National Disability Insurance Scheme (Code of Conduct) Rules 2018

The Rules affect two clearly defined classes of persons designated as “Code-covered persons” in subsection 5(2). The first class is NDIS providers. The term “NDIS provider” is defined by reference to the National Disability Insurance Scheme Act 2013 and encompasses any person or entity that supplies supports or services to NDIS participants using NDIS funding.

The second class is persons employed or otherwise engaged by NDIS providers or members of the key personnel of NDIS providers. This is deliberately broad. “Employed” covers traditional employees under contracts of service. “Otherwise engaged” extends to contractors, consultants, volunteers and any other form of engagement. “Members of the key personnel” is again defined by cross-reference to the Act and typically includes directors, senior managers and other individuals who make decisions or substantially influence the provider’s operations.

Importantly, the Code applies regardless of registration status. The preamble explicitly states that the NDIS Code of Conduct applies to all NDIS providers and persons employed or otherwise engaged by them, regardless of whether they are registered. This universal application ensures that the entire NDIS market, including unregistered providers who may deliver lower-risk supports, is subject to the same baseline standards.

Participants themselves are not directly bound by the Code; they are the beneficiaries. The preamble emphasises that the rules are intended to support participants to be informed purchasers and consumers of NDIS supports and services and to live free from abuse, neglect, violence and exploitation. Families and carers of participants may be indirectly affected when they interact with Code-covered persons, but the legal obligations fall squarely on the provider side.

The Commissioner of the NDIS Quality and Safeguards Commission is not bound by the Code but is empowered by the preamble and the note to section 5 to receive complaints from anyone, investigate alleged breaches, and take education, compliance, enforcement or prohibition action. Courts that hear civil penalty proceedings under section 73V of the Act are also indirectly engaged.

Because the obligations in section 6 apply whenever a Code-covered person is “providing supports or services to people with disability”, the reach is functional rather than organisational. A support worker delivering community access services on a Tuesday afternoon is bound; the same worker in a purely private non-NDIS capacity is not. The pricing prohibition in subsection 6(2) is limited to the supply of goods for a participant, so it only operates in the NDIS context.

In practice the Rules therefore affect every individual and organisation operating within the NDIS ecosystem. The breadth of the second limb of subsection 5(2) means that even a casual support worker engaged for a single shift falls within the definition of Code-covered person and must comply with all seven positive obligations and the pricing rule.

The key duties are exhaustively listed in subsection 6(1) and the prohibition in subsection 6(2). Each duty in subsection 6(1) is expressed as a mandatory requirement (“must”) and is cumulative. The duty in paragraph 6(1)(a) requires Code-covered persons to act with respect for individual rights to freedom of expression, self-determination and decision-making in accordance with applicable laws and conventions. This imports external legal instruments such as the Convention on the Rights of Persons with Disabilities without reproducing their text.

Paragraph 6(1)(b) imposes a standalone duty to respect the privacy of people with disability. This sits alongside but does not duplicate privacy legislation. Paragraph 6(1)(c) requires supports and services to be provided in a safe and competent manner, with care and skill. The conjunctive phrasing means all four elements (safe, competent, care, skill) must be satisfied.

Paragraph 6(1)(d) contains four distinct concepts: integrity, honesty, transparency and (implicitly) their absence of their opposites. Paragraph 6(1)(e) introduces a temporal element (“promptly”) and requires both raising and acting on concerns that may impact quality and safety. Paragraph 6(1)(f) uses the phrase “all reasonable steps” in relation to preventing and responding to violence, exploitation, neglect and abuse. The same “all reasonable steps” formulation appears in paragraph 6(1)(g) for sexual misconduct. The use of “all reasonable steps” imports an objective standard that will vary with the circumstances, resources and role of the particular Code-covered person.

Subsection 6(2) creates a duty not to engage in price gouging of participants. The prohibition applies both to representations of price and to actual charging. The phrase “without a reasonable justification” operates as an exception that the Code-covered person would need to establish. The comparison is with the price represented or charged for the “same (or substantially the same) goods” to a non-participant. The provision is limited to goods; it does not expressly cover services.

