Handling, storage of participant files and access to external agencies
Dear National Disability Insurance Agency,
I am submitting a Freedom of Information (FOI) request regarding the NDIA’s policies and procedures on the storage, handling, and access to participant files. Specifically,
How are participant files stored (electronic, physical, or both), and what security measures prevent unauthorized access or alteration? Does NDIA maintain an audit trail for electronic records? What are NDIA’s record retention and deletion policies, including post-tribunal or court case timelines? Can third-party agencies (e.g., legal firms, Independent medical examiners, Technical advisory branch staff) store participant files independently? If so, when must they return or destroy records, or are they allowed to retain copies? What level of access do NDIA legal representatives, external agencies, and TAB staff have? Are TAB staff NDIA employees or external consultants? How does NDIA track and control external access? What measures prevent unauthorized retention of records after case finalization?
Yours faithfully,
Babi Adus
Thank you for your email to the National Disability Insurance Agency
(NDIA) Freedom of Information (FOI) team.
Please note: due to a high volume of requests, our ability to respond to
you in a timely manner may be affected. We will action your request as
soon as possible and will endeavour to process your matter within the
legislative deadlines. We may need to seek your agreement to an extension
of time. We appreciate your understanding if this is required.
Participant Information
Did you know the NDIA has other ways to access the documents and
information that we hold?
Participants, Guardians and Nominees can obtain copies of some participant
information through our National Contact Centre (NCC). For more
information about what’s available through the NCC, please contact 1800
800 110.
Please visit our [1]Access to Information webpage to find out more about
accessing information through:
* The [2]Participant Information Access (PIA) scheme
* The [3]Information Publication Scheme (IPS)
* The [4]myplace portal for participants
* The [5]myplace portal for providers
Access to Data
You can also request data and statistics. Please visit our [6]Data and
insights webpage page for further information.
If you are able to obtain your information from a source listed above, you
can withdraw your FOI request by emailing [7][NDIA request email]
Further Information
Information about how to make an FOI request can be found on our website:
[8]Freedom of Information
Should you have a query unrelated to FOI, please contact the Agency by
email at [9][email address] or via webchat at [10]ndis.gov.au.
Alternatively, you can also contact us by phoning 1800 800 110.
Kind regards
Freedom of Information Team
Complaints Management & FOI Branch
General Counsel Division
National Disability Insurance Agency
E [11][NDIA request email]
The NDIA acknowledges the Traditional Custodians of Country throughout
Australia and their continuing connection to land, sea and community. We
pay our respects to them and their cultures and to Elders past, present
and emerging.
References
Visible links
1. https://www.ndis.gov.au/about-us/policie...
2. https://www.ndis.gov.au/about-us/policie...
3. https://www.ndis.gov.au/about-us/policie...
4. https://www.ndis.gov.au/participants/usi...
5. https://www.ndis.gov.au/providers/workin...
6. https://data.ndis.gov.au/
7. mailto:[NDIA request email]
8. https://www.ndis.gov.au/about-us/policie...
9. mailto:[email address]
10. https://www.ndis.gov.au/
11. mailto:[NDIA request email]
Dear Babi Adus,
Freedom of Information Request: Acknowledgement
Thank you for your request of 28 March 2025, made under the Freedom of
Information Act 1982 (FOI Act), for copies of documents held by the
National Disability Insurance Agency (NDIA).
Scope of your Request
You have requested access to:
“…I am submitting a Freedom of Information (FOI) request regarding the
NDIA’s policies and procedures on the storage, handling, and access to
participant files. Specifically,
How are participant files stored (electronic, physical, or both), and what
security measures prevent unauthorized access or alteration? Does NDIA
maintain an audit trail for electronic records? What are NDIA’s record
retention and deletion policies, including post-tribunal or court case
timelines? Can third-party agencies (e.g., legal firms, Independent
medical examiners, Technical advisory branch staff) store participant
files independently? If so, when must they return or destroy records, or
are they allowed to retain copies? What level of access do NDIA legal
representatives, external agencies, and TAB staff have? Are TAB staff NDIA
employees or external consultants? How does NDIA track and control
external access? What measures prevent unauthorized retention of records
after case finalization?..."
Processing Timeframes
In accordance with section 15(5)(b) of the FOI Act, a 30-day statutory
period for processing your request commenced from 29 March 2025. This
30-day period expires on 27 April 2025.
The 30-day period can be extended in a number of ways, including with your
agreement.
Extension of Time Request:
Unfortunately, it is currently taking us a little longer than 30 days to
process FOI requests due to a very high volume of incoming matters. I am
therefore seeking your agreement to a 30-day extension of time under
section 15AA of the FOI Act. If you agree to this extension, the new due
date for us to decide on your request will be 27 May 2025.
Please let us know if you agree by Thursday 24 April 2025.
Explanation of Extension of Time Request:
The reason I am seeking an extension of time is to ensure I preserve your
review rights under the FOI Act.
FOI applicants are normally entitled to exercise a right of internal
review if they are unsatisfied with the outcome of an FOI decision.
However, this right of review lapses if a FOI decision is not made within
the statutory timeframe. This is because if an agency doesn’t issue their
decision within the statutory timeframe, they are deemed to have refused
the request for documents. If this situation happens, it will limit your
options for formal review to only contacting the OAIC.
You are not obligated to agree to this request, you would still retain
your review rights with our regulatory body OAIC (Office of the Australian
Information Commission).
Irrelevant Information
Section 22 of the FOI Act allows an Agency to redact information from
documents if that information would reasonably be regarded as irrelevant
to a request for access.
Given the nature of your request, it does not seem that NDIA staff
members’ surnames and contact details would be relevant to you. Can you
please send me a reply email confirming that such details are irrelevant
to your request for access?
Action Required
Can I please request a response regarding our request for a 30-day
extension of time, by Thursday 24 April 2025.
Next steps
I have completed some preliminary work on your request; however, your
matter will be allocated to an authorised FOI decision-maker for any
further action. The decision-maker may need to contact you to discuss a
range of matters, including refining the scope of your request.
We will contact you using the email address you have provided. Please
advise if you would prefer us to use an alternative means of contact.
In the meantime, if you have any questions or need help, please contact us
at [1][NDIA request email].
Kind regards,
Mackenzie
Triage Officer – Triage and Early Resolution
Information Release, Privacy and Legal Operations Branch
Reviews and Information Release Division
National Disability Insurance Agency
[2][NDIA request email]
[3]NDIA logo
[4]LGBTIQA+ rainbow graphic
The NDIA acknowledges the Traditional Custodians of Country throughout
Australia and their continuing connection to land, sea and community. We
pay our respects to them and their cultures and to Elders past, present
and emerging.
Miles left an annotation ()
Hello, I have noticed that your request is seeking questions and not specific documents. It is very likely that NDIA will push back on this request as it does not stipulate what documents you are wanting. I would suggest reviewing your scope to request specific documents