Aged Care Act vs the Corporations Act: what’s new, what overlaps, and what it means.

This article was produced in collaboration with Hall & Wilcox, drawing on their legal expertise in governance and compliance.

With the Aged Care Act 2024 coming into effect on 1 November 2025, the regulatory landscape for whistleblowing and disclosure in the aged care sector is undergoing a material shift. While many aged care providers already operate under the Corporations Act’s whistleblower regime, the new Act introduces sector-specific obligations that reflect the operational realities of aged care environments. This article examines key differences, areas of overlap, unresolved tensions, and implications for organisations navigating both frameworks.

1 | Scope & Eligible Disclosers: Operational Decentralisation vs Corporate Hierarchy

Corporations Act (Part 9.4AAA regime)

The Corporations Act provides protections for eligible whistleblowers including employees, officers, suppliers, contractors, associates, and in some cases relatives and dependants. Disclosures must be made to eligible recipients, which includes a relatively expansive list: officers, senior managers, auditors, actuaries, ASIC, APRA, other prescribed regulators, legal practitioners (for advice), or any person or body prescribed by regulation.

This framework is designed for corporate governance hierarchies where reporting flows through defined organisational structures.

Aged Care Act 2024

The aged care framework operates differently. It allows disclosures to be made to any aged care worker, a “responsible person” in the provider, or to the provider itself. The regime also extends protection to non-employee actors such as contractors, volunteers, family members and consumers (stakeholders with direct relationships to the aged care setting).

Key Difference: Environmental Fit, Not Broader Scope

The aged care regime is operationally decentralised rather than inherently broader in scope. This design reflects the frontline service environment where workers interact directly with vulnerable populations. A nurse overhearing abuse during a medication round, or a family member witnessing neglect during a visit, are differently positioned than corporate whistleblowers in traditional business hierarchies.

The “any worker” approach acknowledges that disclosures about elder abuse, neglect, or substandard care are likely to emerge in informal, urgent circumstances, not through formal compliance channels.

Implication: Aged care providers must prepare to receive disclosures from a wider universe of people, through more casual channels, and must train significantly more frontline personnel (not just compliance officers) to identify, protect confidentiality, and appropriately escalate reports.

2 | Dual Pathway and Triage: Formalising What Was Always Necessary

One of the significant features of the Aged Care Act is its explicit dual-pathway framework: not every issue reported should be channelled as a protected disclosure. Some matters may be better handled through complaints or feedback mechanisms rather than full whistleblower treatment.

Providers must build a triage mechanism or decision tree to determine which path a report should follow, with reasons documented and subject to audit.

What’s Actually New Here

This is not conceptual innovation, it’s mandated formalisation of triage practices that responsible organisations already perform. Under the Corporations Act, not every workplace concern qualifies as a protected disclosure (it must relate to misconduct or breach of law). Organisations have always had to distinguish between HR complaints, service quality issues, and genuine whistleblowing matters.

What the Aged Care Act does is require this triage to be documented, transparent, and auditable. This creates both clarity and risk.

The Risk of Getting It Wrong

What happens if a provider incorrectly routes a disclosure as a complaint? At the time of writing, the specific consequences under the Aged Care Act for mis-triaging a disclosure remain unclear but this represents potential regulatory exposure, particularly if the mis-classification results in a failure to investigate serious misconduct or provide appropriate protections to the discloser.

Implication: Systems must support branching intake flows and capture the reasoning for pathway decisions in a transparent, auditable manner. Providers need clear decision criteria and staff training to minimise classification errors.

3 | Mandatory Obligations: Training, Communication & Review

Aged Care Act obligations

Providers must maintain a whistleblower system (not just a policy) with confidentiality safeguards, protection measures, and support mechanisms. Training is mandatory for aged care workers and responsible persons to identify and handle disclosures properly.

Providers must also conduct effectiveness reviews annually, and actively communicate at regular intervals (the Act requires communication “monthly or at regular intervals”, this ambiguity creates compliance uncertainty about minimum frequency). Policies must be made publicly available to residents, consumers, and others on request.

Corporations Act obligations

The Corporations Act mandates that certain companies (public companies, large proprietary companies, etc.) must adopt a whistleblower policy and communicate it to officers and employees. The policy must cover: to whom disclosures may be made, protections available, investigation processes, support mechanisms, confidentiality measures, and fair treatment assurances.

