Credential expiry: the compliance failure that creeps up on you

Nobody loses their registration in a dramatic way. What happens is that a renewal notice goes to a personal email address that a practitioner checks on weekends, in a month when they are moving house. They mean to do it. Three weeks later they are still seeing patients, still billing, and no longer registered — and neither they nor you know it, because nothing in your week tells you.

That is the shape of every credential failure in an allied-health practice. It is not a decision anyone made. It is a date that passed while everyone was busy, and it stays invisible until the moment it is expensive.

What it actually costs when one lapses

The direct consequences vary by which document it was, and they compound:

• AHPRA registration. Practice while unregistered and the work may not be claimable. Funders and health funds can seek repayment for services delivered in that window, and you are explaining it to every patient seen in it.
• Professional indemnity. An insurer who finds the cover lapsed on the date of an incident is an insurer who is not paying. This is the one that can end a practice.
• NDIS worker screening and Working With Children checks. These are conditions of being allowed near certain participants at all. An audit that finds an unscreened worker delivering supports is a finding against the practice, not the individual.
• Police check, first aid and CPR, manual handling, mandatory training. Individually minor. Collectively, they are what an aged-care provider or an insurer asks to see when they are deciding whether to keep sending you referrals.
• Vehicle insurance. Easy to forget that it is a practice compliance item at all, right up to the first accident on the way to a home visit.

The second-order cost is worse and less discussed: the day a facility or a plan manager asks for your compliance evidence and you cannot produce it inside an hour, you stop looking like a practice they want to work with. Being compliant and being able to show you are compliant are two different capabilities, and only one of them wins contracts.

Why the spreadsheet always fails

Almost every practice starts with a spreadsheet of expiry dates, and almost every one of them drifts. There are three reliable reasons.

It has no owner. The spreadsheet belongs to whoever set it up, and when that person is on leave — or leaves — the reminders stop and nobody notices for a quarter, because a spreadsheet that has stopped being updated looks exactly like one that is up to date.

It stores the wrong artefact. People file the certificate and treat the date as a property of the file. But the thing you need to act on is the date, and you need it in front of you sixty days early, not in a folder you open when someone asks.

And it asks the wrong person to do the work. Chasing eight practitioners for nine documents each is seventy-two follow-ups a year landing on one admin. That job gets deprioritised every single time it competes with billing, because billing is louder.

What a working system looks like

The /team page in AspireOS is built around one screen: a matrix with a practitioner per row and a credential per column, traffic-lit against today. Green is current, amber is expiring, red is expired or action needed, and there is an explicit "not held" state — because a blank cell that means "they do not need this one" and a blank cell that means "nobody has asked" are two completely different situations and must not look the same.

It ships with nine columns — AHPRA, Working With Children, police check, professional indemnity, first aid and CPR, car insurance, NDIS worker screening, manual handling and mandatory training — and you can add your own, because every practice has one credential nobody else has. Each cell holds a status and an expiry date, and the certificate itself can be filed against it.

Three things then turn that screen from a record into a system:

1. Filters by horizon. The matrix filters to everything expiring within 30, 60 or 90 days. Ninety days is the number that matters — it is the only window in which a lapsed police check or a re-screening can realistically be completed without anyone being stood down.
2. A reminder that goes to the practitioner, not to your to-do list. Any amber or red credential has a Remind button for owners and admins, so chasing is one click from the cell rather than a separate task in another app that also needs chasing.
3. Self-service upload. A practitioner maintains their own credential documents and expiry dates from the phone app, alongside their availability and service area. The renewal is theirs to do; the visibility is yours to keep.

The practice's own notification feed surfaces credentials inside a 45-day horizon to owners and admins, so an expiry reaches someone even in a week nobody opens the team page. And the whole matrix prints, which sounds trivial until an aged-care provider asks for your compliance position and you send it the same afternoon.

The half everyone forgets: the company's own documents

Practitioner credentials get attention because they have faces attached. The practice's own documents expire just as quietly and are usually tracked nowhere at all: the WorkCover policy, business insurance, professional indemnity at the entity level, public liability, vehicle policies, the lease, business registration, and every service contract with an aged-care provider or a facility.

AspireOS keeps these in a company compliance register on the same page, with the counterparty, the policy or contract number, issue and expiry dates, and a per-document reminder window that defaults to thirty days but is yours to set — a lease renewal wants ninety, a contract with a care partner might want more. Each one traffic-lights against its own window rather than a global rule, because a document you need three months to renegotiate should not first turn amber at the same time as one you can renew online in five minutes.

There is one contract that is worth handling with more care than the rest. If you deliver Support at Home services as an associate provider, your ability to bill a participant's package depends on having a signed third-party agreement with the care partner who holds it. AspireOS treats that as a billing gate rather than a note: without a confirmed agreement, the invoice cannot be raised, and if the participant moves their package to a different care partner, the confirmation you hold for the old one stops applying. That is not a paperwork nicety — it is the difference between work you get paid for and work you have already done.

Start here if you are starting from nothing

1. List every credential your practice actually requires, including the ones only some practitioners need. Nine is a normal number. Twelve is not unusual.
2. Capture the expiry date for every practitioner against every one of them, and mark the genuinely-not-applicable ones as not held rather than leaving them blank.
3. Do the same for the company's policies, contracts and registrations, and set each one's reminder window to how long the renewal really takes.
4. Set a standing fifteen minutes in the first week of every month to look at the 90-day filter. Not to chase — just to look.
5. Make uploading the renewed certificate the practitioner's job, and say so at induction.

The whole thing runs on about fifteen minutes a month once it is set up. The reason it is worth doing before you need it is that the alternative is not fifteen minutes — it is a fortnight of reconstructing which practitioner held what, on which date, while somebody's auditor waits.