NFP: Defence Guide for NDIS & Aged Care Providers

Introduction

Providers in the National Disability Insurance Scheme (NDIS) and aged care sectors face an increasingly complex regulatory environment, with significant consequences for any breach of their duty of care. Recent high-profile cases involving substantial civil penalties highlight a strong enforcement focus on compliance and safety, underscoring the serious legal and financial risks for providers who fail to meet their obligations.

For not-for-profit (NFP) NDIS and aged care providers, understanding the potential for both civil penalties and criminal charges is therefore essential for maintaining compliance. This guide offers critical learnings from recent enforcement actions, providing a practical defence framework for responding to serious incidents and managing investigations.

Interactive Tool: Check Your Risk of Penalties & Charges for NDIS & Aged Care

The Pincer Movement Facing NDIS Providers

NDIS Commission Civil Penalties

The NDIS Quality and Safeguards Commission is tasked with enforcing the National Disability Insurance Scheme Act 2013 (Cth) and takes strong, deterrent action against NDIS providers who fail to meet their obligations. This includes pursuing significant civil penalties in the Federal Court for serious breaches of compliance, particularly those resulting in harm to a person with a disability.

Recent court decisions highlight the scale of these penalties. For instance, two NFP NDIS providers faced substantial financial consequences following participant deaths:

• In the case of Commissioner of the NDIS Quality and Safeguards Commission v Valmar Support Services Ltd [2025] FCA 11; Valmar Support Services Limited was ordered to pay civil penalties of $1,916,250, which at the time was the largest penalty imposed on an NDIS provider.
• While in Commissioner of the NDIS Quality and Safeguards Commission v LiveBetter Services Ltd [2024] FCA 374; LiveBetter Services Limited was ordered to pay a $1.8 million penalty for 17 contraventions of the National Disability Insurance Scheme Act 2013 (Cth), including breaches of the NDIS Code of Conduct and its conditions of registration.

SafeWork NSW Criminal Charges

In addition to civil proceedings from the NDIS Commission, providers also face the risk of criminal charges from state-based regulators. In New South Wales, SafeWork NSW is empowered to investigate workplace incidents and bring criminal charges against a business for serious safety failures under the Work Health and Safety Act 2011 (NSW).

When a serious incident occurs, SafeWork NSW may conduct an investigation to determine its cause and whether a prosecution is warranted.

The Commissioner of the NDIS Quality v LiveBetter case serves as a clear example of this dual regulatory action, which included:

• The conclusion of the initial civil penalty case.
• SafeWork NSW subsequently bringing separate criminal charges against LiveBetter for a category one breach of its duty of care under the Work Health and Safety Act 2011 (NSW).

Case Analysis: The LiveBetter Precedent for NDIS Providers

The Federal Court’s $1.8M Civil Penalty for NDIS Act Breaches

In the case of Commissioner of the NDIS Quality v LiveBetter involved the tragic death of Ms. Kyah Lucas, a 28-year-old Aboriginal woman with multiple significant disabilities. In February 2022, Ms Lucas suffered fatal burns to 35-40% of her body after being placed in an excessively hot bath by two support workers at her home in New South Wales.

Following legal proceedings initiated by the NDIS Quality and Safeguards Commission, LiveBetter admitted to 17 contraventions of the National Disability Insurance Scheme Act 2013 (Cth). Specifically, the disability provider acknowledged it had failed to:

• Conduct a formal risk assessment of the participant’s home before providing bathing supports.
• Ensure access to competent and appropriate supports to meet Ms Lucas’s needs.
• Adequately train seven support workers in proper and safe bathing techniques.

Consequently, in April 2024, the Federal Court ordered LiveBetter to pay a civil penalty of $1.8 million. The court noted that the provider’s failures were serious as they ultimately resulted in the death of a vulnerable NDIS participant, representing a significant breach of its duty of care.

The SafeWork NSW Criminal Prosecution for WHS Act Breaches

The legal consequences for LiveBetter did not conclude with the civil proceedings. After the Federal Court case, SafeWork NSW commenced a separate criminal prosecution against the NDIS provider for breaches of workplace health and safety laws.

LiveBetter faced criminal charges for a category one breach of its duty of care under the Work Health and Safety Act 2011 (NSW). This is the most serious type of offence, involving gross negligence or reckless conduct that exposes an individual to a risk of death or serious injury.

Furthermore, the provider’s legal proceedings involved:

• Being charged with failing to immediately notify SafeWork NSW of a notifiable incident.
• Pleading guilty to these criminal charges in March 2025.

WHS Criminal Charges & Personal Liability for NFP Directors

What is a WHS Act Category 1 Breach

A Category 1 breach is the most serious criminal offence under the Work Health and Safety Act 2011 (NSW). It arises when a person conducting a business or undertaking (PCBU) acts with gross negligence or recklessness that exposes someone to a risk of death or serious injury.

The penalties that accompany a Category 1 offence are substantial and reflect the gravity of such conduct. The current maximums are:

• 90,424 penalty units for a body corporate – equal to $10,888,858 for the 2024/25 financial year.
• 18,805 penalty units for a remunerated officer – $2,264,498 for FY 24/25 – plus the prospect of 10 years’ imprisonment, or both.

Due Diligence Obligation for NFP Directors & Officers

Officers of an organisation, including directors of NFP providers, owe a personal and proactive duty under the Work Health and Safety Act 2011 (NSW), making it essential to consult a director’s guide for Australian charities to understand these risks.

This obligation requires them to exercise due diligence to ensure their organisation complies with its health and safety duties—a core aspect of NFP governance and compliance—recognising that leadership decisions shape an organisation’s safety culture.

