By: Yen Seah and Samantha Younane
At a glance
- The Aged Care Act 2024 (Cth) comes into effect on 1 July 2025.
- The Act imposes a new statutory duty on directors and other persons responsible for the executive decisions of aged care providers. This includes those who have authority or responsibility for (or significant influence over) planning, directing or controlling the activities of the provider.
- These duties are largely enforceable by the Aged Care Quality and Safety Commissioner, including by way of civil penalty proceedings.
Introduction and context to the reforms
The Royal Commission into Aged Care Quality and Safety delivered its final report in 2018. It outlined 148 recommendations directed at a complete overhaul of Australia’s aged care system. Following significant consultation and debate, the Aged Care Bill was passed in late 2024 and comes into effect on 1 July 2025 as the Aged Care Act 2024 (the Act). The Act gives effect to around 60 of the recommendations made by the Royal Commission and replaces the current Aged Care Act 1997 (Cth).
The Act applies to aged care providers, their responsible persons, aged care workers, and digital platform providers that create websites or apps that support delivery of aged care services. It governs a variety of matters including criteria for entry into the Commonwealth aged care system, aged care provider requirements, the aged care workforce as well as funding of aged care services.
This article focuses on the obligations imposed on “responsible persons” of aged care providers. These changes followed unequivocal findings by the Royal Commission that the governance of some aged care providers and the ineffective regulation of them led to poor outcomes for aged care residents across both public and private sectors. The Commission’s final report observed that:
Provider governance and management directly impact on all aspects of aged care. Deficiencies in the governance and leadership of some approved providers have resulted in shortfalls in the quality and safety of care. Some boards and governing bodies lack professional knowledge about the delivery of aged care, including clinical expertise. There is a risk that they may focus on financial risks and performance, without a commensurate focus on the quality and safety of care. There is sometimes a lack of accountability, particularly when things go wrong. Poor workplace culture has also contributed to poor care. The values and behaviour of people in senior positions have a significant impact on workplace culture and the quality of care that is delivered. When these values and behaviours are poor, so may be the care that people receives.1
Which entities are regulated under the Act and how big is the sector?
There are two types of entity providers: registered providers and associated providers.2
Registered providers are entities registered under the Act that deliver funded aged care services.
Associated providers are those entities that engage in conduct under an “arrangement” with a registered provider relating to the registered provider’s delivery of funded aged care services (and for which they are treated as having been provided by the registered provider).
Providers are a mix of private and government entities. According to government data, there were around 3,106 aged care providers across residential care, home care and other aged services as at 30 June 2023.3
Who is a responsible person?
In short, a “responsible person” is a person who has responsibility, oversight or management of the services delivered by a registered provider. There are two types of responsible persons, and the responsible person “type” informs whether they are subject to the new statutory duty imposed by the Act:
| Registered provider type | Who is a responsible person? |
| Non government entity | “Certain Responsible Persons”
|
| Any providers (government or non-government) who deliver, or propose to deliver, a funded aged care service |
|
What are the duties owed by responsible persons?
There are two buckets of obligations attaching to a responsible person – the statutory duty and the other obligations.
The statutory duty
The statutory duty applies only to Certain Responsible Persons (that is, those who are responsible for executive decisions of non government registered providers) and provides that these persons must exercise due diligence to ensure that the relevant registered provider complies with its duty to ensure that its conduct does not cause adverse affects to the health and safety of those in its care. The term ‘due diligence’ is defined in s180(2) to include taking reasonable steps to ensure the entity has done a number of things such as following processes as well as taking steps to respond to information regarding risks and incidents.
The relevant provisions from the Act outlining the duties of the registered provider as well as Certain Responsible Persons are set out below:
Statutory duty of a registered provider (s 179)
A registered provider must ensure, so far as is reasonably practicable, that the conduct of the provider does not cause adverse effects to the health and safety of individuals to whom the provider is delivering funded aged care services while the provider is delivering those services.
Statutory duty of certain responsible persons (s 180)
A person who is a responsible person of a registered provider […] must exercise due diligence to ensure that the provider complies with the provider’s duty under section 179.
…
A person may be found liable to pay a civil penalty under this Act relating to a duty under this section whether or not the registered provider has been found liable to pay a civil penalty under section 179.
Other obligations
Otherwise, all responsible persons (not just Certain Responsible Persons) have obligations to:
- comply with the Aged Care Code of Conduct
- notify the regulator as to any changes in their suitability as a responsible person (for example where the person is subject to a banning order, a bankrupt or has been the subject of adverse findings by other regulators)
- comply with the whistleblower protections in the Act where a protected disclosure is made to the responsible person, which includes ensuring that the discloser’s identity is preserved and not taking any steps which would victimise the person who made the disclosure
Enforcement and Regulation
Who are the regulators?
The Act establishes three new regulators with each serving a different function:
- The Aged Care Quality and Safety Commissioner (the Commissioner)
- The Complaints Commissioner
- The System Governor
Most of the enforcement powers in relation to responsible persons are vested in the Commissioner.
How can the Act be enforced?
