NDAs for NDIS Providers and Allied-Health Clinics: Protecting Your Participant List Now That Non-Competes Are on the Way Out

On 7 September 2026 the federal government released draft legislation to ban non-compete clauses for workers earning under $190,100 a year, with submissions closing on 2 October. For an NDIS provider or an allied-health clinic, that raises a blunt question: if you can no longer stop a support worker or physio from joining the practice down the road, what stops them taking your participant list with them? The answer is confidentiality, and a properly written non-disclosure agreement is how you get it in writing. Claim Done drafts an NDA for your practice from the details you give it, for a flat A$49, and you can start it here.

This guide is for owners of NDIS provider businesses, therapy and allied-health clinics, and sole practitioners who subcontract. It covers what the draft bill changes, who should be signing an NDA in your business, and the clauses that matter when the information is someone’s health.

What the draft bill takes away, and what it leaves alone

The draft is called the Competition and Fair Work Legislation Amendment (Banning Unfair Non-Competes) Bill 2026. It is an exposure draft, not law yet. As summarised by MinterEllison, it would ban non-compete terms for employees earning at or below the Fair Work high-income threshold, currently $190,100, and for all casual employees and pieceworkers. That threshold sits well above what most support workers, therapy assistants and many clinicians earn, so for a typical provider the non-compete in the employment contract is on borrowed time.

The draft also goes after co-worker non-solicitation. The Australian Industry Group’s member advice describes a ban on co-worker non-solicitation terms for all national system employees, whatever they earn. So the clause that stops a departing team leader recruiting three of your workers to their new venture is also in the firing line.

What survives is the important part. MinterEllison’s reading is that a non-compete term does not include a prohibition on using or disclosing confidential information. A clause that says “you will not use our participant records, referral contacts or rosters for anyone else” is a different animal from “you will not work for a competitor for 12 months”, and the draft treats it that way.

The practical consequence: for most providers, confidentiality is about to become the main written protection you have. If your current contracts lean on a restraint and have a thin confidentiality clause bolted on the end, that balance is backwards.

Why the list matters more than the logo

A clinic’s value is rarely its fit-out. It is the caseload: who the participants and patients are, their plans and funding, their goals, their support coordinators, the GPs and schools who refer to you, and the rosters that match workers to people. Almost all of that is personal information, and much of it is health information.

That changes the stakes. The Office of the Australian Information Commissioner lists health or genetic information as sensitive information, and says sensitive information generally has a higher level of privacy protection than other personal information. So when a worker leaves with a spreadsheet of participants, you have two problems at once: a commercial loss and a possible privacy breach you are responsible for.

Here is the part owners miss. Participants choose their own providers, and nothing in an NDA can or should stop a participant following a worker they trust. What an NDA stops is the worker using your records to go and get them: the phone list, the plan review dates, the referral pipeline. That is a narrower promise, it is easier to defend, and it is the one the draft bill leaves standing.

Privacy law already applies to you; the NDA makes each person promise it too

Many small businesses assume the Privacy Act does not reach them because of the $3 million turnover threshold. Health businesses are an exception. The OAIC’s small business guidance says the Act covers a health service provider regardless of turnover, and names allied health professionals among its examples. If your NDIS supports include therapy or other health-related services, read that page carefully rather than assuming you are exempt.

Once you are covered, the Australian Privacy Principles require you to take reasonable steps to protect the personal information you hold from misuse, loss and unauthorised access or disclosure (APP 11). You cannot take reasonable steps on behalf of a contractor who never agreed to anything. A signed NDA is one of the plainest pieces of evidence that you did.

The NDIS side points the same way. The NDIS Code of Conduct requires everyone delivering supports to respect the privacy of people with disability, and it applies to registered and unregistered providers, their key personnel and their workers. The Code sets the standard. Your NDA ties each individual to your specific rules about records, devices and what happens when they leave.

Who in your business should sign one

Employees usually have confidentiality terms in their employment contract, and those should be reviewed rather than duplicated. The gaps are almost always the people who are not employees:

• Subcontracted support workers and sole-trader therapists who work under your registration or your brand. Pair the NDA with a proper subcontractor agreement.
• Locums and contract clinicians covering leave, who get full access to files for a few weeks and then move on.
• Admin support, including offshore virtual assistants, who handle intake, invoicing and the NDIA portal.
• IT and software people: the person who set up your practice management system, the bookkeeper with access to invoices that name participants.
• Anyone looking at buying your practice, or a practice you are buying. Due diligence means handing over caseload numbers, funding mix and referral sources before anyone is committed.
• A business partner or co-founder before you share the numbers on a new service line.