However, there is no mandated training frequency, no requirement for monthly communication, and no prescribed annual effectiveness review cycle, though ASIC guidance does recommend regular policy review and updates.

What “Effectiveness Review” Actually Means

The Aged Care Act’s requirement for annual effectiveness reviews is potentially onerous but also vague. The Act does not specify metrics, benchmarks, or standards for effectiveness—leaving this to provider discretion and creating compliance uncertainty. Will regulators accept a basic annual report, or expect detailed analysis of disclosure volumes, outcomes, satisfaction surveys, and system improvements?

Implication: Aged care providers face more prescriptive operational burdens (training, communications, reviews) than their corporate counterparts, and must instrument these through systems and processes to ensure obligations are met and demonstrably auditable. Small providers may find these requirements disproportionately resource-intensive.

4 | Confidentiality, Anonymity & Identity Protection: Legal Promise vs Operational Reality

Under the Corporations Act

The identity of the whistleblower must be kept confidential, or measures taken to prevent disclosure of identity, unless the discloser consents. Section 1317AAE sets out civil and criminal penalties for unauthorised disclosure of identity. Disclosures may be made anonymously, although anonymous disclosures face practical investigation constraints.

Under the Aged Care Act

The aged care disclosure framework similarly protects identity and allows anonymous or oral disclosures. Penalties for breaching confidentiality obligations exist, though at the time of writing it is unclear whether these mirror the specific civil and criminal penalties structure of s1317AAE.

The Structural Tension: When Anonymity Is Functionally Impossible

Here’s the operational reality that undermines legal protections: aged care environments often make true anonymity functionally impossible. Small teams, shift patterns, and specific incident details frequently make disclosers identifiable even when they don’t provide their name.

For example, if a family member reports abuse they witnessed during a visit, even without identifying themselves, the circumstances often reveal their identity (only three families visited that day; the incident occurred in a specific resident’s room during a specific shift).

Because any worker can receive a disclosure in aged care, the risk of inadvertent identity exposure through informal channels is materially higher than in corporate environments, which are typically larger and more diffuse.

Implication: This represents a structural tension between legal protection and operational reality. Providers must train widely to maintain confidentiality even in casual settings, but the aged care environment may inherently compromise anonymity protections that work effectively in corporate contexts. This limitation should be acknowledged when communicating protections to potential disclosers.

5 | Detrimental Conduct Protections: A Critical Comparison

Both regimes prohibit victimisation and detrimental conduct against whistleblowers, but critical differences exist in enforcement mechanisms and remedies.

Corporations Act Protections

Under Part 9.4AAA, detrimental conduct includes dismissal, demotion, harassment, discrimination, and other harm. Critically, the Corporations Act reverses the onus of proof under s1317AC, if a person suffers detriment and has made a disclosure, the alleged perpetrator must prove their actions were not because of the disclosure.

Whistleblowers have private civil remedies under s1317AD, allowing them to sue for compensation, reinstatement, and other orders. They don’t depend solely on regulatory enforcement—they have personal legal recourse.

Aged Care Act Protections

The Aged Care Act provides whistleblower protections through civil penalty provisions and court-ordered remedies. Under section 551 and related provisions:

  • Victimisation is prohibited: Causing or threatening detriment due to a protected disclosure attracts civil penalties of 500 penalty units ($165,000)
  • Private civil remedies exist: Courts can order compensation, reinstatement, injunctions, and exemplary damages—remedies comparable to those available under Corporations Act s1317AE
  • Individual accountability: Aged care workers and responsible persons who breach the Code of Conduct (including victimising whistleblowers) face banning orders under Chapter 6 of the Act, prohibiting involvement in aged care.

However, one critical protection remains absent: No reverse onus of proof. Unlike Corporations Act s1317AC, which shifts the burden to the employer once a whistleblower proves they suffered detriment after making a disclosure, the Aged Care Act places the full evidentiary burden on the whistleblower to prove both the victimisation and its causal connection to the disclosure.

Why This Matters

The absence of reverse onus creates a material practical disadvantage despite the availability of similar remedies. Proving causation can be challenging, as employers rarely document retaliatory intent. The reverse onus in the Corporations Act addresses this evidentiary asymmetry by recognising that employers control the evidence about their own motivations.

Despite having access to equivalent remedies (compensation, reinstatement), aged care whistleblowers face a higher evidentiary bar to obtain them. Where corporate whistleblowers need to prove disclosure + detriment, aged care workers must prove disclosure + detriment + causation – with the employer’s subjective intent being the crucial disputed fact.

