NDIS Worker Screening: The Check That Actually Counts
Winter and Ed unpack why a police check is not enough for NDIS hiring, and how the NDIS Worker Screening Check protects participants through a disability-specific risk assessment. They also cover risk-assessed roles, clearance validity, Employer ID workflows, expiry tracking, and the 2026 shift from PRODA to myID and RAM.
Is this your podcast and want to remove this banner? Click here.
Chapter 1
The check that protects participants and your provider
Will, EnableUs Community
Welcome to the show. [matter-of-fact] Winter, the number that matters here is actually ZERO -- zero value in telling yourself a police check is enough for NDIS hiring.
Winter, EnableUs Community
[skeptical] Zero? That's the part I want people to hear properly. Because a lot of providers still go, "We've got a police check, we're covered." And you're saying that specific phrase -- police check -- is where they get into trouble?
Will, EnableUs Community
Exactly. A police check and an NDIS Worker Screening Check are not the same thing. The Worker Screening Check is a disability-specific risk assessment done by a state or territory screening unit. It looks at whether someone poses a risk of harm to people with disability. Criminal history can be part of it, sure, but it's not just "did anything show up on a record." It's broader, contextual, and aimed at participant safety.
Winter, EnableUs Community
[questioning tone] So if I'm a new provider and I say, "But we already sighted a National Police Check" -- the answer is basically, good start, still NOT enough?
Will, EnableUs Community
[calm] That's right. In risk-assessed NDIS roles, the Worker Screening Check is the cornerstone requirement. And risk-assessed means more roles than people think. It's not only frontline disability support workers. It's key personnel too -- board members, senior management, executives, decision-makers. Then you've got workers delivering specified supports directly, and workers whose roles involve more than incidental contact with participants.
Winter, EnableUs Community
More than incidental contact -- that's the phrase I'd circle in red. Because that's where people get cute with job titles. They call someone "operations" or "coordinator" and forget that if that person is regularly around participants, the title doesn't save them.
Will, EnableUs Community
[short pause] Spot on. The role content matters, not the fancy label. And the hard rule is simple: if it's a risk-assessed role with a registered provider, the worker needs clearance before they deliver supports. That clearance is valid for up to five years, and once it's granted it's recognised nationally. So if they move from, say, NSW to Queensland while the clearance is still valid, they don't need a whole new NDIS screening clearance just because they've changed state or employer.
Winter, EnableUs Community
Up to FIVE years is generous... which is great, but it also makes it easy to get lazy. You hire someone, file the number, and then four years and eleven months later everyone's scrambling.
Will, EnableUs Community
[chuckles] And we'll get to that scramble, because it's very real in 2026. But before that, the operational trap. This catches new providers all the time: the worker starts the application, not the provider. The worker applies through their state or territory worker screening unit, pays the fee, and enters your Employer ID from the NDIS Worker Screening Database.
Winter, EnableUs Community
Employer ID -- that's the token people miss, yeah? They assume HR can just lodge everything from the provider side.
Will, EnableUs Community
Yes. You can't lodge it for them. You verify it. That's the distinction. First, your organisation needs access to the Worker Screening Database. Then you obtain the Employer ID through that setup. The worker uses that ID in their application. Once the application lands, you get notified, and you need to verify it promptly in the database so the screening unit can actually start the risk assessment.
Winter, EnableUs Community
[frustrated] Promptly as in... not next week, not when someone's back from leave, not after payroll gets sorted. Because if you sit on verification for three days or seven days, that delay is on YOU, not on the worker screening unit.
Will, EnableUs Community
That is EXACTLY it. In 2026, average processing times are about three to four weeks in most states, but complex cases can stretch to eight to twelve weeks, especially around July and August. So if a provider burns a week because nobody understood the Employer ID or nobody had portal access, you've added delay before the clock even starts.
Winter, EnableUs Community
Three to four weeks I can live with if it's built into recruitment. Eight to twelve weeks in a complex case, though -- that's not admin, that's workforce planning. That's rostering, backfill, participant continuity... all of it.
Will, EnableUs Community
[reflective] Yeah, and that's why this isn't just a compliance box. If your pre-employment workflow is messy, participant safety and service continuity both cop it. The best providers treat screening like part of recruitment operations from day one: identify risk-assessed roles early, get database access sorted early, issue the Employer ID immediately, and verify the application the moment the notification comes through.
Winter, EnableUs Community
And if you're hearing this thinking, "We'll clean it up after registration," [scoffs] that's backwards. The first hire is when the cracks show.
Chapter 2
The compliance stack most providers miss
Winter, EnableUs Community
[curious] Alright, let's talk about the 2026 bits that feel boring right up until an auditor asks for them. The one I'm hearing most is expiries. Those first clearances from 2020 and 2021 are now hitting the five-year mark.
