Secure participant data. Keep support workers working. Stop paying for IT you don't need.
The NDIS Commission is lifting the bar on compliance, and your participant records are among the most sensitive data in Australia. Our fixed-price Tech Health Check shows, in 5 business days, where that data is exposed, what an auditor would ask for, and which software you can stop paying for.
The gaps we see in almost every NDIS provider
Providers grow fast, staff turn over quickly, and IT gets set up by whoever is available. That's fine until an audit, a lost laptop or a phishing email. These are the common gaps:
Former workers still have access
Support workers leave, but their email, rostering app and shared-drive access to participant records often stays active for weeks.
No multi-factor login
A single stolen password can expose case notes, NDIS numbers and health information for every participant you support.
No evidence for the auditor
Policies say "information is kept secure", but there's no record of who can access what, how backups work, or what happens in a breach.
Paying for software nobody uses
Overlapping tools, unused licences and plans nobody has reviewed since setup. Money that should go back into care.
Who it's for
Registered and unregistered providers with roughly 15 to 150 staff and no dedicated IT manager. It suits organisations where workers reach participant information from phones, homes and the community.
SIL and accommodation
Shared devices in houses, rotating rosters and casual staff. We check who can still log in and what is on each shared device.
Community and in-home support
Support workers on personal phones. We check how notes and participant details are protected once they leave the office.
Allied health and therapy
Clinical notes, reports and telehealth. We check file sharing, email security and where health information is stored.
Support coordination and plan management
Plans, invoices and bank details. We check access controls, email fraud protection and who can approve payments.
The NDIS Provider Tech Health Check
A structured, remote review of the systems that hold your participant data and run your operations. You get a clear report you can act on, and evidence you can show an auditor.
| Area | What we check | Why it matters |
|---|---|---|
| Identity & access | Multi-factor login, admin accounts, shared logins, worker onboarding and offboarding, including who can log in to your care platform | Practice Standards: information management and risk management |
| Microsoft 365 / Google | Security settings, email protection, file sharing, external access to participant files | Where most participant data actually lives |
| Devices | Laptops and phones used by staff: encryption, screen locks, updates, lost-device response | Support workers carry participant data into the community |
| Backup & recovery | What's backed up, how often, and whether it can actually be restored | Continuity of supports if systems fail |
| Privacy & breach readiness | Data breach response plan, Notifiable Data Breaches readiness, privacy policy alignment | Most NDIS providers hold health information under the Privacy Act |
| Software & SaaS spend | Every subscription: rostering, notes, billing, Microsoft or Google licences, duplicates, unused seats | Savings you can redirect into care and staff |
Care platforms we review access for: ShiftCare, Lumary, SupportAbility, Brevity, Careview and similar rostering and case-note systems. We check user lists, roles and login security from read-only access or a screen share with your administrator. We are independent of these vendors and don't resell their software.
What we check, and what we don't
A 5-day remote review can't test everything, so every finding in your report is labelled Verified, Sampled or Reported by you.
Verified directly
Microsoft 365 or Google security settings, active accounts compared with your staff list, admin roles, file-sharing links, email protection, and your software subscriptions and licence counts.
Sampled
A sample of staff laptops and phones, care-platform users and roles, and evidence of your most recent backup and restore test.
Reported by you
Policies and day-to-day practices we can't see remotely, such as how workers store notes on personal phones or how paper records are kept.
Not included
Penetration testing, on-site inspections, a legal review of your policies, and your NDIS registration audit itself. We tell you where you need a specialist.
Five days, start to finish
We need about 2 hours of your time across the week. Everything else is on us.
Kickoff call
45 minutes to understand your services, team, systems and audit timeline. You grant read-only admin access.
Review
We review your security settings, accounts, devices, backups and software subscriptions remotely.
Report
A plain-English report with a red/amber/green scorecard, gap list mapped to the Practice Standards, and savings found.
Walkthrough
A 45-minute call to walk you through the findings and a prioritised 30-day fix plan you can run yourself or hand to us.
Simple, fixed pricing
Start with the Health Check. If you want us to fix the gaps and keep you audit-ready, move to ongoing support. No lock-in either way.
