Incident Report Template: What Care Providers Should Include

An incident report template for your care business should capture what happened, who was involved, what action was taken, who was notified, and what you changed afterwards to reduce the risk of it happening again.

That sounds simple, but for NDIS, aged care and allied health providers, the details matter. A good form isn't just an admin document. It helps you protect clients, support staff, meet reporting duties and keep a clear record if a complaint, audit or regulator query comes up later.

The practical trick is to make the form easy enough for staff to use under pressure, while still collecting the information your managers need to make the right call.

What Should An Incident Report Template Include?

Your incident report template should include enough detail to tell the full story without asking staff to guess, diagnose or write pages of commentary.

Think of it as your first record of an event. It should be factual, time-stamped and linked to your escalation process. Templates often miss industry-specific details, so it's worth having a lawyer tailor the form before you rely on it across your business.

A practical care provider incident report form usually includes these sections:

1. Basic Incident Details: Record the date, time, location and service setting, such as in-home support, community access, clinic appointment, residential care or telehealth.
2. Person Completing The Report: Include the staff member's name, role, contact details and the time the report was completed.
3. People Involved: List the client, participant, aged care recipient, worker, contractor, visitor or other person involved, using your usual client identifier where helpful.
4. Incident Type: Tick the relevant category, such as injury, medication error, aggression, fall, property damage, privacy breach, restrictive practice, near miss or staff safety issue.
5. What Happened: Ask for a factual description of what was seen, heard and done, not opinions or blame.
6. Immediate Actions Taken: Record first aid, emergency services, medical review, environmental changes, supervision, client support or worker support.
7. Notifications Made: Capture who was told, when and how, such as a manager, nominee, family contact, support coordinator, regulator or insurer.
8. Evidence And Attachments: Note photos, CCTV references, emails, messages, witness notes or clinical records, with privacy controls and a clear access request process around who can access them.
9. Risk Assessment And Follow-Up: Set out what will be reviewed, who is responsible and when it needs to be completed.
10. Manager Review: Include a sign-off section confirming whether the incident is reportable, whether further investigation is needed and what changes are required.

Keep the wording plain. If staff need to choose between five similar categories or interpret legal language, they'll be more likely to avoid the form or fill it in inconsistently.

Do NDIS Providers Need A Different Incident Report Form?

Usually, yes. If you're a registered NDIS provider, your internal form should support your obligations under the NDIS Practice Standards and the NDIS incident management and reportable incidents rules.

Your form doesn't need to look exactly like the NDIS Commission's online forms, but it should collect the information you'll need if an incident becomes reportable. This is especially important because deadlines can be tight.

For registered NDIS providers, reportable incidents include things like:

• the death of a person with disability
• serious injury of a person with disability
• abuse or neglect of a person with disability
• unlawful sexual or physical contact with, or assault of, a person with disability
• sexual misconduct committed against, or in the presence of, a person with disability
• the unauthorised use of a restrictive practice

For most reportable incidents, the NDIS Commission generally needs to be notified within 24 hours of key personnel becoming aware of the incident. For unauthorised use of a restrictive practice, the notification timeframe is generally 5 business days, unless the incident also involves harm or another reportable incident that triggers the 24-hour timeframe.

Your internal form should make it easy for a manager to answer three questions quickly:

• Does this involve a person with disability receiving NDIS supports?
• Could this be a reportable incident?
• Who is responsible for lodging the notification and tracking any follow-up?

This doesn't mean every staff member needs to know the legal test in detail. Your process can ask staff to report all incidents internally, then have a trained manager decide whether it needs external reporting.

Do Aged Care Providers Need To Capture Priority 1 And Priority 2 Details?

Yes. If you're a registered aged care provider, your incident report template should also support your aged care reportable incident obligations. These obligations are separate from NDIS, WHS and privacy reporting, and they can apply even where no other regulator needs to be notified.

