NDIS providers: use AI and keep participant details private

In disability support, the writing happens at the end of a shift. A support worker in a SIL house types up the progress note at nine at night. A team leader has an incident report to finish before handover. A behaviour support practitioner is redrafting a plan ahead of its review, and a support coordinator is writing to the planner about a change in circumstances.

Every one of those documents names the participant, and most add an NDIS number and a date of birth. Health letters bring the Individual Healthcare Identifier and a Medicare card. Incident reports and service agreements bring the nominee or guardian, with their phone number. Each of those details points to one person even with the name taken out.

What to take out first, and the judgement that has to stay with a colleague, is in our guide to cleaning up a case note before AI. This page covers the mechanical pass that happens on the computer before any of it reaches a chatbot.

With AI for NDIS progress notes and incident reports, order matters: the worker selects the text, presses one key, and only then pastes into ChatGPT, Claude or Copilot.

In the invented report below, the participant’s name, NDIS number, date of birth and IHI leave as placeholders, and so do the nominee’s name and mobile. The account of the evening stays whole: what upset him, what he did, which strategies from the plan staff used, how long he took to settle and that no restrictive practice was used. That is what the AI needs to turn rough notes into a clear report.

The reply comes back written to [PERSON_1] and [PERSON_2], and the real names return on the worker’s screen. Every change is marked before the paste. What OpenAI holds on to afterwards is set out in what a pasted note leaves behind.

The NDIS Commission’s position statement on AI is about behaviour support plans, and it backs no AI tool for writing them. The expectation that matters for everyone else sits in one paragraph, quoted below: that no personal information of participants is disclosed to AI systems.

The verbs are worth reading slowly. The Commission expects and says should, and the consequence it names arrives through the NDIS Act and providers’ existing obligations, not through a new rule about AI. It also says plainly that this does not prevent providers using AI within those obligations.

Practitioners registered with Ahpra have their own regulator saying much the same about clinical information, and our summary of its AI guidance sets it out.

The Commission’s AI transparency statement, published in February 2026, says it uses Microsoft 365 Copilot Chat and large language models to process text such as complaints, reportable incidents and audit reports, and that a person stays between the tool and anyone affected by what it produces.

That is a model a provider can follow without much cost. Choose the tool on purpose rather than letting staff sign up to whatever is open in the browser. Have a person check every output before it goes on a participant’s file. And keep the participant identifiable only on your own systems, which is the step Nonimo takes on each computer.

The IHI deserves a special mention, because it is the number that slips through. It arrives in discharge summaries from the hospital, is copied into a note out of habit, and on its own leads straight back to one person. Nonimo turns it into [IHI_1].

Start with the team that writes the most: shift workers in supported accommodation, or the practitioners drafting behaviour support plans. Install Nonimo on Mac or Windows from the downloads above and press the key on the next note before it is pasted.

Each computer installs it separately, and nobody needs to learn a new chatbot.

Across a whole provider, IT deploys the browser extension by policy, and it covers text pasted into the AI tools without anyone pressing a key, at every site on the roster. The step slots into your AI procedure and your training, and our security page describes how the redaction works.