How to write NDIS progress notes

Why notes matter

A progress note, or case note, is the record of a support you delivered. Plan managers need evidence that a support was delivered, who delivered it and when, and the NDIA says that evidence can be a receipt or tax invoice, so your invoice has to match what you actually delivered, and your notes are what back it up. A good note shows what you did and how it relates to the support item on your invoice.

The NDIA checks claims before and after it pays them, and says that if complete and accurate records can't be provided during a review, the money may have to be repaid. When it reviews a provider's claim, it asks in writing and gives at least 14 days to send the records. From 15 October 2026, claims made more than 90 days after a support get extra checks and may need more evidence before they're paid, so keep each note with the shift it supports.

Notes also help anyone else who supports the same person: for registered providers, the NDIS Practice Standards ask that each participant's information be accurately recorded and current, and 'appropriately utilised by relevant workers'.

What a good note includes

Stick to facts: write what you saw and heard, not what you guess or feel about it. Use respectful words: the NDIS Code of Conduct, which every NDIS worker must follow, asks you to act with respect for people's rights and to respect the privacy of people with disability. A good test is to write each note as though the participant will read it.

Notes aren't the only record. If you keep a support log, the NDIA says it has to be signed by the participant, a child representative, a nominee or a legal guardian, and its 'Documentation by support type' document shows which records each support category needs.

The same shift, written two ways

Privacy and keeping notes safe

Progress notes hold personal information, and often health information. A business that provides a health service and holds health information is covered by the Privacy Act whatever its size, and the OAIC, the privacy regulator, counts disability service providers that handle health information as health service providers. That means taking reasonable steps to protect notes from misuse, loss and unauthorised access, and destroying or de-identifying them once they're no longer needed, unless a law says to keep them.

In practice: keep notes in one secure place, not in your camera roll or a group chat, where they could be lost or seen by people who shouldn't see them.

Registered providers have a further standard: the core module of the NDIS Practice Standards requires each participant's information to be identifiable, accurately recorded, current and confidential.

How long to keep them

The NDIA says changes are coming under the new NDIS laws to how long records must be kept, including 7 years for providers. It hasn't yet said when they start or exactly what they cover, so check its page on the new laws before you rely on them.

The ATO says you're legally required to keep your business records, most of them for 5 years, generally counted from when you made or got the record or finished the transaction it relates to, whichever is later, and some for longer. Keeping notes and the invoices they support for at least 7 years covers the ATO's general 5 years and the 7 years the NDIA has announced for providers, though the NDIA hasn't yet said how its 7 years will be counted.

If something goes wrong

First make sure everyone is safe. Call 000 straight away if someone needs immediate medical care or you suspect a crime has been committed. Then record the details and any evidence as soon as you can, sticking to what you saw and heard (the NDIS Commission's example is a form completed within 24 hours), and store the record so it stays private and confidential.

Registered providers must notify the NDIS Commission of reportable incidents, most within 24 hours. Unregistered providers don't have to notify the Commission, but the NDIS Code of Conduct, which they must follow, requires all providers to respond to incidents, and the Commission says all NDIS providers should have an incident management system. Anyone can report a concern to the Commission.