NDIS provider portal access: A myID and RAM checklist for SDA teams

The NDIA says providers and employees accessing NDIS systems need myID and RAM. The current provider portal guidance says each employee who uses the portals needs their own Digital ID with myID, and the organisation's principal authority needs to link the business in RAM before authorising others.

The NDIS Commission transition is separate. Its guidance says providers, quality auditors and government agencies can now use myID and RAM for NDIS Commission portals, with the transition period scheduled to end on 30 September 2026. The Commission also makes clear that this change does not replace NDIS worker screening checks.

The operational point is simple: do not treat portal access as one finance login. In SDA, access controls decide who can enrol or modify dwellings, submit claim and payment enquiries, download reports, view participant information, manage registration tasks and lodge urgent regulatory notifications.

SDA providers should keep a clear map of which portal does which job. NDIS guidance says the my NDIS provider portal is used for participants on the new computer system, while myplace is used for participants on the old computer system. It also says all SDA dwelling enrolments and claim or payment enquiries are handled through the my NDIS provider portal, while claims and payment requests are submitted through myplace.

Commission portals support a different risk profile. Registered providers use the Commission portal to manage registration. Commission guidance for reportable incidents says registered providers use the Registered Provider portal to submit required incident notifications. Worker screening guidance also points registered providers to the portal for worker screening database access, worker linking and employer ID tasks.

That split matters because the people who need access are not always the same. Finance may need claim status and payment request access. Operations may need dwelling enrolment and participant relationship visibility. Compliance may need registration, worker screening and incident-notification access. Executives may need principal authority or authorisation administrator coverage.

Use this checklist before the next access problem becomes a claim delay, registration blocker or incident-reporting scramble.

Portal access is also a privacy control. NDIS provider portal guidance lists functions such as viewing participant details, seeing plan and budget information where consent exists, downloading reports and extracting key participant information in Excel. That is sensitive SDA operating data, not a general admin convenience.

Each authorisation should have a purpose. A user who only manages worker screening should not automatically receive participant claim exports. A user who handles owner reporting should not need unrestricted access to plan, incident or health information. A consultant helping with an audit should have an end date and a defined evidence scope.

Keep a simple access register that records name, role, portal, organisation, permission purpose, approval date, review date, offboarding date and whether the user can export participant data. Review it at least quarterly and after any incident, data breach, key-personnel change or provider-ownership change.

The most expensive access problem is the one discovered under time pressure. A claim enquiry may be waiting on a portal upload. A dwelling enrolment request may need action before a move-in. A worker screening expiry may block a roster. A registration change may need Commission visibility. A reportable incident may need notification within the required timeframe.

SDA teams should connect portal access to their operating calendar. Include access checks in monthly claim close, dwelling onboarding, staff onboarding, registration renewal, worker screening review, incident drills and disaster recovery testing. If the provider runs after-hours supported accommodation, decide who can lodge or support urgent Commission tasks outside ordinary office hours.

Keep alternative evidence paths clear. If a portal task cannot be completed immediately, the provider still needs dated notes, screenshots where appropriate, request numbers, email records, internal approvals and a named owner for follow-up. Access controls should create accountability, not hide operational blockers.

StepFree SDA should not replace the official NDIS or NDIS Commission portals. The useful role is to keep the surrounding operating record clean: which dwelling enrolment is waiting on portal action, which claim enquiry has an owner, which participant relationship is blocking a claim, which worker screening task is due, and which incident or registration action needs evidence.

The same structure supports owner-safe reporting. Owners need accurate status on vacancy, onboarding, claim readiness, submitted claims, payment exceptions and compliance delays. They do not need raw participant portal exports or unrestricted participant-identifying information.