Under the current aged care framework, certain reportable incidents involving aged care recipients may need to be notified to the Aged Care Quality and Safety Commission. Priority 1 reportable incidents generally need to be notified within 24 hours. Priority 2 reportable incidents generally need to be notified within 30 days.

Your template should help a manager work out whether an incident is Priority 1 or Priority 2 and collect the information needed to lodge the notice. For example, it should capture:

• whether the person was receiving aged care services at the time
• the type of service, such as residential care, home care or community-based care
• whether the incident involved unreasonable use of force, unlawful sexual contact, neglect, psychological or emotional abuse, unexpected death, stealing or financial coercion, inappropriate restrictive practices, or a missing consumer
• whether the incident caused, or could reasonably have caused, physical or psychological injury
• whether police, emergency services, a doctor or another external professional was contacted
• what immediate steps were taken to protect the person and reduce ongoing risk

It also helps to include a manager prompt asking, "Could this be a Priority 1 notice, a Priority 2 notice, both an aged care and NDIS reportable incident, or a WHS notifiable incident?" That prompt can stop a serious matter being treated as an ordinary internal complaint.

How Should Staff Use A Workplace Incident Report Template?

Your staff should complete a workplace incident report as soon as everyone is safe and any urgent support has been arranged.

In care settings, incidents can involve both client safety and worker safety. A client fall may also involve a staff injury. A challenging behaviour incident may also raise psychosocial safety issues for your team. Your form can cover both, but your process should be clear about when it triggers WHS action as well.

Under work health and safety laws, you may need to notify your state or territory WHS regulator immediately if there's a notifiable incident, such as a death, serious injury or illness, or a dangerous incident arising out of your work. You may also need to preserve the incident site, so staff should know who to call before anything is moved, unless changes are needed to make the area safe or help an injured person.

A simple staff process might look like this:

1. Make The Situation Safe: Provide first aid, call emergency services if needed and remove immediate risks.
2. Tell The Right Person: Notify the shift supervisor or manager straight away for serious incidents, and by the end of the shift for lower-risk matters.
3. Complete The Form: Record the facts while memories are fresh, including times, actions and people notified.
4. Attach Supporting Material: Save photos, messages, rosters or witness notes in the approved system, not on personal phones or email accounts.
5. Manager Review: Decide whether the incident is reportable, whether WHS notification is required and what follow-up is needed.
6. Close The Loop: Record corrective actions, who completed them and whether the client or worker needs extra support.

Say Mina runs an allied health clinic in Geelong. A therapy assistant slips while helping a client transfer from a chair, and the client also grazes their arm. Mina's form lets the assistant record the client injury, the worker injury, the wet floor, the time first aid was given and the manager notified. Mina then reviews whether workers compensation, WHS notification, NDIS reporting or service agreement notification is needed. One form creates a clear trail instead of four disconnected conversations.

What Privacy Details Should You Capture And What Should You Leave Out?

You should capture the information you genuinely need to manage the incident, but avoid unnecessary health details, personal opinions or gossip.

Care providers often handle sensitive information, including health information and disability-related information. The Privacy Act 1988 and the Australian Privacy Principles may apply to your business, especially if you're a health service provider or otherwise covered by the Act. Even if your business isn't covered in every situation, good privacy practices are essential for trust and professional risk management.

Your incident report should focus on:

• what happened and when
• the person's immediate needs
• what support was provided and what consent was obtained
• who needed to be told
• what follow-up is required

It should avoid:

• unrelated medical history
• speculation about a person's motives
• judgmental language about behaviour
• details about other clients who weren't involved
• photos or videos unless there's a clear business reason and they're stored securely

Access matters too. Not every staff member needs to see every incident report. Your system should limit access to managers and workers who need the information to provide services, investigate the incident or meet legal obligations.

If an incident involves a privacy breach, such as an email sent to the wrong family or a lost device containing client records, treat that as its own incident category. Under the Notifiable Data Breaches scheme, if you're covered by the Privacy Act, you generally need to assess a suspected eligible data breach within 30 days and notify affected individuals and the Office of the Australian Information Commissioner if it's likely to result in serious harm.