Tech Health Check
- Full review across all 6 areas
- Red/amber/green scorecard
- Gaps mapped to the NDIS Practice Standards
- Software savings list with dollar values
- Prioritised 30-day fix plan
- 45-minute findings walkthrough
- Every finding labelled Verified, Sampled or Reported
- Free if we find neither savings nor a material gap
Fix & Harden
- We close the gaps from your report
- Multi-factor login rolled out to all staff
- Onboarding and offboarding checklist set up
- Backups configured and restore-tested
- Data breach response plan drafted
- Audit evidence pack prepared
Managed IT & Compliance
- Ongoing IT support for your team
- Monthly security and access review
- Software spend monitored every month
- Audit evidence kept current all year
- Quarterly report for your board or owners
- Help choosing and moving NDIS software
An independent review, not a sales visit
Many IT companies offer a free assessment that leads to a quote for a monthly contract. The Health Check is a paid, independent review. You keep the report and can hand the fix list to anyone, including your current IT provider.
| Typical "free IT assessment" | Fivefold Tech Health Check | |
|---|---|---|
| Price | Free, quote to follow | $1,490 fixed, published |
| Who does it | Often a salesperson | A CISSP-certified former Global Head of Technology |
| What you get | A proposal for a monthly contract | A written report mapped to the Practice Standards, yours to keep |
| Software costs | Rarely reviewed | Every subscription reviewed, savings in dollars |
| Evidence | General observations | Each finding labelled Verified, Sampled or Reported |
| If nothing is found | Not applicable | You don't pay |
| Afterwards | Sign up or start again | Fix it yourself, use your IT provider, or ask us |
Enterprise-grade security thinking, sized for NDIS providers
Jayden Le has spent 15 years leading technology at organisations including KPMG, De'Longhi and Eclipx Group, most recently as Global Head of Technology. You work with Jayden directly, not a junior technician or a call centre.
- Plain English, no jargon. Reports written for owners and managers, not IT people
- Australian-based, working to Australian privacy law
- Read-only access during the review. We change nothing without your sign-off
- Your data stays in your systems. We don't copy participant records
- Happy to sign your confidentiality agreement
Common questions
No. Only an NDIS Commission-approved quality auditor can conduct your registration audit. We review your IT, security and privacy setup against what the Practice Standards expect, so you go into your audit with the gaps closed and the evidence ready.
Yes. Smaller providers usually have the biggest gaps because there's no dedicated IT person. If you have staff accessing participant information on laptops or phones, the Health Check applies to you, whether you're registered or not.
We review settings, accounts and permissions, not participant records. We use read-only access, never copy participant data out of your systems, and are happy to sign your confidentiality agreement before we start. See how we handle your data.
You pay the fee if the report identifies at least $1,490 a year in software savings, or at least one material gap in how your participant data is protected. If it identifies neither, you don't pay. Savings are estimates based on your current prices and usage. We agree in writing what counts as "material" on the kickoff call. The full wording is in our NDIS Service Terms.
Jayden does every Health Check personally. We work Monday to Friday, 9am to 5pm Sydney time, and reply within one business day. The Health Check is a review, not a helpdesk. For Managed IT clients, support hours, after-hours cover and response times are written into your service agreement before you start.
Yes. Many providers use the Health Check as an independent second opinion. We'll work with your existing IT provider and give them a clear list of what to fix.
No. This is a business service for providers, not a support for participants. It's a normal business expense for your organisation.
See the work before you buy
No form and no email needed.
NDIS IT Audit-Readiness Checklist
25 checks you can run yourself in an afternoon, grouped by the Practice Standards an auditor looks at.
Sample Health Check Report
What you receive on Day 4: scorecard, findings, savings and a 30-day fix plan. A sample for a fictional provider, with illustrative figures.
Book a 15-minute call
Tell us about your organisation and your next audit. If the Health Check is a fit, we can start this week. If not, we'll point you in the right direction.
Choose a timeFivefold AI is an independent IT and technology services business. It is not affiliated with the NDIA or the NDIS Quality and Safeguards Commission, and is not an NDIS approved quality auditor. The Health Check does not guarantee an audit outcome.