Scheme Amendment (Securing the NDIS for Future Generations) Act 2026Parliament of AustraliaRoyal Assent 20 August 2026
- How we checked it
- Checked against the agency’s published summaryLast verified 4 September 2026
The amending Act that shortens the claim window, adds record-keeping obligations and expands payment assurance powers under the NDIS Act 2013.
Read the official source(opens in a new tab)- Official source
- About the changes to the NDISDepartment of Health, Disability and Ageing
- How we checked it
- Checked against the agency’s published summaryLast verified 4 September 2026
The Department’s own plain-English explanation of what the 2026 amendments change and when each change starts.
Read the official source(opens in a new tab)What the rule says
Registered providers must maintain an information management system that stores participant records with defined access, security, retention and disposal processes, proportionate to the supports they deliver.
Applies to: Registered NDIS providers audited against the Practice Standards.
- Official source
- NDIS Practice Standards and Quality IndicatorsNDIS Quality and Safeguards CommissionCore module — Provider governance and operational management (Information management)
- How we checked it
- Checked against official guidanceLast verified 4 September 2026
The standards a registered provider is audited against, including the information-management standard covering storage, security, retention and disposal of participant records.
Read the official source(opens in a new tab)- Official source
- National Disability Insurance Scheme (Quality Indicators for NDIS Practice Standards) Guidelines 2018Commonwealth of Australia
- How we checked it
- Checked against the agency’s published summaryLast verified 4 September 2026
The instrument containing the quality indicators auditors use to assess a provider against each Practice Standard.
Read the official source(opens in a new tab)Retention is the easy half. Retrievability is the hard half.
Keeping a record for seven years is a storage question, and storage is cheap. The question that decides whether the obligation is actually met is different: when someone asks about a specific claim from three years ago, can you produce the record behind it, know that it is the record that was written at the time, and explain the gap between what the record says and what was claimed?
Most providers can answer the first part. Fewer can answer the second, because a note stored as a single editable field has no way to show whether it was written on the day of the shift or after the claim was queried.
The workforce problem nobody has costed
Support work turns over at roughly a quarter of the workforce a year. Over seven years, that is the entire workforce several times over.
Where notes are written in workers’ own personal accounts on whatever tool they found themselves, those records belong to the worker. The provider cannot access them, cannot export them, and cannot produce them on request. When the worker resigns, the evidence behind the shifts the provider claimed for leaves with them.
This is not a hypothetical failure mode. It is the normal state of affairs anywhere note-writing was solved by individuals rather than by the organisation.
What a record has to be able to answer
Retention aside, a record is only useful if it can answer questions about itself. In practice that means four things.
- What does it say — the content, retrievable in full.
- Who wrote it, and were they the person who delivered the support.
- When was it written, as distinct from when the support happened.
- Has it changed since, and if so what changed and who changed it.
What to check in your own organisation
A short audit anybody can run this week without buying anything.
- Pick three claims from six months ago. Can you produce the record behind each one in under five minutes?
- For one of them, can you tell whether the note has been edited since it was first written?
- Where do your workers actually write notes? Ask them, rather than assuming it is the system you pay for.
- If a worker resigned tomorrow, which of their records would you lose access to?
- Do you have a retention policy that says what happens to records at seven years, or do you just have storage?
What ShiftNote can identify
- Whether a claim has a record linked to it at all, which is the first thing a retention obligation depends on.
- Every version of a note written in ShiftNote from the point the record was created — what it said, who acted, and when — as an append-only history.
- Whether the notes behind your claims are held by your organisation or sitting in individual workers’ personal accounts.
What ShiftNote cannot determine
- Retain your records for seven years. ShiftNote has no retention policy and no organisation-level retention setting yet — this is stated on our trust centre and it is why we do not make that claim.
- Give you a history for a note written before the version history shipped, or for a note written in another system.
- Prove anything to a third party cryptographically. The history is append-only with a hash chain; there is no signing key and no external anchoring.
Common questions
- Does seven years apply to progress notes, or only to financial records?
- The obligation is framed around records relating to the payment and receipt of NDIS funds. Whether a particular progress note falls inside that depends on the role it plays in substantiating a claim, and it is exactly the question to put to your own adviser rather than to a software vendor.
- Can we keep records in the worker’s own account and export them later?
- Only if the worker is still there and cooperative when you need them. That is not a records system; it is an arrangement that works until it does not.
- Does ShiftNote keep our records for seven years?
- No, and we will not say otherwise. Notes are kept until an account is deleted. There is no retention policy, no organisation-level retention setting and no deletion hold. It is on the roadmap and it is marked "planned" on our trust centre, not "available".
Change history
- 9 September 2026 — First published. The retention obligation is verified against the Department’s explanation of the 2026 amendments, not against the section text, and is flagged as not lawyer-reviewed.
ShiftNote provides software and operational information, not legal advice. Providers remain responsible for understanding the requirements that apply to their own circumstances.
Related guides
See where your own claims stand
The free audit runs in your browser — your claims file never reaches our server — and shows claim-window exposure from your own dates.