Exercising due diligence means taking reasonable steps in several areas, and officers should take the following actions:

• Acquire and maintain Work Health and Safety (WHS) knowledge relevant to their operations.
• Understand the organisation’s activities and risks, including the hazards inherent in those activities.
• Ensure adequate resources and processes are available to eliminate or minimise risks to health and safety.
• Establish effective processes for receiving, considering and responding to information about incidents, hazards and risks in a timely way.
• Implement processes for compliance with all duties under the Work Health and Safety Act 2011 (NSW), such as reporting notifiable incidents and consulting workers.
• Verify that resources and processes are actually used, confirming they operate as intended.

While it is reasonable for directors to delegate specific WHS functions to qualified employees, they cannot adopt a completely ‘hands-off’ approach. They must stay informed, retain oversight and maintain reporting lines that demonstrate active compliance with their due diligence obligations.

For volunteer officers—such as unremunerated NFP board members—the Work Health and Safety Act 2011 (NSW) offers a specific protection: they cannot be personally prosecuted for failing to meet the due diligence duty.

However, the regulator may still compel compliance through other enforcement powers, including the issue of an improvement notice.

The Bridge to Aged Care Provider Liability

Mirroring NDIS Provider Duties & Obligations

The Aged Care Act 2024 (Cth), which commenced on 1 November 2025, establishes a regulatory framework with provisions for registered providers that are analogous to those in the National Disability Insurance Scheme Act 2013 (Cth).

Consequently, this alignment means that the learnings from civil penalty cases in the NDIS sector are highly relevant for aged care providers, with parallels being evident in key provider obligations.

Both legislative frameworks require providers to adhere to specific conditions of registration, which is enforced through the following mechanisms:

• Under Section 73J of the National Disability Insurance Scheme Act 2013 (Cth), NDIS providers face a civil penalty for breaching a condition of their registration.
• Similarly, Section 142 of the Aged Care Act 2024 (Cth) imposes a corresponding penalty on aged care providers for the same type of breach.

A further parallel exists with the respective codes of conduct, where key obligations include:

• NDIS providers must comply with the NDIS Code of Conduct as per Section 73V of the National Disability Insurance Scheme Act 2013 (Cth).
• Both aged care workers and responsible persons must comply with the Aged Care Code of Conduct under Sections 173 and 174 of the Aged Care Act 2024 (Cth).

In both schemes, a breach of these core obligations carries a potential civil penalty of 250 penalty units.

A New Due Diligence Duty for Responsible Persons in Aged Care

The Aged Care Act 2024 (Cth) introduces a statutory due diligence obligation for responsible persons of government-funded aged care services, which largely mirrors the duty found in the Work Health and Safety Act 2011 (NSW).

This duty requires responsible persons to ensure their organisation complies with its obligation to protect the health and safety of individuals receiving care.

A ‘responsible person’ includes anyone responsible for the executive decisions of the provider or any other person with significant influence over its activities.

To comply with this duty, they must take reasonable steps, including to:

• Acquire and maintain knowledge of the statutory requirements under the Aged Care Act 2024 (Cth).
• Understand the nature of the funded aged care services delivered and the potential adverse effects that can result.
• Ensure the provider uses appropriate resources and processes to manage adverse health and safety effects.
• Establish processes for receiving and responding to information about incidents and risks in a timely manner.
• Implement processes to ensure the provider complies with all its duties and requirements under the Act.

This duty carries the risk of personal liability, with significant consequences for non-compliance:

• A failure to comply can result in a civil penalty of 150 penalty units for a serious failure.
• This penalty increases to 500 penalty units if the failure results in the death or serious injury of an individual.
• Unlike the position for volunteers under the Work Health and Safety Act 2011 (NSW), a volunteer board or committee member of an aged care provider can be personally subject to enforcement proceedings for a due diligence failure.

A Defence Guide for Responding to Incidents & Investigations

First Steps After a Notifiable Incident

Following a serious incident, providers have immediate and critical legal obligations. A ‘notifiable incident’ under the Work Health and Safety Act 2011 (NSW) covers the death of a person, a serious injury or illness, or a dangerous incident—even where nobody is hurt.

Failing to report such an event can result in significant penalties.

If a notifiable incident occurs, you must take the following steps:

• Report immediately: Notify SafeWork NSW as soon as possible by calling its 24/7 contact number.
• Preserve the scene: Do not disturb the site until an inspector arrives or authorises changes; you may, however, help an injured person, remove a deceased person, or make the area safe.
• Notify your insurer: Advise your workers’ compensation insurer of the incident within 48 hours.

Managing a SafeWork NSW Investigation

After an incident is reported, SafeWork NSW may launch an investigation to determine its cause—a process often requiring legal support for managing NFP-related investigations—and whether any breach of work health and safety laws has occurred.

Inspectors can be sent to the site to gather evidence and understand the circumstances that led to the event.

The primary goals of a SafeWork NSW investigation are:

• Establish the precise cause of the incident.
• Identify lessons that will improve safety and prevent similar events.
• Determine whether a prosecution is warranted based on the evidence collected.

Conclusion

NDIS and aged care providers face significant legal risks, including substantial civil penalties and potential criminal charges for any breach of their duty of care. The key learnings from recent enforcement actions underscore the importance of proactive compliance and a clear understanding of personal due diligence obligations for directors.

Therefore, if your organisation is responding to a serious incident or facing an investigation, it is crucial to seek expert legal guidance promptly. To ensure your organisation is protected, contact LawBridge’s experienced not-for-profit lawyers for trusted advice on managing your compliance obligations and defending against civil or criminal proceedings.

Frequently Asked Questions