Participants possess corresponding rights that are reflected but not directly created by the Code. The preamble states that the Code supports the rights of people with disability in the National Disability Insurance Scheme to have access to safe and ethical supports. Participants therefore have the practical right to expect compliance and the ability to complain when it is not forthcoming. The right to be free from higher pricing for goods is explicit in subsection 6(2).

Key personnel and employed or engaged persons have the duty to comply but no additional statutory rights are created by the Rules. However, the preamble’s emphasis on shaping behaviour and culture may give rise to internal organisational rights such as whistleblower-style protections when staff raise concerns under paragraph 6(1)(e).

The Rules do not themselves prescribe penalties. Instead, the note to subsection 5(3) records that compliance with the NDIS Code of Conduct is a civil penalty provision under section 73V of the Act. Enforcement therefore occurs through the civil penalty regime of the Act rather than through criminal prosecution.

The preamble states that when NDIS providers or persons employed or otherwise engaged by them are found to have breached the NDIS Code of Conduct, the Commissioner is able to take a range of actions as appropriate, including education, compliance and enforcement action or prohibiting them from operating in the NDIS market. Education and compliance action are non-punitive. Enforcement action refers to civil penalty proceedings. Prohibition from the NDIS market is a severe administrative sanction that can prevent a person or organisation from receiving NDIS funding or supplying supports.

Because the obligations are expressed at a high level, enforcement will turn on evidence of specific conduct said to contravene one or more paragraphs of subsection 6(1) or subsection 6(2). A single course of conduct could breach multiple paragraphs simultaneously; for example, failure to prevent sexual misconduct could engage both paragraph (g) and paragraph (f).

The civil penalty nature of the provision means the standard of proof is the balance of probabilities, though the court will apply the Briginshaw principle to serious allegations. The maximum penalty amount is set by the Act rather than these Rules. Courts may also make other orders, such as injunctions or corrective advertising, depending on the powers available under the Act.

Complaints can be made by anyone, as expressly stated in the preamble. This open standing broadens the enforcement net beyond participants to include family members, advocates, other providers or even members of the public who observe conduct.

The Commissioner’s power to prohibit a person from operating in the NDIS market is a significant enforcement tool that can be exercised independently of or in addition to civil penalty proceedings. The precise criteria for prohibition are not set out in these Rules but flow from the broader functions of the Commission under the National Quality and Safeguarding Framework described in the preamble.

The Rules are made under the National Disability Insurance Scheme Act 2013 and are therefore part of the NDIS legislative package. Section 5(1) expressly states that Part 2 is made for the purposes of section 73V of the Act. The Code therefore derives its legal force from the Act and must be read with it.

The preamble records that the NDIS Code of Conduct reflects the core values and principles set out in the National Standards for Disability Services, the National Mental Health Standards and the National Disability Insurance Scheme Act 2013. These instruments are not incorporated by reference but provide interpretive context. Decision-makers applying the Code may have regard to those standards when determining whether, for example, a provider has taken “all reasonable steps” under paragraphs 6(1)(f) and (g).

The privacy obligation in paragraph 6(1)(b) interacts with the Privacy Act 1988 (Cth) and any applicable state or territory privacy legislation. Conduct that breaches the Code may also breach Australian Privacy Principles, creating parallel liability. The duty in paragraph 6(1)(a) to respect rights to freedom of expression, self-determination and decision-making in accordance with applicable laws and conventions draws in the Convention on the Rights of Persons with Disabilities, the Australian Human Rights Commission Act 1986 and any relevant state or territory anti-discrimination or guardianship legislation.

The prohibition on higher pricing in subsection 6(2) intersects with Australian Consumer Law provisions on misleading or deceptive conduct. Representing or charging a higher price without reasonable justification could also constitute unconscionable conduct in some circumstances. However, the Code creates a standalone obligation that does not require proof of misleading conduct or consumer detriment beyond the price differential itself.

