The mandatory reporting aged care providers owe does not begin and end with the Serious Incident Response Scheme. A home care team can lodge every SIRS notification correctly and still sit in breach of a separate statutory duty, because several reporting obligations run to different bodies on different triggers. Police referral, reportable conduct, elder abuse pathways, privacy notification and whistleblower handling are all live duties for a home care provider, and none of them are discharged by a SIRS report. This article sets out those non-SIRS reporting obligations and turns them into something a care partner can act on. It is general guidance, not legal advice.
What SIRS Covers, and Where It Stops
SIRS is the incident notification scheme that runs to the Aged Care Quality and Safety Commission, and it applies to in-home and community services, not only to buildings. Our post on SIRS in home care covers the scheme itself, so this one does not: assume you have the priority categories and the incident management system handled, and read on for the duties that sit outside them.
The failure is a quiet one. A care partner sees something, recognises it as a SIRS matter, lodges the notification and treats the job as closed. Meanwhile the police were never called, the worker is rostered on tomorrow, and the staff member who first raised it has no idea whether speaking up protected them or exposed them.
The Mandatory Reporting Duties That Sit Outside SIRS
Treat each of these as a separate obligation with its own trigger and its own recipient. One event can set off three of them at once.
Reporting to Police When a Crime Is Suspected
Reporting to police is a decision about suspected criminal conduct, not about care quality. Physical assault, sexual assault, theft from a client's home, financial exploitation by a worker or a family member, and threats to life all sit in police territory whether or not they also meet a SIRS category. You do not need to have proved anything. The test a care partner should apply is whether a reasonable person would suspect a crime has occurred.
Two things catch home care teams out. An adult client with capacity who refuses a police report is making a choice you must weigh seriously, but a client whose capacity is in doubt is a different situation and should not be handled by one worker alone. And a police report never replaces your internal investigation, because a decision not to prosecute is not a finding that nothing happened.
Elder Abuse Reporting: Home Care Pathways
Most abuse of older Australians living at home is committed by a family member rather than a worker, which puts it outside the SIRS frame on many occasions and squarely inside state and territory systems. Every state and territory runs an elder abuse helpline, and each has a public advocate or public guardian who handles matters involving capacity and substitute decision making. Financial abuse through a misused power of attorney is the pattern a home care worker is most likely to see and the least likely to recognise as reportable.
Reportable Conduct and Worker Screening Referrals
Reportable conduct is about the worker, not the incident. Where a worker's conduct raises a question about their suitability to work with people who are at risk, the duty is to refer it to the relevant screening or regulatory body, and that duty survives the worker resigning. Providers lose this one routinely: the worker leaves, the SIRS notification is already in, nobody makes the screening referral, and the same person is in another client's home inside a month.
Registered health practitioners add a layer. Nurses working in your service carry mandatory notification duties under the national registration scheme administered by the Australian Health Practitioner Regulation Agency, and your clinical lead should know when those are triggered independently of anything you lodge as a provider.
Privacy Notification After a Data Breach
A breach of client information is a reporting obligation too. The Office of the Australian Information Commissioner states that where the Privacy Act applies to your organisation and a data breach of personal information is likely to result in serious harm, you must notify both the affected individuals and the Commissioner. A lost phone holding client addresses and medication lists is the home care version of that, and it is a reporting event rather than an IT problem.
A Decision Tree Your Care Partner Can Follow
The question a worker actually asks is narrower than any policy: I have just seen this, who do I tell and by when. Work down the list. Each step is independent, so finishing one does not close out the next.
- Step 1, is anyone in immediate danger? Call emergency services first and do not wait for internal approval. Tell your supervisor the same shift.
- Step 2, do you suspect a crime? Assault, sexual assault, theft, financial exploitation or threats go to police. Report the suspicion; proving it is not your job.
- Step 3, is a worker involved? Two separate actions: take them off that client's roster, and start the reportable conduct and screening referral assessment. Do not wait for a police outcome.
- Step 4, is a family member or informal carer involved? Your pathway is the elder abuse helpline for your state or territory and, where capacity or a power of attorney is in question, the public advocate or public guardian.
