Most NDIS back-office admin can still go offshore. What changed on 10 November 2025 is the login: reaching the National Disability Insurance Agency's provider portals now needs a digital identity that only Australian-issued documents can verify, so the person who signs in and presses submit has to be someone on your team in Australia. Your offshore assistant can still do almost everything either side of that button, including reconciling shifts, preparing the claim file, invoicing plan managers, chasing service agreements and keeping your registers current. The catch is that data downloaded from those portals is not allowed to leave Australia either, so keep exports out of any folder your offshore team can reach.
If you have offshore admin support in your NDIS business, or you are costing one, the question you arrived with is whether the myID changeover killed it. It did not, but it moved the line, and the line now sits at the submit button: an offshore assistant can prepare, reconcile, chase and assemble almost everything, while the portal login and the data it produces stay in Australia with your own people.
It is a smaller change than the panic suggests, and a bigger one than most suppliers admit. If anyone still offers to run your PRODA claims, they have not checked in a while.
What actually changed on 10 November 2025
The NDIA discontinued PRODA as the access route to its provider portals on 10 November 2025. Providers now reach the myplace and my NDIS (PACE) provider portals through myID and Relationship Authorisation Manager, or RAM. That is the NDIA's own announcement, Strengthening provider access to NDIS systems, published 8 August 2025.
PRODA itself is not dead. The same notice says it continues for other government services. Only the NDIS pathway closed.
And the NDIS Quality and Safeguards Commission runs its own clock. Its PRODA to myID transition began on 7 December 2025 and is scheduled to end on 30 September 2026. Until then, the Commission's guidance says you can keep using PRODA for its portal if you are having trouble setting up myID. That is weeks away. Do not merge the two deadlines.
Why an offshore assistant cannot hold a portal login
The NDIA requires at least Standard myID identity strength for anyone accessing a provider portal, and Strong for the principal authority who links the business in RAM. Standard means verifying at least two documents, and every document myID can verify is Australian-issued: an Australian passport, driver licence, birth certificate, visa, ImmiCard, citizenship certificate or Medicare card. A foreign passport on its own is not one of them.
Say that precisely, because the loose version is wrong. A foreign national can get a myID: a Basic Digital ID needs no Australian documents. It is just useless here: the ATO's guidance on Basic Digital ID restrictions says you cannot be an authorised user in RAM with one. So this is a documents test, not a nationality test, and a Filipino staff member on an Australian visa, physically in Australia, is in a different position.
Sharing a login is not the workaround. The myID terms of use require you not to disclose your password, not to enable any other person to use your credential, and not to undertake screen sharing that might compromise your account. A session where the offshore person drives your screen is the same problem wearing a hat.
The clause most providers have never read
Clause 3.4 of the myplace provider portal Terms and Conditions, dated 14 October 2023, does two separate things. It prohibits accessing the portal from outside Australia. It separately prohibits you from doing this outside Australia: "transfer, store or access any of the data accessed by using the Portal", unless the NDIA gives prior written approval. The my NDIS provider portal terms of 8 November 2023 carry the same clause, so there is no PACE loophole.
The second limb catches people, because it is not a login rule: it reaches the data. Emailing a service booking report or a budget utilisation export to Manila engages it even though nobody offshore ever logged in. Budget burn-down built from portal exports gets sold as an easy offshore win. Read the clause and it is not one.
Be honest about what it is: a contractual term binding the portal user, not an offence in itself. What a breach costs you is access. The myplace terms let the NDIA suspend portal access at its sole discretion while it investigates. Suspended access means claims stop, which means cash stops. That is the commercially decisive risk, not prosecution.
Two things we do not know and will not pretend to. Whether clause 3.4 still bites once portal data has been re-keyed into your own CRM: the plain words point that way, and we found no NDIA guidance on it. And whether a remote desktop session into an Australian-hosted machine solves the problem, which is the industry's standard answer and is not settled. Both are questions for your lawyer, not features anyone should sell you.
