Lesson 24 of 26
Overview
Winter and Ed unpack why a police check is not enough for NDIS hiring, and how the NDIS Worker Screening Check protects participants through a disability-specific risk assessment. They also cover risk-assessed roles, clearance validity, Employer ID workflows, expiry tracking, and the 2026 shift from PRODA to myID and RAM.
Welcome to the show. Winter, the number that matters here is actually ZERO -- zero value in telling yourself a police check is enough for NDIS hiring. Zero? That's the part I want people to hear properly. Because a lot of providers still go, "We've got a police check, we're covered." And you're saying that specific phrase -- police check -- is where they get into trouble? Exactly. A police check and an NDIS Worker Screening Check are not the same thing. The Worker Screening Check is a disability-specific risk assessment done by a state or territory screening unit. It looks at whether someone poses a risk of harm to people with disability. Criminal history can be part of it, sure, but it's not just "did anything show up on a record." It's broader, contextual, and aimed at participant safety. So if I'm a new provider and I say, "But we already sighted a National Police Check" -- the answer is basically, good start, still NOT enough? That's right. In risk-assessed NDIS roles, the Worker Screening Check is the cornerstone requirement. And risk-assessed means more roles than people think. It's not only frontline disability support workers. It's key personnel too -- board members, senior management, executives, decision-makers. Then you've got workers delivering specified supports directly, and workers whose roles involve more than incidental contact with participants. More than incidental contact -- that's the phrase I'd circle in red. Because that's where people get cute with job titles. They call someone "operations" or "coordinator" and forget that if that person is regularly around participants, the title doesn't save them. Spot on. The role content matters, not the fancy label. And the hard rule is simple: if it's a risk-assessed role with a registered provider, the worker needs clearance before they deliver supports. That clearance is valid for up to five years, and once it's granted it's recognised nationally. So if they move from, say, NSW to Queensland while the clearance is still valid, they don't need a whole new NDIS screening clearance just because they've changed state or employer. Up to FIVE years is generous... which is great, but it also makes it easy to get lazy. You hire someone, file the number, and then four years and eleven months later everyone's scrambling. And we'll get to that scramble, because it's very real in 2026. But before that, the operational trap. This catches new providers all the time: the worker starts the application, not the provider. The worker applies through their state or territory worker screening unit, pays the fee, and enters your Employer ID from the NDIS Worker Screening Database. Employer ID -- that's the token people miss, yeah? They assume HR can just lodge everything from the provider side. Yes. You can't lodge it for them. You verify it. That's the distinction. First, your organisation needs access to the Worker Screening Database. Then you obtain the Employer ID through that setup. The worker uses that ID in their application. Once the application lands, you get notified, and you need to verify it promptly in the database so the screening unit can actually start the risk assessment. Promptly as in... not next week, not when someone's back from leave, not after payroll gets sorted. Because if you sit on verification for three days or seven days, that delay is on YOU, not on the worker screening unit. That is EXACTLY it. In 2026, average processing times are about three to four weeks in most states, but complex cases can stretch to eight to twelve weeks, especially around July and August. So if a provider burns a week because nobody understood the Employer ID or nobody had portal access, you've added delay before the clock even starts. Three to four weeks I can live with if it's built into recruitment. Eight to twelve weeks in a complex case, though -- that's not admin, that's workforce planning. That's rostering, backfill, participant continuity... all of it. Yeah, and that's why this isn't just a compliance box. If your pre-employment workflow is messy, participant safety and service continuity both cop it. The best providers treat screening like part of recruitment operations from day one: identify risk-assessed roles early, get database access sorted early, issue the Employer ID immediately, and verify the application the moment the notification comes through. And if you're hearing this thinking, "We'll clean it up after registration," that's backwards. The first hire is when the cracks show. Alright, let's talk about the 2026 bits that feel boring right up until an auditor asks for them. The one I'm hearing most is expiries. Those first clearances from 2020 and 2021 are now hitting the five-year mark. Yep. This is now live, not theoretical. Providers need a worker screening register that tracks every