NDIS CRM: Track Every Referral and Keep Participant Data Private

Why NDIS referrals go cold in an inbox

Check which of these describes your intake:

• If referrals arrive by email, phone and a web form and nobody lists them in one place, the cause is no single intake record.
• If a referral waits for the one person who handles intake, the cause is a single point of failure: holidays and sick days cost you participants.
• If you cannot say which coordinators sent your last ten participants, the cause is no source tracking, so thank-yous and capacity updates go to the wrong people.
• If participant details live in personal spreadsheets or message threads, the cause is a privacy risk as well as a sales leak.

Most of this is process, not software. A CRM makes the process hard to skip.

What an NDIS CRM should track

A client management system for NDIS providers needs two layers: the referral pipeline that wins participants, and the participant record that supports delivery. Keep them linked but separate in who can see what.

Keep clinical notes, incident reports and rostering in the systems built for them. The CRM should hold what you need to win and start a service, and link to those systems rather than copy them.

Referral tracking from support coordinators and plan managers

Referral tracking means every referral has a source you can count. Set these up first:

1. Define stages: New, Contacted, Intake call booked, Service agreement sent, Signed, Started, Closed (with a lost reason).
2. Create a referrer record for every coordinator and plan manager you deal with, linked to their organisation.
3. Capture every channel in one place. The web form creates a record automatically; phone and email referrals are entered by whoever receives them within the hour.
4. Assign an owner and a due time the moment a record is created. The default is a reply the same business day.
5. Send the referrer a short acknowledgement saying who has it and what happens next.
6. Report monthly by referrer: referrals sent, signed, started, and median time to first reply.

The report is useful in a relationship conversation: "You sent six referrals in the quarter, we started four, and the two we could not take were out of area." That is a conversation, never a payment. Do not attach rewards to referral counts. The Code of Conduct guidance says providers should not give or accept inducements, including referral arrangements with other providers, that affect supports (NDIS Commission), and the NDIA has linked referral payments to fraud (NDIS Commission media release).

Privacy: the Australian Privacy Principles and participant data

A CRM holds health information, so privacy is the main design requirement, not an afterthought.

Do the APPs apply to you?

Small businesses under the Privacy Act turnover threshold are often outside it, but the OAIC lists health service providers as covered regardless of turnover (OAIC small business guidance).

It defines them as providers of services in relation to physical, emotional, psychological and mental health. Whether your particular supports fall within that is a question for your legal adviser; either way, the NDIS Code of Conduct requires providers to respect the privacy of people with disability (NDIS Code of Conduct), and the Practice Standards expect consent to collect, use and disclose participant information.

What the APPs mean for your CRM

The principle summaries come from the OAIC APP quick reference.

Privacy settings to switch on from day one

• Role-based access. Intake sees referrals; delivery staff see participants they support; only managers export data.
• Multi-factor authentication for every user, and removal of leavers the same day.
• Minimal fields. If you do not need the NDIS number to answer the referral, do not collect it yet.
• Consent recorded as data, with date, who gave it (participant or nominee) and what it covers.
• No health data in email subject lines, chat tools or ad platforms. Send links to records, not the details.
• Retention rules for closed referrals that never became participants, so declined enquiries are deleted on a schedule.
• A breach plan: who decides, who is told and how, written down before it is needed.

We are not a law firm and do not give legal advice. We build these controls into the system and document them so your adviser can review them.

CRM for NDIS providers: build, buy or use Odoo

Three honest options, with the trade-offs:

For most small providers, the right first step is the cheapest option that gives you a single intake record, owners, due times and source reports. Read more in our guide on what custom CRM software is and custom CRM versus Salesforce.

Automations that save intake time without pressuring anyone

Automation should make replies faster and consistent, never pushier:

• Create a referral record and notify the owner when the web form is submitted.
• Send an acknowledgement to the referrer with a name and next step.
• Raise a task for the manager when a referral is not contacted by the due time.
• Remind staff about a service agreement that has been waiting for signature for several days, as an internal task, not a repeated call to the family.
• Update a monthly dashboard of referrals by source and stage.

Do not automate repeated chasing messages to participants. The Code of Conduct guidance describes repeated follow-up calls to someone who said they would think it over as high-pressure sales. See our AI and workflow automation service and the speed-to-lead guide.

Set up an NDIS CRM in six steps

1. Map your current intake: every way a referral arrives, who touches it and where it waits.
2. Decide the stages and the reply rule (for example, same business day) and name a backup for every owner.
3. Choose the system using the table above, and check hosting location and access controls against the APPs.
4. Import referrers first, then current referrals. Add participants only where the CRM needs them.
5. Connect the web form and phone numbers so records are created without retyping.
6. Run it for a month, hold a 20-minute review each week, then add automations.

If you can only do one step, do step 2. A written reply rule with a backup owner stops most losses before any software is bought.

How to know your NDIS CRM is working

• Median time to first reply, by channel. Target: same business day.
• Referrals with no owner or past due, which should be zero at the end of each day.
• Referral to start rate by referrer and by support type.
• Lost reasons, grouped. "No capacity" and "out of area" point to marketing changes; "no reply" points to process.
• Privacy checks: users with access who no longer need it, and records past their retention date.

These feed the strategy in the NDIS marketing guide, and the source field is what lets you judge SEO and Google Ads by service agreements rather than clicks.

NDIS CRM mistakes to avoid

• Buying a large all-in-one system before fixing the reply rule.
• Collecting diagnosis and plan details on the first form.
• One shared login for the whole team.
• Rewarding referrers or staff for referral counts.
• Copying participant data into marketing tools, ad platforms or spreadsheets.
• Never deleting declined enquiries.

Where Devvista fits

Devvista builds NDIS provider CRMs on Odoo or as custom software: referral pipeline, referrer records, web form and phone integration, role-based access, consent fields and source reporting. We work remotely with Australian providers, you own the data, and we document access and retention settings for your adviser to review.

A good fit if you want one intake record, same-day replies and source reports, and you are prepared to agree the process first. Not a fit if you want a replacement for your rostering, claiming and incident reporting products; we connect to those rather than rebuild them.

Related: CRM development, custom software development, Odoo implementation, benefits of custom CRM development, NDIS website design and the Australia hub.