INCIDENT, HAZARD & WHS

Designing a SIRS reporting workflow that beats the clock

Providers rarely miss a SIRS deadline because they did not know the rule. They miss it because the incident sat in somebody's inbox over a weekend. Here is how to build the workflow so the clock is the system's problem, not a person's.

The obligation, briefly

Under the Serious Incident Response Scheme, approved providers must notify the Aged Care Quality and Safety Commission of reportable incidents. The scheme covers eight incident types, including unreasonable use of force, unlawful sexual contact or inappropriate sexual conduct, psychological or emotional abuse, unexpected death, stealing or financial coercion by a staff member, neglect, inappropriate use of restrictive practices, and unexplained absence from care.

Reportable incidents are notified as Priority 1 within 24 hours, or Priority 2 within 30 calendar days. Some incident types are always Priority 1. Others become Priority 1 depending on whether the incident caused, or could reasonably have caused, injury or discomfort requiring medical or psychological treatment, or where there are reasonable grounds to report the matter to police.

Check the current definitions and timeframes against the Commission's own guidance before you configure anything. The scheme's wording has moved with the aged care reform program, and a workflow built on last year's reading of it is worse than no workflow at all.

The failure mode is never the form

Every provider I have worked with had an incident form. What they did not have was anything that knew the form had been submitted at 4:50pm on a Friday and that the 24-hour window would close before anyone opened it again.

Three specific ways the deadline gets missed, in rough order of frequency:

• Nobody owns the clock. The form goes to a shared mailbox. Shared mailboxes are where accountability goes to rest.
• Triage is a judgement call made by whoever happens to look. The Priority 1 / Priority 2 decision is genuinely hard, and a tired team leader at handover will default to "I will ask tomorrow."
• The escalation goes to the same person twice. A reminder that only ever emails the person who is already stuck is not an escalation.

None of these are fixed by a better form. They are fixed by making elapsed time an event the system reacts to.

The build

1. Intake

A Microsoft Form or a SharePoint list form, submitting into a single SharePoint List. Two design rules:

• Capture the incident datetime separately from the submission datetime. The reporting clock runs from when the provider became aware, not when someone typed it up. Store both. Auditors will ask about the gap, and you want to be able to answer.
• Do not ask the reporter to decide the priority. Ask them factual questions - what happened, who was involved, was medical attention sought, were police contacted. Let the workflow and a trained assessor do the classification.

2. Immediate acknowledgement and assignment

On item creation, a flow fires instantly. It writes a calculated Notification deadline field - awareness datetime plus 24 hours as the working assumption until triage says otherwise - assigns the item to the on-call assessor from a simple roster list, and posts an Adaptive Card to a Teams channel that the assessor actually watches. Email alone is not sufficient for a 24-hour obligation.

Set the default to the tighter deadline. Downgrading later is safe. Starting at 30 days and discovering on day three that it was Priority 1 is not.

3. Triage, as a guided decision rather than a free choice

Build the decision as a short branching form the assessor completes against the item. Was the incident type one of those always treated as Priority 1? If not, did it cause or could it reasonably have caused injury or discomfort requiring medical or psychological treatment? Are there reasonable grounds to report to police?

The value here is not that the software decides. It is that the answers are recorded. When the Commission or an internal auditor asks why an incident was assessed as Priority 2, you have the reasoning captured at the time by a named person, rather than a recollection constructed six months later.

4. The escalation ladder

A flow running on a short interval against open items, comparing now to the notification deadline:

• At 50% of the window elapsed - remind the assigned assessor.
• At 75% - notify the assessor and the quality manager together.
• At 90% - notify the GM, by Teams and SMS if you have it. At this point the organisation has a live compliance exposure and the most senior available person needs to know.
• Deadline passed without notification recorded - create a linked entry in the compliance breach log automatically. Do not make this a decision someone has to remember to make.

That last step is the one people push back on, and it is the one that matters most. A system that quietly forgives a missed deadline will produce more missed deadlines.

5. Recording the notification

The actual submission still happens in the Commission's portal - the workflow does not replace it and should not pretend to. What the workflow does is capture the receipt: date and time submitted, who submitted it, the reference returned, and the attached copy. Until those fields are filled, the item is not closed and the escalation ladder keeps running.

6. The part after the notification

SIRS does not end at the notification. There is the investigation, the outcome, the actions taken to prevent recurrence, and any further information the Commission requests. Model those as their own fields with their own owners and due dates on the same item, so the record of the incident and the record of the response live in one place. Splitting them across a list and a folder of Word documents is how providers end up unable to demonstrate closure.

What not to automate

Three things I keep out of the flow deliberately:

• The priority classification itself. Guide it, record it, but a named human makes the call. An automated classification is an automated defence you cannot stand behind.
• Notification to family or representatives. That is a conversation, and it should never be triggered by a system event.
• Anything that writes to the Commission's portal. Even if it were technically possible, the submission is an attested statement by your organisation. Keep a person on it.

Automation belongs on the clock, the routing, the chasing, and the evidence trail. It does not belong on judgement.

Where AI genuinely helps, and where it does not

Summarising a long free-text incident description into a consistent structure for the assessor to check: useful, low risk, saves real time. Drafting the recurrence-prevention actions from patterns across previous incidents: useful, provided a human owns the output.

Classifying the incident, or drafting the notification text without review: not worth the exposure. If you are considering either, the questions to answer first are the ones in the Australian Government's guidance for AI adoption - who is accountable, what happens when it is wrong, and can you show the board how you decided. A summarisation step your quality manager reads before acting on is a different risk proposition from a classification step nobody checks.

What this actually costs

The SharePoint list, the forms, the flows and the Teams cards are all inside a standard Microsoft 365 Business Standard or E3 licence. There is no new subscription in any of the above. The cost is a couple of days of design and the harder work of agreeing the escalation ladder with the people whose names appear on it.

That second part is the real project. The technology is the easy half.

Not confident your current incident process would survive a Friday evening Priority 1? Walk me through it and I will tell you where it breaks.