Will, EnableUs Community
Yep. This is now live, not theoretical. Providers need a worker screening register that tracks every clearance number and expiry date, plus what happens if a clearance lapses, gets suspended, or is refused. And because those early clearances are expiring now, you can't rely on memory or a spreadsheet someone last touched in 2023.
Winter, EnableUs Community
[deadpan] The haunted spreadsheet. Every compliance system has one.
Will, EnableUs Community
[laughs] It always has three tabs, one password nobody knows, and one expiry date in red from fourteen months ago. But seriously, the register is the system. Without it, you're guessing.
Winter, EnableUs Community
And then there's the really slippery one: work on application. People hear that phrase once and assume it applies everywhere.
Will, EnableUs Community
[skeptical] It absolutely does not. Rules vary by state and territory. In some jurisdictions, under specific conditions, a worker can start while the screening application is being processed. The Northern Territory is the clean example: the application has to be complete, paid, and verified by the employer in the national database; the employer has to agree; risk management strategies have to be in place; and the worker has to be supervised by someone who already holds a clearance.
Winter, EnableUs Community
That NT list -- complete, paid, verified, supervised -- is the kind of detail people skip. They remember "can work on application" and forget the four conditions attached to it.
Will, EnableUs Community
Right, and if you copy-paste NT logic into the wrong state, you can create a serious breach. So before anyone starts without a confirmed clearance, check your state rules and document the supervision and risk controls. Not in your head -- actually document them.
Winter, EnableUs Community
[matter-of-fact] And while you're in the portals, there's another deadline sitting there: 30 September 2026. That's the end of the transition from PRODA to myID and RAM for provider identity access.
Will, EnableUs Community
Correct. If you're still using PRODA to access the Worker Screening Database, you need that myID and Relationship Authorisation Manager setup sorted before that deadline. Otherwise you risk losing clean access right when you need to verify applications or monitor statuses.
Winter, EnableUs Community
Which is a very specific kind of panic -- the compliance version of losing your keys while the Uber is outside. [short pause] Okay, stack the rest for me. What are the other mandatory pieces people miss?
Will, EnableUs Community
For anyone supporting participants under 18, a Working With Children Check is mandatory on top of the NDIS Worker Screening Check. And that one is state-based with limited interstate recognition. So a worker moving states may need a new WWCC or Blue Card depending on where they land.
Winter, EnableUs Community
Limited interstate recognition is the gotcha there. National for the NDIS screening clearance, not necessarily national for Working With Children. Easy to mix up.
Will, EnableUs Community
Then mandatory training: the NDIS Worker Orientation Module -- Quality, Safety and You. It's free, online, about 90 minutes, and workers need to complete it before providing supports. Keep the certificate. Auditors will ask for it, and a missing certificate is a non-conformity.
Winter, EnableUs Community
Ninety minutes. That's so short that not doing it is almost worse. There's no heroic explanation for missing a 90-minute mandatory module.
Will, EnableUs Community
[responds quickly] Exactly. Then infection control and PPE training. Workers providing direct supports need training -- and refresher training -- in infection prevention and control, hand hygiene, respiratory hygiene, cough etiquette, and PPE use. It needs to be done before support delivery. The Commission doesn't lock in a precise refresher interval, but annual refreshers are the standard most compliance people recommend.
Winter, EnableUs Community
And first aid? Because this is where providers sometimes say, "Well, the Practice Standards don't literally say every worker must have HLTAID..."
Will, EnableUs Community
[careful] That's the nuance. The Practice Standards don't mandate first aid training for every single worker in those exact words, but they do require protocols for participant medical emergencies and workers trained to respond, including distinguishing urgent from non-urgent situations. In practice, most employers require first aid and CPR. And importantly, those units need an in-person practical assessment -- not online only.
Winter, EnableUs Community
So if someone proudly emails you an online-only CPR completion, that's not a shortcut, that's a problem.
Will, EnableUs Community
Yep. And finally, right to work. Every worker must have legal right to work in Australia before employment starts, and you retain the evidence on file. For citizens and permanent residents that might be a passport or birth certificate with citizenship evidence. For temporary visa holders, you verify the specific work rights and track expiry dates tied to the visa.
Winter, EnableUs Community
[reflective] Which brings us back to the least glamorous thing in the whole episode: the register. One place, current, maintained. Screening clearance, WWCC where needed, orientation certificate, infection control, PPE, first aid, CPR, right to work, role-specific qualifications, registration details -- all of it.
Will, EnableUs Community
Because the simplest failure point is still the deadliest one. An auditor finds one expired clearance, or one missing orientation certificate, and that can become a finding against your workforce management system -- not just one file.
Winter, EnableUs Community
[softly] And that's the question I'd leave hanging for any provider listening: if an auditor asked for your workforce register at 9 a.m. tomorrow, would you be showing them a system... or a scramble?