Australia’s New Aged Care Act: Whistleblower Protections

If you lead an aged care provider in Australia, you know change—by way of the new Aged Care Act—is in the air. The sector has been under the spotlight for years, culminating in a simple, unavoidable truth: the old ways of governance and compliance are over.

The Aged Care Act 2024 (ACA 2024), passed late last year and due to commence on 1 November 2025 , isn’t just a list of new rules. It’s a foundational redesign that swaps procedural box-ticking for personal accountability. This is a rights-based framework that mandates safety, quality, and dignity for older Australians.

For executive teams and compliance officers, this means one thing: the margin for error has vanished, and protecting the business now means protecting your directors.

Personal Liability Is Now Law

The most significant change under the new Aged Care Act is the introduction of clear, enforceable duties that reach right to the top of your organization.

The Act establishes two statutory duties that fundamentally shift risk:

The Registered Provider Duty: Your organization is now legally obliged to ensure, “so far as is reasonably practicable,” that its conduct does not cause adverse effects to the health and safety of individuals receiving care.
The Responsible Person Duty (S. 180): This is the game-changer. It imposes a statutory duty on every director, governing person, and high managerial agent to exercise due diligence to ensure the provider complies with the first duty.

In plain language? If your governance, risk management, or integrity systems are ineffective—and a failure of care occurs—your directors and executives can be held personally liable. It’s no longer enough to claim ignorance; you must demonstrate active, documented efforts to identify and mitigate risks.

Penalties That Matter: The High Price of Silence

To underline the severity of this shift, the penalties are set at levels intended to be a genuine deterrent, turning compliance from a cost centre into an essential risk mitigation strategy.

Consider the financial risk for the organization: a systemic breach of the Registered Provider Duty (S. 179) can attract a maximum civil penalty of 250,000 penalty units. With penalty unit values constantly increasing, this equates to a massive financial threat.

For the directors and high-level executives facing the Responsible Person Duty (S. 180), a systemic breach can lead to a personal civil penalty of 12,500 penalty units.

But the stakes are even higher in the realm of integrity and whistleblowing: The Act creates a criminal offence of whistleblower victimisation—retaliating against someone who reports an issue. The maximum penalty for this is a shocking 2 years imprisonment.

This means a failure to properly handle a confidential disclosure, resulting in detriment to the discloser, moves from a severe HR crisis to a criminal liability for the individual involved. Protecting your people means providing them with a secure, independent channel to speak up.

Whistleblowing: The New Due Diligence Defence

In this new regulatory environment, a robust integrity system isn’t an accessory—it is the evidence that your “Responsible Persons” are exercising due diligence. How can executives ensure compliance and safety if they have no reliable, early warning system for failures?

The ACA 2024 makes it easier and safer than ever to report concerns :

Expanded Protections: Now extend beyond employees to include older people, their families, carers, and volunteers. This dramatically increases the pool of people who must be given a safe reporting pathway.
Broadened Reporting Channels: A protected disclosure can be made anonymously , and it can go beyond internal management to external authorities, including a police officer or an independent aged care advocate.
Mandatory Systems: Providers are required to implement whistleblower systems and policies, train staff, and actively work to prevent retaliation. This is directly tied to the provider’s broader governance obligations.

A robust integrity reporting system is your insurance against the catastrophic. It’s the only way for boards and executives to proactively surface issues before they escalate from a local problem into a systemic contravention that attracts the maximum penalties.

The Aged Care Act: Dual Compliance Challenge

Aged care providers (especially incorporated entities) cannot satisfy the new law with generic solutions. You must comply with both the specific, sector-focused ACA 2024 protections and the existing Corporations Act 2001 (Cth) whistleblower regime*.

A single disclosure—say, about financial fraud leading to unsafe staffing levels—can breach both Acts. Your internal system must be capable of :

Receiving disclosures from the ACA’s wide range of eligible recipients.
Handling matters that fall under corporate misconduct and care quality issues.
Maintaining auditable records that satisfy the legal requirements of both regimes.

If your policy, your training, and your technology are not integrated to handle this dual compliance, you are leaving your directors exposed.

Make Transparency Your Due Diligence Defense

The November 2025 deadline is not far away. Your competition is already moving to establish secure reporting channels and update their governance policies. But the goal shouldn’t be minimum compliance; it should be building a system that robustly defends your leadership team under the new laws.

A generic HR inbox or internal email system will not cut it when faced with an ACQSC investigation or a personal liability claim under S. 180. You need a dedicated, independent solution that provides auditable, legally defensible, and secure reporting.

Protect your organization. Protect your directors. Implement institutional integrity now.

The New Aged Care Act: A Call to Action

The new Aged Care Act has made robust integrity capability a non-negotiable part of executive due diligence. If your reporting systems are not secure, independent, and dual-compliant, you are putting your organization at severe risk.

Report It Now® provides the specialized, secure platform necessary to meet the stringent governance requirements of the ACA 2024 and the Corporations Act. Contact Report It Now® today to ensure your directors are defensibly compliant before the 2025 deadline.