AI data leakage for NDIS providers: what leaves when participant files go into ChatGPT or Claude.

A registered NDIS provider writes down the most personal facts about the people it supports: diagnoses, medication, behaviours, where they live alone and when a worker is with them. The Practice Standards expect each participant’s information to be identifiable, accurately recorded, current and confidential, and the Code of Conduct requires respect for privacy. In February 2026 the NDIS Commission said, in a position statement on behaviour support plans, that sending sensitive participant information to a third-party AI platform such as ChatGPT without safeguards may breach the Code. This series takes ten documents a service produces every week, marks every item those obligations bear on, and shows where each one goes when the document is pasted into ChatGPT or Claude. Each page ends with the same document on Ermos, inside the service.

The documents, one at a time

RecordThe participant support plan

Diagnosis, medication, triggers, the lockbox and a relationship he has asked to keep private. The whole person, in one record.

See what leaves → NotesThe shift progress note

Sleep, medication, a self-injury episode, a confidence about bullying and what was said to his mother. One shift, written in the car park.

See what leaves → Report or memoThe reportable incident notification

The participant, the injury, the worker who left the room, a witness and what the service had not yet changed, in a report due within 24 hours.

See what leaves → AgreementThe service agreement

A young woman’s disability, her family, her Saturday routine, her funding and who to call in a bushfire. A contract and a map of her week.

See what leaves → SpreadsheetThe claims and invoice spreadsheet

Names, NDIS numbers, the support each person receives, hours, and a status column that says which shifts are under question.

See what leaves → SpreadsheetThe worker roster spreadsheet

Who lives alone, where, when a worker is there, the notes for each person and the lockbox code. A map of the week.

See what leaves → RecordThe positive behaviour support plan

Behaviours, the reason for them, the locked cupboard, the PRN medication and who authorised it. The plan the Commission has warned providers about putting into AI tools.

See what leaves → EmailThe email to a participant’s family

The injury, the hospital, the worker taken off the roster, an admission and a request about his daughter, written to his sister.

See what leaves → FormThe worker onboarding form

Worker check clearance, identity documents, TFN and bank details, a health declaration, family circumstances and the state of the induction.

See what leaves → LetterThe response to a complaint

A missed shift, a disputed charge, a late call to a mother and a confidence her son asked the service to keep. Four findings in one letter.

See what leaves →

How the leakage happens

The mechanism is the same for every document. The whole text is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia. On consumer tiers it can be retained and used to train future models. The provider’s staff and systems can reach it under the provider’s own policies. Once sent, the service no longer controls it. Our on-premise vs cloud comparison sets out the four ways to run AI and where each one puts your documents.

The obligations in play

Each marked item on these pages links to the guide that covers its obligation:

The same documents on Ermos

Ermos Dominion drafts and searches on a unit in your office, so the documents never leave it. Ermos Edge keeps your documents on your own instance in an Australian data centre and sends only permitted excerpts, per question, to a named Australian provider. Every page in this series ends with both, item by item.

Common questions

Can NDIS providers use ChatGPT or Claude with participant information?
Generally not with identifiable participant information, and the privacy regulator advises the same. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks. The Information Management standard, which applies to registered NDIS providers, expects each participant's information to be identifiable, accurately recorded, current and confidential. The Code of Conduct requires respect for privacy whether or not the NDIS provider is registered. The Commission's February 2026 position statement says sending sensitive participant information to a third-party platform such as ChatGPT without safeguards may breach the Code. It does not endorse or approve any AI tool.
Do ChatGPT and Claude train on what staff paste in?
It depends on the account each person is using. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. For an NDIS service the question matters because staff paste diagnoses, medication and behaviour notes about people with disability, and some participants ask that certain things stay private.
Do business plans such as ChatGPT Business or Claude Team solve the problem for NDIS providers?
Only in part. A business plan changes the default on training, but it does not change who receives the content. On a personal plan the user cannot choose where conversations are stored or processed. Some business plans let an organisation choose to store data at rest in Australia (OpenAI), which still leaves the content with the AI company. The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product. For an NDIS service, support plans, incident notifications and rosters would still reach the AI company, and the Information Management standard expects consent to cover the purpose of any disclosure. Our comparisons with ChatGPT Enterprise and Claude weigh the trade-offs.
What is the safest way for an NDIS provider to use AI with participant documents?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. For an NDIS service, staying in control means a support plan, incident notification or family email is drafted where the service can check it, and a team leader or manager answers for it. The Commission's position statement endorses no tool, so the service decides for itself whether an arrangement meets its expectation.
What does the NDIS Code of Conduct say about privacy?
Section 6 of the NDIS (Code of Conduct) Rules 2018 requires a person providing supports to people with disability to respect their privacy, to act with respect for their rights to self-determination and decision-making, and to provide supports in a safe and competent manner, with care and skill. It applies to NDIS providers and to the people they employ or engage, whether or not the NDIS provider is registered. Breaching it is a civil penalty matter.
Does the Privacy Act apply to a small NDIS provider?
The OAIC says an organisation that provides a health service and holds health information is covered by the Privacy Act, even if it is a small business, and lists disability service providers that handle health information as an example. A small business with annual turnover of $3 million or less that delivers no health service may sit outside the Act. Which side a service falls on depends on the supports it delivers, so it is worth checking with an adviser.
What do the Practice Standards say about participant information?
The Information Management standard says each participant's information must be identifiable, accurately recorded, current and confidential. Its quality indicators, which assessors must take into account, expect consent to collect, use, retain or disclose information, including the purpose and when disclosure may occur without consent. The quality indicators for the Privacy and Dignity standard expect participants to understand and agree to what personal information is collected and why. The standards apply to registered providers, and neither the standards nor the indicators mention AI.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
Resources The Privacy Act, the APPs and AI All professions