What that leaves, which is most of the week
We hire in the Philippines for Australian providers, so everything above narrows our own commercial surface. It is still a large one. Working inside your systems, on data your business generated, an assistant can run:
- Reconciling shift and timesheet data against rostered services in your own system.
- Building the roster, filling vacancies by contacting support workers, and flagging anything touching a SCHADS Award condition for you to decide.
- Preparing the claim input file from your own service delivery records, ready for your Australian person to check and submit.
- Checking support item numbers, unit prices and claim rules against the current pricing document.
- Raising invoices to plan managers and self-managed participants, and following up plan managers on overdue payment.
- Populating service agreement templates, chasing countersignature and diarising expiry.
- Chasing missing progress notes and flagging gaps, without authoring the content.
- Maintaining the incident and complaints registers and drafting the narrative for your review.
- Recruitment administration, onboarding packs, and the training and worker-screening expiry registers.
- Audit preparation: gap analysis against the quality indicators, drafting policies, indexing evidence, running the audit calendar.
Nothing on that list is built from a portal export, and nothing on it gets submitted.
On screening: a genuinely back-office role sits outside the definition of a risk assessed role in the NDIS (Practice Standards—Worker Screening) Rules 2018, which is why no clearance is legally required for it. Those same Rules require you to assess all roles and identify which are risk assessed, so do the assessment and file the finding. Screening checks are run state by state and built around Australian residents, so design the role outside the definition rather than planning to clear it. Then write the limitations into the position description: no portal access, no portal-derived data, no participant contact, no authoring of participant records, no incident notification. That paragraph is your compliance artefact.
The lines that have nothing to do with geography
A second set of tasks is reserved by accountability rather than by borders. Notifying the Commissioner of a reportable incident is the registered provider's duty under the NDIS (Incident Management and Reportable Incidents) Rules 2018, and the tightest of those notification clocks runs 24 hours, which does not sit well across a time-zone gap. Behaviour support assessment and any plan containing a regulated restrictive practice must come from an NDIS behaviour support practitioner under the NDIS (Restrictive Practices and Behaviour Support) Rules 2018. Complaint outcomes sit in your complaints system. And nobody authors a progress note for a shift they did not attend, because a reconstruction is not a record.
One duty runs the other way. Under the same rules, a person engaged by a provider who becomes aware that a reportable incident has occurred must notify key personnel, a supervisor or the provider's nominated person. Your offshore assistant is inside that obligation, so train them into it rather than around it. Our boundary map for regulated Australian work applies the same test across other professions.
Plan managers and support coordinators are a different question
If you are a registered plan manager, do not assume this article applies to you. Management of funding for supports in participant plans appears on the Commissioner's list of specified services and supports, which can make claims processing a risk assessed role in its own right, regardless of contact. For a plan manager, claiming is the service you sell, not overhead.
Support coordination sits in a similar spot: the coordination work is a funded, participant-facing support, and formatting a report is not the same as writing it. There is still a real role in both businesses, but it is scoped differently from a support provider's. See plan manager support and support coordinator assistant, and scope it with us before you write the job description.
What to do next
Segregate at the system level, not the policy level: offshore accounts get role-based access that cannot reach the folder, mailbox or drive area where portal downloads land. Assume a policy alone will fail. Then check your participant consent and collection notice actually names overseas handling: Australian Privacy Principle 5 requires you to take reasonable steps to notify whether personal information is likely to go to overseas recipients and, where practicable, which countries. Most NDIS consent forms we see do not. Then name the Australian supervisor and the escalation path in writing.
After that, hand the work over in an order that builds context. Our guide to what an NDIS provider should delegate first sets out that sequence, the NDIS page covers how the roles are structured, claims and invoicing is the usual starting point, and NDIS and allied health is for providers running a clinical practice alongside the scheme.
If you want the boundary drawn against your own workflow, book a 30-minute call and bring your claiming process. Checked 10 August 2026. This area has moved twice in a year, so if you are reading much later, check it again.
