Cyber Security for NDIS Providers: Participant Data Protection and What Your Compliance Obligations Require

The NDIS sector has grown into one of the largest social support programs in Australian history, with over half a million active participants and a registered provider network spanning sole traders to large organisations. That scale, combined with the deeply sensitive nature of participant information, makes the sector an increasingly prominent target for cyber attack.

Health service providers — a category that includes disability support providers — consistently report the highest number of data breaches of any industry in Australia. The OAIC's Notifiable Data Breaches Report for July to December 2024 confirmed this pattern: health and disability services accounted for the highest proportion of reported breaches across all sectors. The data held by NDIS providers explains why: it is comprehensive, sensitive, and — for participants who may have limited capacity to manage the consequences of identity theft or financial fraud — the impact of a breach can be severe in ways that go beyond what statistics capture.

Providers who are also registered health practitioners — physiotherapists, occupational therapists, psychologists, and similar — face AHPRA's Code of Conduct obligations on top of NDIS Commission requirements. Both sets of obligations apply simultaneously, and a single incident can trigger consequences under both frameworks.

What Data NDIS Providers Actually Hold

The starting point for any security analysis is understanding the data you collect and retain. For NDIS providers, this goes well beyond what most small businesses would consider. Across participant records, staff records, and operational systems, a typical provider holds:

• Participant assessment and care plans — functional assessments, support needs, goals, and behaviour support plans; these documents describe a person's disability in clinical and personal detail
• Health and medical information — diagnoses, medications, medical history relevant to supports, allied health reports, and specialist assessments
• Financial information — NDIS plan budgets and funding categories, banking details for plan-managed participants, Centrelink interactions, and invoicing records
• Identity documents — copies of birth certificates, Medicare cards, and government-issued photo ID collected at registration
• Daily care records and progress notes — shift-by-shift records of supports delivered, incidents observed, and participant wellbeing; these create a granular record of a participant's daily life
• Incident and complaint records — reports of restrictive practices, serious incidents, and complaints; these are among the most sensitive records in any organisation
• Home and routine information — for in-home support providers, records may include property access arrangements, daily schedules, and household security details
• Guardian and nominee information — contact details and decision-making authority for participants' families and representatives

The combination of health information, financial data, identity documents, and detailed personal routines in a single record set makes a participant file extraordinarily comprehensive. A breach of this data is not just a privacy incident — it creates the conditions for identity fraud, financial exploitation, and for participants in supported living arrangements, potential physical safety risks.

Your Regulatory Obligations

The Specific Threats Facing NDIS Providers

The threat landscape for NDIS providers has characteristics that differ from other small business sectors. Three threats deserve particular attention:

Ransomware Targeting Care Delivery Systems

NDIS providers are attractive ransomware targets for two reasons: the sensitivity of the data they hold creates leverage for extortion demands, and the disruption of care delivery systems creates operational pressure to pay quickly. A provider that cannot access care plans, shift records, or medication information faces not just data risk but real participant safety consequences. The 2022 CTARS breach — in which the cloud-based case management platform used by multiple NDIS providers was compromised, exposing sensitive participant data — illustrated exactly this dynamic.

Phishing and Account Compromise

Many NDIS providers use cloud-based rostering, billing, and case management platforms, and communicate extensively by email. Support workers often use personal devices and personal email accounts for work-related communication. This creates a diffuse and difficult-to-control attack surface. A phishing email that captures a support coordinator's login credentials can expose every participant file they have access to.

Supply Chain and Third-Party Platform Risk

The 2023–24 ASD Annual Cyber Threat Report documented 107 supply chain incidents — approximately 9% of all recorded incidents. NDIS providers who rely on third-party platforms for rostering, invoicing, or participant management share in the risk profile of those platforms. If a vendor's platform is compromised, participant data held on that platform may be exposed regardless of the provider's own security posture.

Baseline Controls for NDIS Providers

For most NDIS providers, a practical and proportionate security baseline centres on the following controls:

• MFA on all staff accounts — rostering systems, billing platforms, case management software, and email; MFA blocks the majority of account compromise attempts; it is the single most impactful control available
• Role-based access controls — support workers should access only the participant files relevant to the clients they directly support; administrators should not have the same access as senior coordinators; a breach involving one account should not expose every participant record
• Device management policies — if staff use personal devices for work purposes, minimum security requirements (screen lock, device encryption, no jailbreaking) should be documented and enforced as a condition of access
• Encrypted storage of participant records — care plans, assessment reports, and health information should be stored in encrypted systems, not in shared drives, USB sticks, or personal email attachments
• Regular software patching — all software, including rostering apps, case management platforms, and mobile applications, should be kept up to date; unpatched software is the most common technical attack vector
• Offline backup of critical records — in the event of a ransomware attack, an offline backup of participant care plans and critical information allows care continuity without paying a ransom
• Annual cyber security training for all staff — including support workers; training should cover phishing recognition, password management, device security, and what to do if they suspect a breach
• Third-party vendor assessment — before adopting any cloud platform that will hold participant data, assess the vendor's security practices; at minimum, confirm they have MFA, encryption at rest, and a breach notification process
• Documented incident response plan — a clear process for what happens when a suspected breach is detected; who is notified internally, what systems are isolated, and when the OAIC and NDIS Commission are contacted
• Annual privacy and information security assessment — the NDIS Practice Standards expect this as part of audit readiness; it should be documented and retained

Responding to an Incident

If you experience a cyber incident — a ransomware infection, a phishing compromise, an unauthorised access event, or a vendor breach — the response obligations for NDIS providers are layered. Understanding what happens when a breach occurs — the sequence of events, costs, and notification obligations — is essential planning before an incident, not after.

1. Contain and assess — isolate affected systems, reset compromised credentials, and determine what data may have been accessed or exfiltrated
2. Notify the NDIS Commission — the Commission's incident reporting portal should be notified of significant incidents affecting participant safety or data; this includes data breaches involving participant health or personal information
3. Assess NDB obligations — determine whether the breach constitutes an eligible data breach under the Privacy Act; participant health information almost certainly meets the serious harm threshold
4. Notify the OAIC and affected participants — for eligible data breaches, notification must occur as soon as practicable; for participants with limited capacity, notification to nominees or representatives may also be required
5. Notify the ASD — if a ransomware payment has been made and your turnover is above $3M, report within 72 hours
6. Review care continuity — if care delivery systems have been disrupted, the immediate priority is ensuring participant safety; incident response planning should address care continuity alongside data breach response