Who Should Incidents Be Escalated To And When?

It depends on the seriousness of the incident, but your policy should tell staff exactly who to contact and how quickly.

A form is only useful if it connects to a real escalation pathway. Otherwise, incidents sit in inboxes, staff assume someone else is dealing with it, and your business may miss a deadline.

Your escalation pathway should cover at least these levels:

• Low-Risk Incidents: Minor issues with no injury or ongoing risk, reviewed by a supervisor within your internal timeframe.
• Moderate Incidents: Injuries, repeated issues, medication concerns, behavioural incidents or near misses needing manager review and a follow-up action plan.
• High-Risk Incidents: Serious injury, abuse, neglect, death, sexual misconduct, serious WHS risks, major privacy breaches or matters likely to be reportable to a regulator.

For each level, set out:

• who must be called immediately
• who lodges external notifications
• who speaks with the client, nominee or family contact, including any consent needed
• who supports the worker involved
• who approves corrective actions
• who signs off that the incident is closed

For example, Tom operates a registered NDIS support business in Adelaide. At 8:30 pm, a support worker calls to say a participant has been taken to hospital after a suspected medication error. Tom's policy says the worker must call the on-call manager immediately, complete the internal incident report before finishing the shift if safe to do so, and upload medication records. The on-call manager treats it as potentially reportable and escalates it to the authorised key personnel by 9:15 pm. That gives the business a clear path to assess whether the NDIS Commission needs to be notified within 24 hours.

You can also build escalation prompts into the form. For example, if staff tick serious injury, abuse, restrictive practice, medication error, police attendance, emergency services or privacy breach, the form can require immediate manager notification.

How Do Incident Records Connect To Your Policies And Service Agreements?

Your incident records should line up with your incident response policy, staff training and service agreements, so everyone knows what happens after a form is completed.

This is where many templates fall short. They collect details, but they don't connect the incident to the documents that govern your business. That can create gaps between what you promise clients, what staff are trained to do and what actually happens during a stressful event.

Your incident process should match your:

• Incident Management Policy: What counts as an incident, who reports it and how it's reviewed.
• WHS Policy: How worker injuries, dangerous incidents and psychosocial hazards are handled.
• Privacy Policy: How personal information is collected, stored, shared and accessed, including during a privacy incident.
• Complaints Policy: How clients can raise concerns and how you respond.
• Restrictive Practices Or Behaviour Support Procedures: How restrictive practices are authorised, monitored and reported.
• Staff Contracts And Contractor Agreements: What workers must report, confidentiality rules and consequences for failing to follow process.

Your service agreements also matter. For care and disability providers, your agreement can explain how you handle incidents, when you'll contact a nominee or emergency contact, and when you may need to share information with regulators, health professionals, insurers or other providers.

If you use subcontractors, don't assume they'll follow your internal process unless their agreement says so. Their contract should require prompt incident reporting, cooperation with investigations, confidentiality and compliance with your policies. Without that, you may struggle to get the information you need when an incident involves a contractor providing services under your brand.

The goal isn't more paperwork. It's a connected system where the form, policy, staff training and client agreement all point in the same direction.

Key Takeaways

• An incident report template should capture the facts, immediate action, notifications, follow-up steps and manager review.
• NDIS providers should design forms that support reportable incident decisions, including the 24-hour and 5-business-day notification timeframes.
• Aged care providers should capture enough detail to assess Priority 1 and Priority 2 notices, including the general 24-hour and 30-day timeframes.
• Workplace incidents may also trigger WHS duties, especially for serious injuries, dangerous incidents and staff safety risks.
• Privacy matters. Collect what you need, limit access and avoid unnecessary sensitive details or speculation.
• Your form should connect to your incident policy, privacy policy, WHS process, staff agreements and client service agreements.

If you'd like help with your incident report template, incident management policy, privacy documents or care provider service agreements, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.