1. Purpose
Provide a consistent, compliant framework to identify, respond to, report, investigate and learn from incidents, safeguarding the safety, wellbeing and rights of participants, staff and others, in a way that ensures every person is understood, included, and supported to grow. This reflects Heartwood’s vision of communities where behaviour is recognised as communication, and every response is grounded in compassion and connection.
This Policy gives effect to the requirements of the NDIS Act 2013, the NDIS (Incident Management and Reportable Incidents) Rules 2018, and NSW Child Protection legislation, ensuring Heartwood meets all compliance obligations while living our vision and values.
2. Scope
Applies to all Heartwood Support directors, staff, contractors, volunteers, participants and visitors.
3. Policy Statement
Heartwood Support is committed to delivering safe, high-quality, person-led supports that uphold the dignity and rights of every participant.
Guided by our values of Creativity, Heart, and Growth, we:
Respond with compassion and fairness when things go wrong, recognising that every behaviour has meaning.
Ensure every person’s voice is heard and respected in the incident process, co-designing responses that honour individual strengths.
Learn from incidents to innovate safer practices and continuously improve outcomes, challenging the norm to create lasting change.
This policy also sets out our compliance commitments.
We maintain a zero-tolerance approach to abuse, neglect, exploitation and discrimination.
All incidents are managed promptly, fairly, and transparently, with support for affected persons and procedural fairness for anyone subject to an allegation.
Participants are consulted throughout the incident management process and their feedback incorporated into continuous improvements at Heartwood Support.
NDIS reportable incidents are notified to the NDIS Commission within required timeframes.
Mandatory reporting obligations (NSW) for children and young people are met via the Mandatory Reporter Guide (MRG) and reports to the Child Protection Helpline where indicated.
We meet privacy and information-sharing duties (Privacy Act; NSW Care Act Ch 16A).
We use incidents to drive continuous improvement and governance oversight.
4. Definitions
Incident: Any event causing or with potential to cause harm or service disruption.
Reportable Incident (NDIS): Death, serious injury, abuse/neglect, unlawful sexual/physical contact or assault, sexual misconduct, unauthorised restrictive practice (for NDIS participants).
Mandatory Reporter (NSW): Prescribed roles required to report risk of significant harm for children/young people.
5. Roles & Responsibilities
Directors
Ensure the Board is provided with quarterly reports on incidents, trends, and systemic risks, noting nil reports where applicable.
Ensure a fit-for-purpose Incident Management System (IMS) and Incident Register.
Notify NDIS Commission (or ensure delegated submission) and police/DCJ where required.
Commission or conduct internal investigations; ensure risk updates and Board reporting.
Ensure training, recordkeeping (≥7 yrs), and trend analysis feed the Risk Register and Continuous Improvement Register.
Ensure incident learnings are embedded into systems, holding ourselves accountable to those we support by acting with care and consistency.
Senior Behaviour Support Practitioners / Managers
Triage incidents, coordinate response, welfare checks, staff debriefs.
Quality-check and submit NDIS notifications when delegated.
Ensure MRG completion and child protection reports where indicated.
Ensure plan/risk updates post-incident.
All Staff/Contractors
Recognise → Respond → Record → Report → Review (see Section 7).
Notify their Manager and lodge an incident report in CMS within 24 hours.
All staff are mandatory reporters under this Policy and must not delay escalation where child protection or reportable incidents are suspected.
Maintain confidentiality and cooperate with investigations.
Support participants (advocacy, adjustments, safety planning), listening deeply and responding with empathy.
Participants/Families
Report concerns promptly, access advocacy if desired. Reporting won’t affect access to services. Participants and families are encouraged to speak up, knowing their voices drive improvements and shape safer, more inclusive services.
6. Incident Categories & Timeframes
Where an incident involves both NDIS reporting and mandatory child protection reporting, both processes must be followed concurrently.
6.1 NDIS Reportable Incidents (participants)
Notify NDIS Commission within 24 hours: death, serious injury, abuse/neglect, unlawful sexual/physical contact or assault, sexual misconduct.
Notify within 5 business days: unauthorised restrictive practice.
Provide follow-up report within 5 business days of initial notification (or as requested).
Notify police for any alleged criminal conduct.
6.2 Non-reportable incidents
Record in Incident Management System within 24 hours; review monthly/quarterly for trends and improvements.
6.3 Mandatory Reporting – Children/Young People (NSW)
Use Mandatory Reporting Guidelines MRG to determine Risk Of Significant Harm.
If indicated, report to Child Protection Helpline (132 111) immediately.
Document MRG outcome in Heartwood Supports Incident Management System and proceed with any NDIS notification as applicable.
Where not at Risk of Significant Harm, document actions/referrals and continue monitoring.
