IT support for NDIS providers in Townsville, so participant records stay private and audit day isn’t a scramble
Tech TroubleShooters looks after the computers, phones, email and security for NDIS providers across Townsville and North Queensland. We keep participant information private, help you show an auditor how it’s protected, and when something breaks you call Kelly or Carisa, not a help desk.
Does any of this sound like your week?
- “The auditor’s booked and I’ve no idea what they’ll ask about our IT.”
- “Half my support workers write their notes on their own phones.”
- “We all share one login for the rostering system.”
- “A worker left last month. I’m honestly not sure what she can still get into.”
- “If someone’s phone got pinched from the car, I wouldn’t know where to start.”
None of this makes you a bad provider. It’s what happens when a small team is busy looking after people, not passwords. But these are the gaps that turn a lost phone into a reportable data breach, and most are quick to close.
What the rules ask of you, in plain words
We’re IT people, not lawyers, so treat this as a plain-English summary rather than legal advice.
The Privacy Act almost certainly applies to you, even if you’re small. Most businesses under $3 million turnover are exempt, but health service providers aren’t. The privacy regulator, the OAIC, counts disability service providers that handle health information as health service providers. If you keep notes about someone’s health or disability support, plan on the Act applying, which means taking reasonable steps to protect that information.
A data breach starts a clock. If you suspect personal information has been lost or seen by the wrong people, you need to assess it quickly, and within 30 days at the most. If it’s likely to cause someone serious harm, you must tell the people affected and the OAIC as soon as practicable.
Registered providers are audited on information management. The NDIS Practice Standards expect each participant’s information to be accurate, current and kept confidential. You need their consent to collect and share it, and to tell them how it’s stored and how they can see it. You also need sensible processes for storing, sharing, keeping and destroying records, in proportion to the size of your organisation. The NDIS Code of Conduct, which covers registered and unregistered providers, includes respecting people’s privacy.
ASD Essentials is the practical yardstick. On 15 October 2026 the Australian Signals Directorate launched ASD Essentials, the successor to the Essential Eight. If a funder, insurer or auditor still asks about the Essential Eight, that’s fine. It stays valid while everyone moves across. Neither is a certificate you can buy, so be wary of anyone offering to “certify” you.
What changes when we look after it
Everyone gets their own login, and we remove access when someone leaves. No more shared passwords, and a clearer answer when an auditor asks who can open what.
Notes on phones, set up sensibly. We can help make sure the phones your workers use have a passcode, and that the apps holding participant notes need two-step sign-in to open. More on managing phones and tablets.
Two-step sign-in on email and the systems that hold participant records, so a stolen password on its own isn’t enough. See multi-factor authentication.
Backups that are encrypted and kept in Australia, so a dead laptop or a ransomware attack doesn’t take your records with it. See data backup.
For managed IT clients, the quiet work happens in the background: monitoring, updates, drive health checks, and security that watches what programs actually do and stops ransomware, rather than shop-bought antivirus. Each month you get a plain-English report of what we updated, checked and blocked, which is handy when someone asks how you manage IT risk. See managed IT and cyber security.
Email and web filtering if you want them, to catch dodgy links before a worker clicks. See email security.
What we won’t pretend
We can’t make you “NDIS compliant”. That depends on your policies, your consent forms and how your team works day to day, as well as your IT. What we can do is make the IT side solid, explain in plain English what’s in place, and help you answer the IT questions before an audit. The policies stay yours. Better to hear that from us than from the auditor.
Who picks up the phone
Kelly Hunn has been fixing IT for more than 30 years, and Kelly and Carisa have run their own business since 2006. When you call, it’s Kelly or Carisa, every time. Usually one of us answers straight away. If we’re driving or on a job, we’ll call or text you back, usually within the hour.
Managed IT clients get 24/7 support at no extra charge, which matters when your workers are out on evening and weekend shifts. Not a client yet? You can still call any time. After hours we’ll get back to you as soon as we can, but we can’t promise to start straight away.
We look after providers across Townsville and out to Ayr, Ingham and Charters Towers, often remotely. No lock-in contract unless you ask for a set term.
Questions NDIS providers ask us
What will an NDIS auditor ask about our IT?
It varies, but expect questions about where participant information is stored, who can open it, how access is removed when a worker leaves, how records are kept and destroyed, and what you’d do after a breach. We can help you get the IT answers and records together.
Do we have to report a data breach?
If the Privacy Act covers you, and for most providers holding health information it does, then yes, when a breach is likely to cause someone serious harm. You assess a suspected breach within 30 days, then tell the people affected and the OAIC as soon as practicable. If you think something has gone wrong, call us early and we’ll help you work out what was actually exposed.
Can support workers use their own phones for participant notes?
They can, if it’s set up sensibly. That means a passcode on the phone, two-step sign-in on the apps that hold participant notes, and notes kept in your system rather than in the phone’s photos or text messages. We can help you set that up.
Where should participant records be kept?
In a system with individual logins, two-step sign-in and encrypted backups. Not in personal email, on a USB stick, or in a shared folder everyone can open. Ask your software provider where they keep your data. Our own backups and hosting stay in Australia.
We’re not registered with the NDIS Commission. Does any of this apply to us?
The Practice Standards audit is for registered providers. But the NDIS Code of Conduct applies to all providers, and the Privacy Act generally applies to anyone holding health information, so the same basics matter.
Can you check our website’s enquiry form?
Yes. Our free Healthcare Website Privacy Scanner checks whether your website could be sending enquiry details somewhere it shouldn’t. It’s quick, and you don’t need to call anyone.
The faces on this page are the people who answer the phone. Odd thing to have to point out, really.
The same two people look after every provider we work with. So in month six, you're still not explaining your setup to a stranger.
Carisa
The calm voice on the other end when things go wrong.
Kelly
30+ years fixing IT. Has seen most problems before, some of them twice.
Usually one of us answers straight away. If we're driving or on a job, we'll call or text you back, usually within the hour.
Managed IT clients get 24/7 support at no extra charge.
We put our own mobiles on the website. Most IT companies would rather not. That's sort of the point.
Tell us what's bugging you.
Talk it through with Kelly or Carisa. They’ll ask how participant information moves around your organisation and tell you honestly what’s fine and what isn’t. No jargon.
No lock-in contracts. If we stop being good, you're free to go. We'd rather you didn't.
Leave your number and Kelly or Carisa will call you back, usually within the hour, and within one business day at the latest.
Busy? We'll ring you.
Leave your number and tell us what's not working. We'll take it from there.