State and territory laws regulating disability services, safeguarding, mandatory reporting of abuse, and working with children or vulnerable persons continue to apply. A breach of the Code does not displace obligations under those laws; rather, the same facts may give rise to liability under multiple regimes. The NDIS Quality and Safeguards Commission works alongside state and territory bodies under the National Quality and Safeguarding Framework referenced in the preamble.

The Rules do not contain a supremacy clause. In the event of direct inconsistency with another Commonwealth legislative instrument, ordinary principles of statutory interpretation would apply, with the later-made or more specific provision ordinarily prevailing. Because these Rules are relatively narrow in scope, inconsistency is unlikely.

The instrument as presented is the original 2018 version. The preamble explains the context for its introduction. The NDIS was, at the time, an emerging market requiring minimum expectations to ensure safety and quality. The rules were made to build the capability of NDIS participants and providers to uphold the rights of people with disability and realise the benefits of the NDIS.

The repeated preamble text emphasises that the Commission’s role is to protect and prevent harm. The Code was therefore introduced to shape behaviour and culture and to empower consumers. The decision to apply the Code to both registered and unregistered providers reflects a deliberate policy choice to cover the entire market rather than only regulated entities.

No amendments are recorded in the provided text. The structure has remained stable: a short preliminary part followed by designation of covered persons and the seven positive obligations plus the pricing rule. The use of “all reasonable steps” and “promptly” reflects a flexible approach that avoids the need for frequent legislative updates as the market matures.

The instrument was made because the NDIS represented a fundamental change to funding and delivery. Without a Code of Conduct, there was a risk that the market would not consistently uphold the rights of people with disability. The rules therefore fill a gap by setting minimum expectations that can be enforced through the civil penalty regime and the Commissioner’s powers.

The source text does not refer to any specific court challenges or decided cases. The instrument is relatively recent and its obligations are expressed at a high level of principle, which may reduce the likelihood of constitutional challenges. No controversy about the validity of the rule-making power under section 73V of the Act is mentioned.

Potential areas of controversy can be inferred from the text itself. The breadth of subsection 5(2)(b), which captures every person “employed or otherwise engaged” by a provider, could be challenged in enforcement proceedings on the basis that a particular individual was not sufficiently connected to the provision of supports. The phrase “all reasonable steps” in paragraphs 6(1)(f) and (g) is inherently contestable and likely to generate disputes about what steps were reasonable in the circumstances of a particular provider or worker.

The pricing rule in subsection 6(2) may give rise to controversy about what constitutes “reasonable justification”. A provider that incurs higher costs when supplying goods to participants (for example, additional delivery or adaptation costs) may argue that the differential is justified. The comparison with “substantially the same” goods also leaves room for factual dispute.

Because the preamble refers to the National Standards for Disability Services and National Mental Health Standards, arguments may arise about the extent to which those non-legislative documents can inform the content of the legal obligations. Courts would likely treat them as permissible aids to interpretation rather than binding law.

The open standing for complaints (“anyone can raise a complaint”) could lead to litigation about the Commissioner’s obligation to investigate or the procedural fairness owed to Code-covered persons before prohibition decisions are made. However, none of these controversies are resolved in the instrument itself.

The civil penalty characterisation means that proceedings are heard in civil courts and attract civil rules of evidence. This may be controversial for serious allegations of sexual misconduct or violence, where respondents may argue that a higher standard of proof should apply in practice.

Most people do not realise that the Code applies to unregistered providers and to every individual worker no matter how casual the engagement. A support worker hired for one shift through an online platform is a Code-covered person and can be personally liable for a civil penalty if they fail to take all reasonable steps to prevent sexual misconduct.

The obligation in paragraph 6(1)(e) to “promptly take steps to raise and act on concerns” creates an individual duty. A worker who observes poor practice but assumes management will deal with it may still breach the Code. The duty is not satisfied by internal reporting alone if the concern is not actually acted upon.

The pricing prohibition applies to goods only, yet many providers bundle goods and services. A provider that inflates the goods component of an invoice while keeping the service fee the same may still fall foul of subsection 6(2) if the overall effect is to charge the participant more.

