Healthcare workforce compliance is no longer a one-time task. Here's what's changing in 2026.
If you're an HR or People lead in healthcare, aged care or disability services, 2026 has arrived with a compliance workload that looks different from previous years. AHPRA registration renewals are running on their usual staggered schedule. The first NDIS Worker Screening Checks issued in 2021 are now expiring at scale. Working with Children Checks are tightening under active national reform. And for many providers, the system holding all of this together is a spreadsheet.
That's not a criticism. It's how most organisations got here, credential by credential, one check added at a time, managed by a team already stretched. But the obligations landing in 2026 have changed the risk profile of that approach. Here's what's happening and what a better process looks like.
The compliance stack healthcare providers are managing right now
Before getting into process, it helps to see the full picture. Healthcare, aged care, disability and childcare providers are typically managing several overlapping credential requirements, each with its own renewal cycle, its own regulator and its own employer obligation.
AHPRA registration
Renewed annually, but not all at once. Nurses and midwives renew by 31 May, medical practitioners by 30 September, and all other registered practitioners by 30 November. The obligation to verify current registration sits with the employer. A lapsed registration is an immediate compliance breach, there is no grace period.
NDIS Worker Screening Check
The first national NDIS checks were issued from 1 February 2021. Five-year clearances. Which means they started expiring in early 2026, and the wave continues into 2027. When a clearance expires, the worker must stop performing their risk-assessed role immediately. No grace period, no working while you wait for the renewal to come through. Providers who roster an expired worker are in breach of the NDIS Practice Standards. From 1 July 2026, mandatory registration also expanded to Supported Independent Living providers and platform providers, a new cohort of organisations now managing this obligation for the first time.
Working with Children Check
Required for roles involving contact with children across healthcare, disability and childcare settings. Validity periods vary by state, two years in the Northern Territory, five in NSW, Victoria and South Australia. National reform has been moving quickly. As of mid-2026, every state and territory has legislated a consistent approach to disqualifying offences across state and territory governments, meaning a person denied a WWCC in one jurisdiction cannot obtain one elsewhere.
Police certificates
Required across most aged care and disability roles. Under the Aged Care Act 2024, which commenced 1 November 2025, a police certificate older than three years no longer satisfies the screening obligation for aged care workers. From mid-2026, a new national aged care worker screening check is being aligned with the NDIS model.
These credentials don't operate in isolation. They expire on different schedules, under different regulatory frameworks, and the responsibility for verifying each of them sits with the employer, not the worker.
Why manual tracking is a risk organisations can no longer afford
"What we're hearing from healthcare clients is that credential management used to feel manageable, a few checks at onboarding, a reminder here and there. What's changed in 2026 is the volume and the regulatory stakes. When an NDIS clearance expires and a worker is still rostered, that's not an admin oversight. That's a breach," says Neil Rose, CEO of Referoo.
Three failure modes are showing up consistently.
No early warning. A spreadsheet doesn't flag an AHPRA renewal 90 days out. It surfaces the problem when someone checks, often the week before, or after the fact.
Volume the process wasn't built for. NDIS renewal, annual AHPRA cycles and staggered WWCC expiries are all arriving at the same time, across workforces that have grown since 2021. A manual process that held together at 30 staff doesn't hold together at 300.
No auditable record. When a regulator asks for evidence of compliance, not just that checks were done, but who verified what and when, a shared folder of PDFs with a last-modified date is not a defensible answer.
The mistakes that create compliance gaps
Even well-run compliance processes have common failure points.
Treating renewal as the worker's job. Workers apply for and renew their own checks. But the employer's obligation to verify current status is separate. Assuming a practitioner will self-manage their AHPRA renewal and that no news means good news, is not a compliance position.
Confusing a police check with an NDIS clearance. They are not interchangeable. The NDIS Worker Screening Check involves a broader assessment of criminal history and workplace misconduct records, with ongoing monitoring built in. A police check does not satisfy the NDIS obligation.
Treating WWCC as an onboarding task. A Working with Children Check verified at the point of hire is not a WWCC managed over time. Expiry dates move, state obligations vary and continuous monitoring is a separate obligation from the initial check.
Not linking workers in the NDIS database. Holding a valid clearance isn't enough. The worker must be formally linked to the provider in the NDIS Worker Screening Database portal. This step is easy to miss and the consequences aren't minor.
What a good compliance process actually looks like
"The organisations that manage this well aren't necessarily doing more work. They've shifted when the work happens, from reactive, when something expires, to proactive, when the renewal window opens. That one change makes the whole thing feel different," says Rose.
A few things separate a process that holds up from one that doesn't.
One view across all credential types. Not AHPRA in one spreadsheet, NDIS in another and WWCC filed somewhere in a shared drive. One place, sorted by what needs attention and when.
Renewal triggers at 90 days. The NDIS renewal window opens 90 days before expiry, that's the moment to act, not the week before. The same logic applies to AHPRA. If you're prompting practitioners in May for a 31 May deadline, you're already behind.
Worker obligations and employer obligations kept separate. Workers apply, renew and hold their credentials. Employers verify, record and monitor. Conflating these or assuming a worker's action is sufficient evidence of the employer's compliance is where gaps open up.
A record that proves what happened. Not reconstructed after the fact. Timestamped, accessible and structured so that it can be read by someone who wasn't there when the check was done.
2026 isn't a one-off, it's the new baseline
The convergence of renewals and new obligations in 2026 reflects a permanent shift. The Aged Care Royal Commission and the Disability Royal Commission both recommended moving from point-in-time screening to continuous monitoring. Regulators have been delivering on those recommendations, and enforcement is stepping up alongside.
"The direction has been clear for a while. Ongoing compliance is the standard now, not a best practice. What 2026 has done is make that real for a lot of organisations that were still managing things the old way," says Rose.
This year's renewal wave is not the last one. The credential types will shift. The volume will grow. The organisations building a proper process now are building something that carries them through what comes next. The ones still running it manually are carrying a risk that compounds with every month that passes.
Getting ahead of it
Healthcare HR teams are managing more credential types, across larger workforces, with more regulatory scrutiny than before. A better spreadsheet isn't the answer but neither is a fragmented one, where every renewal means chasing a different provider, logging into a different system and starting the process from scratch.
When a credential expires and a new check needs to be ordered, Referoo Hub makes that fast. Police checks, background checks, right to work verification and reference checks are all in one place, so when your renewal schedule flags that action is needed, you can act on it without the admin overhead.
Want to see how Referoo Hub can support your healthcare compliance process? Book a demo.