Get the NDA signed before access is granted, not after. An NDA signed three months into an engagement is weaker and far more awkward to ask for.

The clauses that matter when the information is health data

A generic NDA template is written for trade secrets and pricing. Yours needs to name what actually leaves a clinic:

1. A specific definition of confidential information: participant and patient identities, NDIS plans and funding details, clinical notes and assessments, rosters, referral sources and contacts, pricing and service agreements, and login credentials.
2. A use restriction, not just a disclosure restriction. The worker who never tells anyone but quietly uses your list to contact participants has not “disclosed” anything. The clause must stop use for any purpose other than work for you.
3. Devices and systems: no participant data on personal phones or personal email; your systems only; no screenshots of rosters into group chats.
4. Return and deletion on exit, with a written confirmation that it has been done. This is where most disputes are won or lost later.
5. Breach reporting: a duty to tell you promptly if information is lost, sent to the wrong person or accessed by someone else, so you can deal with it under your own privacy obligations.
6. A clear carve-out for complaints and reporting. The NDA must not stop anyone raising a concern with the NDIS Commission, reporting harm, or doing anything the law requires. The Code of Conduct itself requires workers to promptly raise and act on concerns about quality and safety. A clause that looks like a gag will not be enforced, and it will make you look worse, not better.
7. Duration: obligations about participant information should survive the end of the engagement indefinitely; commercial information can have a set term.

For a clause-by-clause checklist, see our guide to reviewing an NDA’s scope, term and carve-outs.

What an NDA will not do for you

Be honest with yourself about the limits. An NDA will not stop a participant changing providers. It will not stop a good clinician being hired by a competitor, and under the draft bill you will increasingly be unable to stop that at all. It will not undo a breach that has already happened. What it does is set the rules clearly in advance, give you a document to point to, and make the next step, a letter requiring someone to stop using your information, straightforward. If a former worker is already contacting your participants with your records, that is the moment for a written demand; our guide on whether a non-compete clause is enforceable covers the restraint side.

Claim Done is not a law firm and does not give legal advice.

What it costs and how it works with Claim Done

Claim Done’s NDA is a flat A$49 per document, with no subscription and no lawyer’s retainer; the pricing page lists every service. You answer questions about your practice, who is signing, what information they will see and how long the obligations should last. Claim Done’s document engine drafts the NDA from those answers, naming the categories of information above that apply to you. You review and approve it, and then it is sent by email. If you already have contracts in place and want to know whether their confidentiality clauses will carry the weight once restraints go, the Contract and Agreement Reviewer reads them first.

The cheapest time to fix this is before your next contractor starts, and certainly before the non-compete in your employment contracts stops doing the job you thought it did. Start your NDA on Claim Done, choose Non-Disclosure Agreement, and have a document ready for your next subcontractor, locum or buyer to sign.

Frequently asked questions

Is the ban on non-compete clauses already law?

No. As at late September 2026 it is an exposure draft released on 7 September, with submissions closing on 2 October. It still has to be introduced into Parliament and passed, and the draft provides for a start date after Royal Assent. Planning now is sensible because confidentiality terms take time to roll out to every worker and contractor.

Do NDIS support workers need to sign an NDA if they are employees?

Employees usually already have confidentiality terms in their employment contract, so check those first rather than stacking a second document on top. Subcontracted workers, locums, admin contractors and offshore assistants are the usual gaps, and they should sign before they get access to participant records.

Can an NDA stop a participant or patient following a worker to a new provider?

No. Participants choose their own providers, and an NDA should not try to override that. What it can do is stop the worker using your records, contact lists and referral sources to solicit them.

Does the Privacy Act apply to a small allied-health clinic?

The OAIC says the Privacy Act covers health service providers regardless of turnover and names allied health professionals as an example. Check the OAIC's small business guidance for your own situation, and treat participant and patient information as sensitive information that needs a higher level of protection.

How much does an NDA from Claim Done cost?

A flat A$49 per document, with no subscription. You review and approve the NDA before it is sent by email, and the pricing page lists every service.