“Reasonable justification” in subsection 6(2) is an exception that the respondent must prove. Providers often assume that any cost difference is automatically justified; the Rules require the justification to be reasonable and capable of demonstration.

The preamble’s statement that the Code reflects the National Standards for Disability Services and National Mental Health Standards means those documents can be used against providers in enforcement proceedings even though they are not reproduced in the Rules. An organisation that complies with its own policies but falls short of those standards may still breach the Code.

Because the obligations apply “in providing supports or services to people with disability”, the same person may be bound on some occasions and not on others. This creates a compliance nightmare for organisations that deliver both NDIS and non-NDIS services with the same staff.

The Commissioner’s power to prohibit a person from operating in the NDIS market is not limited by any monetary threshold or number of breaches. A single serious contravention of paragraph 6(1)(g) could, depending on the circumstances, justify permanent exclusion from the entire NDIS market.

Finally, the repeated preamble is not mere surplusage. Courts may treat the five paragraphs as a statement of statutory purpose that informs the interpretation of every obligation in section 6. Providers who focus only on the black-letter rules in section 6 without reference to the preamble’s emphasis on preventing harm and empowering consumers do so at their peril.

Compliance begins with clear identification of all Code-covered persons. Providers should maintain an up-to-date list of employees, contractors, volunteers and key personnel. Each such person must be made aware of the seven obligations in subsection 6(1) and the pricing rule in subsection 6(2).

Organisations should translate the high-level principles into practical policies. For paragraph 6(1)(a), this means adopting decision-making frameworks that prioritise participant choice and control. Privacy policies must go beyond minimum legal requirements to reflect the specific duty in paragraph 6(1)(b). Clinical governance or quality frameworks should explicitly address the safe, competent, careful and skilful delivery required by paragraph 6(1)(c).

Integrity, honesty and transparency (paragraph 6(1)(d)) require robust conflict-of-interest policies, accurate marketing materials and open disclosure of any limitations on service capability. A dedicated concern-reporting mechanism that satisfies paragraph 6(1)(e) should feed directly into risk management systems so that issues are both raised and acted upon promptly.

Prevention of violence, exploitation, neglect, abuse and sexual misconduct (paragraphs 6(1)(f) and (g)) demands comprehensive safeguarding policies, staff screening, training, supervision and incident response plans. The “all reasonable steps” test means that measures must be proportionate to the risk. Providers working with high-risk cohorts will need more robust systems than low-risk providers.

Pricing systems must be audited to ensure that the same or substantially the same goods are not offered at a higher price to participants. Where a differential exists, documented justification should be retained. The justification must be reasonable and capable of explanation to the Commissioner or a court.

Training should be mandatory, regular and tailored to role. Senior managers (key personnel) require deeper training because their conduct can engage the organisation’s liability and their own personal liability. Records of training, including content and attendance, should be kept.

Complaints handling procedures must be accessible to participants, families and the public. The organisation should treat every complaint as potentially engaging the Code and conduct an internal review against each paragraph of section 6.

Internal audit and quality improvement processes should periodically test compliance with the Code rather than simply with registration conditions. Scenario-based testing of the “all reasonable steps” obligation is particularly valuable.

When a potential breach is identified, the organisation must be able to demonstrate that it promptly raised and acted on the concern. This requires contemporaneous records. Self-reporting to the Commission may be viewed favourably when determining enforcement response.

Organisations should maintain a compliance matrix that maps each obligation in section 6 to specific controls, responsible persons, training modules, audit activities and key performance indicators. Because the Code applies to individuals, employment contracts and contractor agreements should contain express terms requiring compliance with the NDIS Code of Conduct and providing for disciplinary action or termination if breached.

Finally, compliance is not a static exercise. The preamble’s emphasis on building capability and shaping culture means that providers should regularly review policies against evolving practice, participant feedback and any guidance issued by the NDIS Quality and Safeguards Commission. A provider that treats the Rules as a checklist rather than a living statement of minimum ethical standards is unlikely to achieve sustained compliance.