clearance number and expiry date, plus what happens if a clearance lapses, gets suspended, or is refused. And because those early clearances are expiring now, you can't rely on memory or a spreadsheet someone last touched in 2023. The haunted spreadsheet. Every compliance system has one. It always has three tabs, one password nobody knows, and one expiry date in red from fourteen months ago. But seriously, the register is the system. Without it, you're guessing. And then there's the really slippery one: work on application. People hear that phrase once and assume it applies everywhere. It absolutely does not. Rules vary by state and territory. In some jurisdictions, under specific conditions, a worker can start while the screening application is being processed. The Northern Territory is the clean example: the application has to be complete, paid, and verified by the employer in the national database; the employer has to agree; risk management strategies have to be in place; and the worker has to be supervised by someone who already holds a clearance. That NT list -- complete, paid, verified, supervised -- is the kind of detail people skip. They remember "can work on application" and forget the four conditions attached to it. Right, and if you copy-paste NT logic into the wrong state, you can create a serious breach. So before anyone starts without a confirmed clearance, check your state rules and document the supervision and risk controls. Not in your head -- actually document them. And while you're in the portals, there's another deadline sitting there: 30 September 2026. That's the end of the transition from PRODA to myID and RAM for provider identity access. Correct. If you're still using PRODA to access the Worker Screening Database, you need that myID and Relationship Authorisation Manager setup sorted before that deadline. Otherwise you risk losing clean access right when you need to verify applications or monitor statuses. Which is a very specific kind of panic -- the compliance version of losing your keys while the Uber is outside. Okay, stack the rest for me. What are the other mandatory pieces people miss? For anyone supporting participants under 18, a Working With Children Check is mandatory on top of the NDIS Worker Screening Check. And that one is state-based with limited interstate recognition. So a worker moving states may need a new WWCC or Blue Card depending on where they land. Limited interstate recognition is the gotcha there. National for the NDIS screening clearance, not necessarily national for Working With Children. Easy to mix up. Then mandatory training: the NDIS Worker Orientation Module -- Quality, Safety and You. It's free, online, about 90 minutes, and workers need to complete it before providing supports. Keep the certificate. Auditors will ask for it, and a missing certificate is a non-conformity. Ninety minutes. That's so short that not doing it is almost worse. There's no heroic explanation for missing a 90-minute mandatory module. Exactly. Then infection control and PPE training. Workers providing direct supports need training -- and refresher training -- in infection prevention and control, hand hygiene, respiratory hygiene, cough etiquette, and PPE use. It needs to be done before support delivery. The Commission doesn't lock in a precise refresher interval, but annual refreshers are the standard most compliance people recommend. And first aid? Because this is where providers sometimes say, "Well, the Practice Standards don't literally say every worker must have HLTAID..." That's the nuance. The Practice Standards don't mandate first aid training for every single worker in those exact words, but they do require protocols for participant medical emergencies and workers trained to respond, including distinguishing urgent from non-urgent situations. In practice, most employers require first aid and CPR. And importantly, those units need an in-person practical assessment -- not online only. So if someone proudly emails you an online-only CPR completion, that's not a shortcut, that's a problem. Yep. And finally, right to work. Every worker must have legal right to work in Australia before employment starts, and you retain the evidence on file. For citizens and permanent residents that might be a passport or birth certificate with citizenship evidence. For temporary visa holders, you verify the specific work rights and track expiry dates tied to the visa. Which brings us back to the least glamorous thing in the whole episode: the register. One place, current, maintained. Screening clearance, WWCC where needed, orientation certificate, infection control, PPE, first aid, CPR, right to work, role-specific qualifications, registration details -- all of it. Because the simplest failure point is still the deadliest one. An auditor finds one expired clearance, or one missing orientation certificate, and that can become a finding against your workforce management system -- not just one file. And that's the question I'd leave hanging for any provider listening: if an auditor asked for your workforce register at 9 a.m. tomorrow, would you be showing them a system... or a scramble?