Aged care and NDIS providers
Business continuity planning for Queensland aged care and NDIS providers.
A continuity plan for a Queensland aged care or NDIS provider sets out how care keeps being delivered when power, staff, transport or systems fail, because for this sector a missed visit or a cold meal is not just an inconvenience, it is a duty of care issue. It needs to satisfy the Aged Care Quality Standards or NDIS Practice Standards requirement for a documented emergency and disaster management approach, not just describe good intentions. Most providers need this reviewed and current, not written once and filed.
72 hrs
commonly used minimum self-sufficiency window built into aged care and disability emergency plans
24-48 hrs
typical notice window before a declared cyclone requires evacuation decisions for a north Queensland facility
1 missed visit
the threshold at which an NDIS or home care disruption becomes a reportable and reputational issue, not just an operational one
The state of play
Where the sector sits right now.
Queensland's aged care and disability sector operates under some of the most explicit continuity obligations of any industry in the state. The Aged Care Quality Standards require providers to have effective organisational governance including risk management systems, and the Aged Care Act framework following the Royal Commission has sharpened expectations around emergency and disaster preparedness for residential and home care providers. NDIS Practice Standards similarly require registered providers to demonstrate business continuity and emergency and disaster management planning as a condition of registration, meaning this is one of the few sectors in Queensland where the obligation is not implied by insurers or clients, it is written into the regulatory framework itself.
What actually stops you trading
The disruptions that hit this sector hardest.
Cyclone or severe weather evacuation
A declared cyclone or major flood event can require evacuation or shelter-in-place decisions for a residential facility with only a day or two of notice. Providers without a rehearsed decision framework and transport arrangement risk a chaotic evacuation that puts vulnerable residents at greater risk than staying put would have.
Missed home care or NDIS visits
Staff shortage, road closure or vehicle failure preventing a scheduled visit is a direct duty of care issue, not an operational inconvenience. A provider without a rapid client prioritisation and rebooking process cannot demonstrate they managed the risk appropriately.
Extended power outage affecting clinical equipment
Refrigerated medication, oxygen concentrators, powered mobility equipment and nurse call systems all depend on power. A facility or in-home client without a backup power plan faces a genuine clinical risk within hours of an outage starting.
Workforce shortage during an outbreak or weather event
A gastro or respiratory illness outbreak, or a severe weather event affecting staff commutes, can strip rostered coverage across a service area simultaneously. Providers need a mutual aid or agency escalation plan rather than discovering the gap on the morning of the shift.
Client record system outage or data breach
A ransomware attack or system failure affecting rostering and client health records can stop safe service delivery and separately trigger Notifiable Data Breach scheme obligations if personal information is exposed, requiring the provider to run a clinical response and a regulatory response at the same time.
Key clinical or coordination staff loss
Losing a registered nurse, care manager or the coordinator who holds the relationships with a client's family and allied health team disrupts continuity of care in a way that is difficult to remediate quickly given workforce scarcity in the sector.
Who is asking for a plan
The pressure is already on.
Clients, insurers, regulators and prime contractors increasingly want evidence, not assurances.
Aged Care Quality Standards and Aged Care Act requirements
Standard 2 and the broader governance requirements expect documented risk management and emergency preparedness, tested and reviewed, not written once at accreditation and left unopened.
NDIS Practice Standards
Registered NDIS providers must demonstrate business continuity and emergency and disaster management planning as part of their registration and audit requirements under the NDIS Commission framework.
Queensland Disaster Management Act arrangements
Facilities in cyclone and flood-prone areas are expected to align with local disaster management group guidance on evacuation and shelter-in-place decisions, which requires the provider to actually know what that guidance is before the event, not during it.
Notifiable Data Breach scheme (OAIC)
Providers holding health and personal information about clients must notify affected individuals and the OAIC of an eligible data breach, which makes a documented incident response plan a practical necessity given the tight notification timeframes involved.
Why planning is worth the afternoon
What it costs to work it out on the day.
For an aged care or NDIS provider, the consequence of poor continuity planning is not primarily financial, it is clinical and reputational, and that changes the calculation entirely.