Implication: Aged care workers making disclosures face a higher burden of proof than their corporate counterparts, even though the aged care regime appears more operationally extensive. Equivalent remedies exist on paper but are harder to access in practice.

6 | Overlap, Interaction & Regulatory Enforcement: When Both Regimes Apply

Because many aged care providers are incorporated entities, they may simultaneously fall under both statutes. The Aged Care Act itself acknowledges that some disclosures may trigger protections under the Corporations Act as well.

Critical Unresolved Questions

When a disclosure qualifies under both regimes, which governs? Key issues include:

  • Precedence: If process requirements conflict, which takes priority?
  • Maximum protection principle: Are providers required to comply with whichever regime offers greater protection to the discloser?
  • Explicit interaction provisions: Does the Aged Care Act contain language addressing its relationship with the Corporations Act, or is this ambiguous?

At the time of writing, the legislative interaction framework remains unclear, creating compliance uncertainty for dual-regime providers.

External Escalation Pathways: A Major Gap

The Corporations Act permits public interest and emergency disclosures to journalists or parliamentarians under strict conditions (Part 9.4AAA Division 3). This provides an escalation pathway when internal processes fail or regulatory responses are inadequate.

The Aged Care Act does not clearly provide equivalent external escalation pathways. If this is a deliberate omission rather than oversight, it means aged care workers who witness systemic abuse have fewer escalation options than corporate whistleblowers, even though they work with vulnerable populations where disclosure stakes are high.

This gap warrants explanation and may reflect policy choices prioritising sector reputation over disclosure rights.

Regulatory Enforcement

Enforcement in aged care involves the Aged Care Quality & Safety Commission and sector oversight bodies. Under the Corporations Act, ASIC is the primary regulator. For dual-regime entities, this means potential involvement of multiple regulators with different priorities, investigation approaches, and enforcement philosophies.

Implication: Providers must ensure compliance with both regimes where applicable, understanding that regulatory coordination may be imperfect. Dual compliance creates procedural complexity and potential for conflicting obligations. Organisations cannot use aged care-specific provisions to disclaim or weaken their obligations under corporate law.

7 | Key Risks & Challenges for Organisations

Scale & diffusion of recipients: Because disclosures may be made to any worker in aged care, significantly more personnel must be educated and trained to act appropriately (triage, confidentiality, escalation). This is operationally demanding.

Branching complexity: The dual-pathway requirement introduces operational complexity. Mistakes in classification could expose providers to regulatory action, particularly if serious misconduct is incorrectly treated as a routine complaint.

Audit & governance: Providers must instrument logging, triage documentation, reviews, communications, and effectiveness measures, often via digital platforms, to demonstrate compliance. The burden of proof sits with the provider.

Dual compliance tension: Reconciling divergences between aged care-specific rules and Corporations Act requirements is challenging, especially where interaction is ambiguous. Hybrid organisations face particular complexity.

Resource burden for small providers: Mandated training, regular communications, annual effectiveness reviews, and system requirements may be disproportionately difficult for small operators with limited administrative capacity.

Weaker protections paradox: If the aged care regime lacks private civil remedies or external escalation pathways, providers may face less legal risk than under the Corporations Act, but disclosers are more vulnerable. This creates a perverse incentive structure that may chill disclosures.

Cultural change: Staff must shift from treating “complaints/feedback” and “whistleblowing” as separate silos to viewing them as part of a unified risk and quality framework. This requires leadership commitment, not just policy updates.

Conclusion: Clarity Required

The Aged Care Act 2024 introduces a whistleblowing framework tailored to the operational realities of aged care with decentralised reporting, broad stakeholder inclusion, and formalised triage. However, significant ambiguities remain regarding its interaction with the Corporations Act, the availability of private civil remedies, external escalation pathways, and enforcement mechanisms.

Organisations should not assume the aged care regime is uniformly more robust than corporate protections. In some respects, particularly regarding personal legal recourse for victimised disclosers and external escalation pathways, it may be materially weaker, despite appearing more operationally comprehensive.

As regulatory guidance develops and case law emerges, providers must remain vigilant about compliance obligations under both regimes, advocate for clarity on unresolved interaction issues, and build systems capable of demonstrating compliance across both frameworks.

The aged care sector deserves whistleblowing protections that match the vulnerability of the populations it serves. The new regime provides an important foundation, but clarifying the ambiguities identified above will be essential to achieving that objective.