There are several enforceable provisions in the Act ranging from failure to notify certain matters through to serious breaches of the statutory duty. Importantly, this includes civil penalty provisions enforceable against responsible persons with a maximum penalty of 500 penalty units ($165,000) where the conduct results in death or serious injury a person under the provider’s care. In the event of conduct amounting to a ‘serious failure’ (ie where the conduct exposes a person to a risk of death or serious injury or illness, and involves a ‘significant failure’ or systemic pattern of conduct), the maximum penalty is 150 penalty units ($49,000) per offence.
All of the civil penalty provisions under the Act are enforceable by way of court proceedings issued by the Commissioner but the Commissioner also has the powers to conduct a formal investigation into potential breaches of the Act. The Commissioner also has powers to make banning-style orders against responsible persons and to prosecute responsible persons where the whistleblowing protections provided to those who make qualifying disclosures apply.
The table at the end of this article sets out all of the provisions that can be enforced (as against responsible persons only).
What does this mean for insurers?
The new Aged Care Act introduces elevated risk for responsible persons, with flow-on effects for their insurers. The Australian Financial Review reported last year that D&O premiums have “almost doubled”, reflecting the anticipated increase in exposure.4
As outlined above, the Act introduces a number of civil penalty provisions applying to responsible persons. Insurers may be required to cover the costs of defending such proceedings, although the extent of the total exposure will depend on whether fines and penalties are covered under the relevant policy. Investigations and disciplinary powers—such as banning orders—are likely to fall within the scope of investigation cover.
The expanded whistleblower protections also warrant review. Policies should be assessed to confirm whether they respond to potential remedies such as compensation orders. While many larger entities are required to comply with the existing whistleblowing regime within the Corporations Act 2001 (Cth), the changes provide a timely opportunity for insureds to review their cover as well as revisit their internal whistleblower procedures.
Finally, while the Act imposes new statutory duties on responsible persons (and therefore creates a new set of exposures for those persons), those who meet the definition of ‘responsible person’ will, in most cases, already be considered directors or officers under the Corporations Act 2001 (Cth) and be subject to an extensive set of duties and obligations as a result of their role.
Table: Provisions that can be enforced against responsible persons only
| Section | Remedy / power | Basis to seek the remedy / exercise the power | Who can pursue the remedy/exercise the power? | Against whom can it be sought? | Maximum penalties (if applicable)* |
| 180(5) | Civil penalty – serious failure | · person owes the statutory duty, and
· without reasonable excuse, the person engages in conduct that does not comply with the duty, and · the conduct amounts to a serious failure by the person to comply with the duty |
Commissioner | Certain Responsible Persons | 150 penalty units |
| 180(6) | Civil penalty – death or serious injury or illness | · person owes the statutory duty, and
· without reasonable excuse, the person engages in conduct, and · the conduct amounts to a serious failure by the person to comply with the duty, and · the conduct results in the death of, serious injury to or illness of an individual to whom the statutory duty is owed by the registered provider |
Commissioner | Certain Responsible Persons | 500 penalty units |
| 169 | Civil penalty – change of circumstances re suitability | Responsible person must notify their provider of a change in circumstances that relates to a “suitability matter” in relation to a person (suitability matter defined in s13) | Commissioner | Responsible persons (of a kind prescribed by the rules) | 30 penalty units |
| 174 | Civil penalty – Aged Care Code of Conduct | Where the person has failed to comply with the Aged Care Code of Conduct | Commissioner | A responsible person of a registered provider (ie not just Certain Responsible Persons) | 250 penalty units |
| 170 | Determination powers re suitability | The Commissioner may, at any time, determine that a person who is one of the responsible persons of a registered provider is not suitable to be involved in the delivery of funded aged care services. | Commissioner | Responsible person | N/A |
| 448(b) | Infringement notices | Failure to give notice of change of circumstances of suitability as a responsible person | Commissioner | Responsible persons (of a kind prescribed by the rules) | N/A |
| 488-489 | Notice to attend and answer questions | Where the Commissioner or Complaints Commissioner believes a person has information relevant to a breach of the Act or the information otherwise relates to the relevant regulator’s functions | Commissioner or Complaints Commissioner or System Governor | Any person (which could include responsible persons) | N/A although failure to comply is a civil penalty provision |
| 492-494 | Notice to attend and produce documents | ||||
| 498-499 | Banning orders | · The Commissioner can make an order which prohibits or restricts a responsible person from being involved in the delivery of funded aged care services (or a specified type of service)
· The grounds include where the Commissioner reasonably believes that the person has breached the Aged Care Code of Conduct or where there is a severe risk to the safety wellbeing of those who access funded aged care |
Commissioner | Responsible persons | N/A |
| 552 | Court orders where whistleblowing protections breached (such as for injunctive relief, compensation for loss) | Where the responsible person has engaged in conduct which causes detriment to an individual because they have made a disclosure | Commissioner | Responsible persons | 500 penalty units |
* Current value of 1 penalty unit = $330
[1] Royal Commission into Aged Care Quality and Safety Final Report – Care, Dignity and Respect: Volume 1 at pg. 85
[2] There is also a third category (being “aged care worker”) however this is outside the scope of this article.
[3] See https://www.gen-agedcaredata.gov.au/topics/providers,-services-and-places-in-aged-care.
[4] https://www.afr.com/politics/federal/aged-care-insurance-fees-jump-on-threat-of-fines-and-jail-20240703-p5jqnh.