A missed medication round or a poorly managed evacuation can lead directly to resident harm, and the regulatory and reputational fallout from that, including sanctions or loss of registration, can end a provider's ability to operate at all.
Families making a placement or service decision are increasingly asking providers directly about emergency preparedness, particularly after several well publicised aged care sector failures during severe weather events elsewhere in Australia.
A provider who can produce a clear, current plan is answering a question families are already asking, whether or not they say so out loud.
The dual-track nature of a data breach, a clinical continuity problem running alongside a strict regulatory notification clock, means providers without a pre-written incident response plan lose time on both fronts simultaneously.
That lost time is what tends to turn a manageable incident into a reportable failure.
Because this is one of the few sectors where continuity planning is an explicit condition of registration rather than a discretionary good practice, a provider without a current plan is not just carrying operational risk, they are carrying direct compliance risk that an auditor can and will test.
A realistic morning
A Townsville residential aged care facility faces a category 3 cyclone warning.
A 60-bed residential aged care facility in Townsville receives a cyclone warning on a Thursday with landfall expected within 48 hours.
Facility manager activates the pre-written cyclone plan, checking it against the current local disaster management group advice rather than starting from scratch.
Clinical team reviews the list of residents dependent on powered medical equipment and confirms backup generator fuel and runtime.
Families are contacted using the pre-agreed communication script, giving them a clear shelter-in-place decision and a number to call for updates.
Additional agency staff confirmed for the 48-hour period through the pre-arranged mutual aid agreement, covering rostered staff who cannot get to the facility.
Facility sheltered in place safely through the event, generator maintained power to essential clinical equipment throughout a grid outage lasting into Sunday.
The facility maintained resident safety and clinical care throughout the event without an evacuation, families received timely and honest communication, and the facility's continuity documentation formed direct evidence for its next Aged Care Quality Standards audit rather than a scramble to reconstruct what happened after the fact.
What good looks like
What a plan for aged care and ndis providers should contain.
How we fix it
One app. Your risks, and what to do about them.
The ResilientQLD app has two modules. The Risk Register works out what could stop you trading. The Disruption Playbooks tell whoever is on shift exactly what to do when it happens. Enter your business once, use it on a phone or a laptop, and export a printed copy for the wall.
Risk Register mapped to quality standards
Log clients, equipment dependencies and staffing risk in a Risk Register that lines up directly against Aged Care Quality Standards and NDIS Practice Standards requirements, ready to show an auditor without extra work.
Disruption Playbooks for evacuation and outages
Pre-written playbooks for cyclone evacuation, power outage and workforce shortage mean the facility manager or coordinator on shift can act immediately rather than reconstructing a plan under pressure.
Accessible to shift staff, not just management
The app works on mobile and desktop and is built to be simple enough for whoever is rostered on that day, not just the manager who wrote it, to follow without confusion.
Audit-ready printable plan
Export a current PDF plan for only $1,299 first year, then $999 per year that can be handed straight to an aged care or NDIS auditor, or updated before each cyclone season without starting again.
Questions we get asked
Straight answers.
Do NDIS providers need a business continuity plan in Queensland?
Yes. NDIS Practice Standards require registered providers to have business continuity and emergency and disaster management planning in place as part of registration and audit requirements.
What does the Aged Care Quality Standards require for emergency planning?
The standards require documented risk management and governance arrangements, which in practice means aged care providers need a current, tested emergency and disaster management plan, not just a document produced once for accreditation.
How should aged care facilities plan for cyclone evacuation in Queensland?
Facilities should align their evacuation and shelter-in-place decision framework with local disaster management group guidance, maintain backup power for clinical equipment, and rehearse family communication before cyclone season starts.
What happens if an NDIS or home care provider misses a scheduled visit?
A missed visit is a duty of care issue that should trigger an immediate client welfare check and rebooking under a documented prioritisation process, and repeated or poorly managed misses can attract regulatory attention.
Does a data breach at an aged care provider need to be reported?
Yes, if it involves personal or health information and meets the threshold for an eligible data breach under the Notifiable Data Breach scheme, the provider must notify affected individuals and the OAIC within the required timeframe.
Related guides.
Get your plan sorted before you need it.
Most operators finish the first version in an afternoon. Start in the app, or have a 20 minute conversation with us first.