This is general information, not legal or financial advice. Your obligations depend on your registration, your registration groups and your state. Confirm anything above with your own adviser before you rely on it.
How we would staff this: everything up to the submit button
We hire in the Philippines on behalf of Australian NDIS providers, so the line this article draws runs through the middle of our own commercial surface. We build the role around it rather than pretending it is not there. The offshore person does the preparation, the reconciliation and the chasing inside your own systems; your Australian team holds the login, checks the file and submits.
- Reconciles shift and timesheet data against rostered services in your system and prepares the claim input file, ready for your Australian person to check and submit.
- Builds the roster and fills vacant shifts by contacting support workers, escalating anything that touches a SCHADS Award condition to you to decide.
- Raises invoices to plan managers and self-managed participants, follows up plan managers on overdue payment, and checks support item numbers and unit prices against the current pricing document.
- Populates service agreement templates, tracks which are still unsigned and diarises expiry, and chases support workers for missing progress notes without authoring the content.
- Keeps the incident, complaints, training and worker-screening expiry registers current, and indexes audit evidence against the quality indicators.
- The portal login. Your Australian team holds the myID and the RAM authorisation and presses submit. We will not build a process on a remote desktop either, because the NDIA has published nothing on whether that solves it.
- Anything downloaded from the portal. Service booking reports, budget utilisation exports and anything else the portal produces stay in Australia, in a folder the offshore account has no role-based access to.
- Reportable incident notification to the Commissioner, behaviour support decisions involving a regulated restrictive practice, and complaint outcomes.
- Participant contact and the authoring of participant records. A progress note belongs to the worker who attended the shift, and nobody else writes it.
Frequently asked questions
Is PRODA being discontinued?
Can my offshore assistant use a remote desktop to get into the NDIS portal?
Does an offshore NDIS admin assistant need a worker screening check?
Do I need participant consent to have NDIS admin done overseas?
Can an offshore NDIS assistant talk to participants or support workers?
How much does an offshore NDIS admin assistant cost?
- NDIA, "Strengthening provider access to NDIS systems", 8 August 2025 — PRODA stopped being the way into the NDIS provider portals on 10 November 2025, replaced by myID and RAM, and the identity strengths the NDIA requires
- NDIS Quality and Safeguards Commission, "Changing from PRODA to myID and RAM" — The Commission's separate transition and PRODA still working for its portal until 30 September 2026
- NDIS myplace provider portal Terms and Conditions (14 October 2023) cll 3.4, 9.1; Terms and Conditions — my NDIS provider portal (8 November 2023) cl 3.4 — The ban on accessing the portal or handling portal-derived data outside Australia without prior written approval, and the NDIA's power to suspend access
- myID, "Verifying your ID in myID" (updated 9 December 2025) — Standard identity strength needs two verified documents and every document myID can verify is Australian-issued
- myID Terms of use (user) (updated 24 September 2025) — Credential sharing and screen sharing a portal session breach the myID terms of use, so neither is a workaround
- National Disability Insurance Scheme (Practice Standards—Worker Screening) Rules 2018 (Cth) ss 5, 6, 7, 11 — Back-office roles falling outside the risk assessed role definition, the duty to assess every role, and why plan management claiming is different
- National Disability Insurance Scheme (Incident Management and Reportable Incidents) Rules 2018 (Cth) ss 19, 20, 21 — Reportable incident notification to the Commissioner staying with the provider, and the worker's own duty to report internally
- Privacy Act 1988 (Cth) sch 1, Australian Privacy Principle 5 — Telling participants their personal information is likely to go to overseas recipients
Seth is a performance-focused professional with a proven history of accelerating growth and building impactful client partnerships. He specialises in tailored staffing solutions that fuel business success, helping companies secure the right talent to exceed their goals. At StaffingSolutions.io he looks after growing accounts — clients who start with one hire and end up with a small team — planning the sequence so quality holds as headcount goes up.
Meet the team