Allied Health NDIS Audit Checklist: worksheet

Protect disclosers: keep identity confidential and prohibit victimisation

NDIS Provider Registration Rules. Edition held: NDIS (Provider Registration and Practice Standards) Rules 2018, Compilation No. 6 (F2026C00527), in force 1 July 2026, with NDIS Act 2013 Part 3A as in Compilation No. 27 (C2026C00401); checked current on 6 October 2026 (Federal Register: latest version on 6 October 2026).

Under review, not in force: The plan management changes made by the latest amending Act start on proclamation and are not in force. The provisions this product cites are in force.

Standards library: https://compliance.theartofservice.com/frameworks/australia-ndis-provider-registration-rules-2018. Page: https://allied-health-ndis-audit-checklist.theartofservice.com/rules/ndis-provider-registration-rules/s73zba-73zc-protect-disclosers-keep-identity-confidential/

Ref	Requirement (our statement of the clause)	Evidence an auditor or the regulator asks for	Common gap to check	Held (yes, partly, no, not applicable)	Where it is kept	Owner	Last reviewed	Next review
Act ss 73ZBA and 73ZC	Workers, contractors, participants, nominees, families, carers and advocates who report a suspected contravention of the NDIS Act to the Commissioner, the Agency or the provider's key personnel or partners on reasonable grounds are protected (s 73ZA). No one may disclose the discloser's identity or information likely to identify them except as s 73ZBA(2) authorises (Commissioner, Agency, police, legal advice, consent, serious threat to safety, courts, complaint handling) (civil penalty 30 penalty units), and no one may cause or threaten detriment because of a protected disclosure (s 73ZC; civil penalty up to 10,000 penalty units for a serious contravention by an NDIS provider, otherwise 500), with a right to compensation (s 73ZD). Source: https://www.legislation.gov.au/C2013A00020/latest/text	Whistleblower policy covering who is protected, recipients, confidentiality and anti-victimisation; Restricted-access register of protected disclosures; Training for key personnel who may receive disclosures	Discloser identity shared with the manager being complained about; Roster cuts or contract termination after a worker reports to the Commission	☐ yes ☐ partly ☐ no ☐ n/a

Completing this worksheet records what your practice holds and where. It does not make a practice compliant or ready for audit, and it is not legal advice.