
NDIS Record Keeping Requirements: How Long Providers Must Keep Records (7-Year Rule)
Registered NDIS providers must now keep records for seven years. Destroying them is a criminal offence, and payments can be clawed back if you can’t produce one.
Guides, templates and real-world advice for NDIS providers, straight from our compliance team.
NDIS medication management is one of the areas auditors look at closely, and one of the areas where registered providers get caught out most often. The rules aren’t buried or complicated, but there’s a real gap between knowing they exist and having everything actually in place.
This post breaks down what the NDIS Practice Standards require when it comes to medication, what that looks like for support workers day to day, and what your documentation needs to cover to stay compliant and keep participants safe.
The NDIS Practice Standards sit within the National Disability Insurance Scheme (Provider Registration and Practice Standards) Rules 2018. They apply to every registered NDIS provider, large or small, and cover everything from how you manage incidents to how your workers handle and administer medication.
Medication management sits primarily under the Core Module, in the Provision of Supports standard. The requirement is straightforward on paper: providers must have policies and procedures in place, workers must be appropriately trained, and records must be kept.
At its most basic, the Practice Standards require that:
Not all medication support is the same, and that matters for what training and documentation you need.
Beyond that, there’s a separate category for high intensity supports, things like subcutaneous injections. These fall under the High Intensity Daily Personal Activities module of the NDIS Practice Standards and require workers trained by a qualified health practitioner. It’s a different registration category entirely, and not all providers are registered for it.
Good NDIS medication management doesn’t happen by accident. The Practice Standards expect a specific set of documentation to exist, and auditors will ask for it.
This is where NDIS medication management gets serious.
Under the NDIS (Incident Management and Reportable Incidents) Rules 2018, certain medication errors are reportable incidents. Specifically, a medication error becomes reportable when it results in serious injury to a participant, or when medication is administered to the wrong person.
That said, all medication errors, including near-misses, should be documented internally. If a worker gives the wrong dose and nothing bad happens, it still goes in the incident register. Patterns of near-misses are exactly what auditors look for. Capturing them is what a real safety culture looks like.
Providers who only document incidents that are clearly “reportable” and let smaller ones slide are taking a risk. The NDIS Commission expects incidents, big and small, to be captured, reviewed, and used to improve practice.
A few patterns come up repeatedly when providers run into compliance problems around medication.
Auditors will ask for the policy, individual plans, MARs, and training records. They may also ask workers directly what they know about medication procedures.
Being audit-ready doesn’t mean perfect records going back years. It means having systems that make documentation the default, not something that depends on everyone remembering.
This is exactly what Wholii’s Medication & Incidents module is built for.
Support workers record medication on the go, spoken on shift, structured automatically, timestamped at point of care. No paper MAR charts. No catching up at the end of a shift when details are already fuzzy. The record exists the moment the support happens, linked directly to the participant profile, and ready for manager review instantly.
Credential tracking works the same way. Wholii flags which workers are trained to assist with medication and sends expiry alerts before anything lapses, so you’re not finding out a credential is expired the night before an audit.
For registered NDIS providers where NDIS medication management is a daily operational reality, that kind of infrastructure removes the compliance burden from individuals and puts it where it belongs, in the system.
If you’re a support coordinator placing a participant with a provider, medication management is worth asking about directly.
Ask whether the provider has a written medication policy. Ask how they document administration. Ask what happens when a regular worker is sick and someone covers the shift, is the covering worker trained? Is that training documented?
A provider who can answer these questions clearly has the systems in place. One who can’t is relying on people remembering, and that’s where things go wrong for participants.
The rules around NDIS medication management aren’t there to make life difficult. They exist because medication errors cause real harm. A missed dose, a double dose, the wrong medication given to the wrong participant, these happen when systems aren’t in place.
The Practice Standards give every registered provider a clear baseline: have a policy, train your workers specifically, document every administration, and report what needs to be reported. Getting that right consistently is a matter of having the right systems in place, not just good intentions from good people.
See how Wholii handles NDIS medication management for registered providers.
Book a free demo today: wholii.com.au

Registered NDIS providers must now keep records for seven years. Destroying them is a criminal offence, and payments can be clawed back if you can’t produce one.

From 1 December 2026, NDIS providers have just 90 days to submit a claim — here is what that means for your organisation and what you need to do before the deadline hits.

The NDIS just had its biggest shake-up since launch. Here’s what registered providers need to know, and why compliance matters more now than ever.