Quick Timeframe Table
Requirement Who When
Make environment safe; call 000 if required First responder Immediately
Incident Management System entry (all incidents) Staff Within 24 hours
Notify Directors/Senior -
(potential reportable/child protection/criminal) Staff/Manager Immediately
NDIS Commission notification (reportable) Directors/Delegate Within 24 hours (RP within 5 business days)
Police report (criminal conduct) Directors/Delegate Immediately
Child Protection report (132 111) per MRG Mandatory reporter/Manager Immediately if ROSH
Follow-up report to NDIS Directors/Delegate Within 5 business days
Welfare checks to affected person(s) Manager Day 0 and Day 1 (then as needed)
7. Step-by-Step Procedure (the “5 Rs”)
7.1 Recognise
· Be alert to signs: injuries, distress, disclosures, sudden behaviour change, service failures.
7.2 Respond (safety first)
· Ensure immediate safety; call 000 if needed.
· Provide reassurance, dignity, and support (offer support person/advocate), responding with compassion because every person deserves to feel safe and understood.
· Gather detailed information from all parties involved, ensuring participants perspective and voice is heard and respected. The participant (with their advocate or support person) will be contacted by a Director to discuss the incident to gain further information.
7.3 Record Incident
· Enter incident in IMS within 24 hours with objective facts (who/what/when/where; actions taken).
· Flag if NDIS-reportable and/or child-protection concern.
7.4 Report (external notifications)
Manager/Director assesses:
· NDIS reportable? Submit via NDIS portal within 24 hours (or 5 business days for URP).
· Child protection? Complete MRG → if ROSH, phone 132 111; note MRG decision in Incident Management Register.
· Criminal? Notify police.
· Inform participant’s guardian/family of incident reporting (where appropriate and safe).
· Participants will be asked how they wish to be kept informed (e.g., meetings, phone calls, written updates).
· Inform insurers/SafeWork NSW if applicable to workers’ serious injury.
7.5 Consult and Review with Participants (learn & support)
· Debrief with participants, their support networks and staff as appropriate
· Arrange wellbeing/trauma support as required.
· Risk profiles will be updated where indicated to minimise future risks with participants.
· Behaviour Response Plans will be updated with participants and their support networks to reflect changes and improvements.
· Organisational procedures will be updated as required and staff trained in any changes.
· Log systemic issues in Risk Register and actions in Continuous Improvement Register; track to closure and report to Board.
2. Abuse, Neglect, Exploitation & Discrimination - Specifics
Heartwood has a zero-tolerance approach, reflecting our purpose to challenge the norm and our value of Heart — we listen, act, and advocate so every person feels safe, valued, and included.
Examples include physical/sexual/psychological abuse, financial exploitation, neglect, and discrimination based on disability, culture, age, gender or other attributes.
Staff do not investigate allegations themselves - report and escalate.
3. Investigations & Procedural Fairness
Allegations involving staff follow Fair Work and natural justice.
Participants retain access to supports; if they choose to change provider, we support safe transition.
We cooperate with NDIS Commission/DCJ/Police investigations. Internal investigations will be proportionate, documented, and outcomes will be shared with the Board and participants/families where appropriate, respecting privacy.
4. Post-Incident Risk & Continuity
Complete/refresh participant and environmental risk assessments before service resumes.
If risks cannot be safely mitigated, arrange alternative services with the participant.
Ensure changes flow into plans, the Risk Register, and continuity arrangements.
5. Confidentiality & Information Sharing
Handle information per Privacy Act 1988 and Privacy, Confidentiality and Information Management Policy.
Share information with prescribed bodies under Care Act Ch 16A where permitted to protect a child/young person.
6. Recordkeeping
Maintain incident reports, registers, investigation files and notifications for ≥7 years; audit-ready and secure.
7. Communication & Welfare Checks
Contact affected persons by close of business Day 0 and again Day 1; further check-ins based on needs and preference.
8. Training
Induction and annual refreshers: Incident response, NDIS reportable incidents, MRG/child protection, WHS, and this Procedure.
9. Governance, Trends & Improvement
Board reviews Heartwood Support Incident Register.
Trend analysis of incident register with Risk Register; controls updated; CI actions tracked to closure. Lessons learned will be used to build safer systems, strengthening relationships and creating the conditions for individuals, families, and staff to thrive.
This ensures we not only meet compliance obligations but also challenge the norm to create lasting change, delivering practical, person-led improvements that honour each individual.
16. Contacts
NDIS Quality & Safeguards Commission: 1800 035 544 — ndiscommission.gov.au
Child Protection Mandatory Reporter Guide can be completed here > MRG
Child Protection Helpline (NSW): 132 111
Police / Ambulance / Fire: 000
Disability Advocacy: 1300 365 085
OAIC (Privacy complaints): oaic.gov.au/privacy/privacy-complaints
17. Related Documents
Emergency & Disaster Management Framework; Emergency & Disaster Policy & Procedure
Risk Management Policy & Risk Register
Incident Management Register
WHS Policy; Privacy, Confidentiality & Information Management Policy
NDIS Code of Conduct
Document Control
Document name: 6.1 Incident Management Policy and Procedure
Document owner: Heartwood Support
Date created: 14/09/2025
Review cycle: Annual or Trigger review as required
Next review date: 14/09/2026 or as required
Document version: V2 16/09/2025
Approved by: Heartwood Support Board