Sharing information about participants, prospective participants and providers with third parties
The National Disability Insurance Scheme Act 2013 (Cth) (NDIS Act) governs the way the NDIA handles, protects and shares protected Agency information.
Protected Agency information is information about a person that is, or was, held in the NDIA’s records, including information to the effect that the NDIA has no information about a person (section 9 of the NDIS Act).
This includes information about NDIS participants or prospective participants and information about providers.
Sharing information with state and territory agencies
An NDIS participant interacts with many state and territory government agencies in their day-to-day life. Sometimes, the quality of service those agencies provide is enhanced by knowing more about the disability-specific supports funded in a participant’s plan.
State and territory government agencies regularly request information from the NDIA where it is possible or practicable to do so. Please use the NDIA’s prescribed consent form for this purpose.
However, the NDIA realises that it is not always possible or practicable to obtain a participant’s consent to access their information. In limited circumstances permitted by law, the NDIA can release information to a state or territory agency without a participant’s consent.
The NDIA can only release information in accordance with legislative requirements, including the NDIS Act and the Privacy Act 1988 (Cth).
All requests for protected Agency information are assessed on a case-by-case basis and in accordance with the NDIS Act.
The state or territory agency must explain why they have not been able to reasonably obtain consent, why the information is required and what the information will be used for. The NDIA will then decide whether disclosure of the information to that state or territory agency is in the public interest.
To clarify the process for state and territory agencies for requesting information when it is not possible or practicable to obtain a participant’s consent, the NDIA has introduced an Information Sharing Protocol.
Examples of when a state or territory government may request information without a participant’s consent:
- Police are trying to locate a missing person, who is also an NDIS participant. The police make a request to the NDIA for information about the participant’s plan that might assist their search.
- The parents of a child in contact with state or territory youth justice cannot be contacted. A child protection investigation is opened and the child protection agency makes a request to the NDIA to find out if the child is an NDIS participant, so that they can support the child to access their supports.
- A person admitted to a public hospital does not have capacity to provide consent and does not have a known authorised representative. The hospital makes a request to the NDIA to find out if the person is an NDIS participant, so that they can support the person to use their NDIS plan funds and plan for discharge.
To understand more about how the NDIA can share information with states and territories, refer to the Information Sharing Protocol.
- Information Sharing Protocol (DOCX 224KB)
- Consent for your NDIS information (DOCX 67KB)
- Information Request Form (DOCX 1.4MB) - used only when a state or territory agency has not been able to obtain consent.
- Access to information
- Consent forms
Requests for information should be sent to [email protected].
If a request is urgent, please indicate in the request form and covering email why the request is urgent, the date information is required and any other relevant circumstances you would like to bring to the attention of the NDIA. We will prioritise your request where there is a genuine urgency and use our best endeavours to meet the requested timeframe.
Sharing information with other organisations
Only state and territory agencies are covered by the Information Sharing Protocol.
However, in the same limited circumstances permitted by law, the NDIA can also release information to other organisations without a participant’s consent if it is in the public interest to do so.
This means that organisations and people which fall outside of the Information Sharing Protocol can also make a request for protected Agency information.
Requests from organisations and people other than state or territory agencies can also be made to [email protected].
When making a request, the requesting party must explain why they have not been able to obtain reasonably obtain consent and a detailed explanation about why the information is required and what it will be used for.