- Step 5, does it also meet a SIRS category? Lodge that notification on its own timeline through your incident management system, in addition to everything above.
- Step 6, was client information exposed? Assess it as a privacy breach and escalate to whoever holds your data breach decision.
- Step 7, who raised it? Record that the report was made, confirm in writing to the staff member that their disclosure is protected, and check your policy covers them.
Whistleblower Protections for the Person Who Speaks Up
Whistleblower protections belong to your reporting system, not to HR. The worker who tells you something is wrong is taking a risk, and the quality of every report you receive after that depends on how the last person who spoke up was treated. A provider with a clean notification record and a workforce that has learned to stay quiet has a reporting problem it cannot see.
Protection means three concrete things. The discloser's identity is held tightly and shared only where there is a lawful reason. There is a named alternative recipient, so a worker is never forced to report to the person they are reporting about. And adverse treatment after a disclosure is handled as a serious matter in its own right. Put the Whistleblower Policy Template in front of workers before you need it, and make that alternative contact a real name rather than a job title.
Writing Mandatory Reporting Into Your Policy Set
A policy that only describes SIRS leaves your team without instructions for most of what they will meet. A Mandatory Reporting Policy (Non-SIRS) Template should name each external body separately, state the trigger in the words a care partner would use, and name the internal person accountable for making each referral. Pair it with Recognising and Responding to Abuse and Neglect training so recognition and reporting are taught together, because a worker who cannot recognise financial abuse will never reach step two of your decision tree.
Confirm every timeframe against the current instrument before you publish your own version. The Aged Care Act 2024 is in force and the arrangements around it continue to be updated, and elder abuse pathways differ between states, so a policy carrying a stale hour count is worse than one that tells the worker to act immediately and escalate the same day.
Related Resources
- Mandatory Reporting Policy (Non-SIRS) Template - the non-SIRS duties written up as a policy your team can follow.
- Whistleblower Policy Template - protections and the named alternative recipient for the person who reports.
- Abuse and Neglect Prevention Policy Template - prevention controls that sit upstream of any report.
- Recognising and Responding to Abuse and Neglect training - recognition training for the staff who see it first.
- SIRS in home care - the scheme itself, its categories and its notification pathway.
- Aged Care Quality and Safety Commission - the regulator's own site for current provider obligations.
Frequently Asked Questions
Does lodging a SIRS notification satisfy my police reporting duty?
No. They are separate obligations with separate triggers and separate recipients. Where you suspect criminal conduct the police report stands on its own, whatever you have lodged with the Commission.
Who do I call for suspected elder abuse by a family member?
Start with the elder abuse helpline for your state or territory, and add the public advocate or public guardian where capacity or a power of attorney is involved. Abuse by a relative in the client's own home often sits outside SIRS, which is exactly why teams miss it.
Do I still make a screening referral if the worker has resigned?
Yes. The point of the referral is to stop an unsuitable person working with people at risk somewhere else, so a resignation makes it more important rather than less.
What timeframe applies to non-SIRS reports?
It varies by obligation and by jurisdiction, and the figures move. Act immediately where there is danger or suspected crime, document the same shift, and confirm each statutory deadline against the current instrument or the responsible regulator rather than against a figure in a blog post.
Can a client stop me from reporting?
An adult client with capacity can refuse, and their wishes carry real weight in how you proceed, but a refusal does not automatically end your obligation. Where capacity is in doubt, or other clients or workers are at risk, escalate it rather than deciding alone.
Is the staff member who reports protected?
Protected disclosure arrangements exist, and your own whistleblower policy should name a confidential alternative recipient and treat retaliation as a reportable matter. Tell the worker in writing what applies to them, because uncertainty is what stops the next report.
Build The Non-SIRS Reporting Reflex
The teams that get this right do not memorise a table. They train one reflex: when I see something, I ask who else needs to know, not just whether this is a SIRS matter. Give your care partners the decision tree, name the external bodies against each trigger, protect the person who raised it, and re-check your timeframes against the source every time the policy comes up for review.
