Use this checklist to verify that your CQC-registered healthcare service meets its recurring annual compliance obligations. Work through each section and address any gaps before your next CQC inspection or annual governance review.

Healthcare Regulatory Overview

Sector-specific regulatory guide: Key regulators and compliance requirements for healthcare businesses

Healthcare businesses are subject to rigorous regulatory oversight to protect patients and service users:

Care Quality Commission (CQC): Registration and inspection for health and social care providers
General Medical Council (GMC): Doctor registration and fitness to practise
Nursing & Midwifery Council (NMC): Nurse and midwife registration
Health & Care Professions Council (HCPC): Allied health professional registration
Medicines & Healthcare products Regulatory Agency (MHRA): Medical devices and medicines regulation

Most healthcare businesses providing regulated activities must register with the CQC before operating. Staff must be registered with appropriate professional bodies, and you must prepare a statement of purpose - a provider-level requirement under the CQC (Registration) Regulations 2009.

1

CQC annual fee paid (invoiced annually on your registration anniversary)
2

CQC registration details up to date (locations, nominated individual, registered manager)
3

All professional registrations verified (GMC, NMC, GDC, GPhC, HCPC)
4

Employers' liability insurance renewed (minimum £5 million cover)
5

Public liability insurance renewed
6

Professional indemnity insurance renewed
7

Medical malpractice insurance renewed (if applicable)
8

ICO data protection fee paid (due annually on registration anniversary)

CQC Annual Fees

Annual fees for CQC registration (England only) - there is no application fee

Application fee: None - CQC does not charge a fee to apply for registration
Variation fee: None - no fee to vary your registration
Annual fee (care and nursing homes): Banded by maximum service users, from £313 (fewer than 4 places) to £15,710 (more than 90 places) per location
Annual fee (community social care): £239 plus £54.305 per service user, per location
Billing: Invoiced annually on your registration anniversary
Fees scheme: 2019/20 fees scheme still in force (2024/25 figures shown)

1

DBS checks current for all staff in regulated activity (periodic rechecking is good practice, not a statutory requirement - set a policy)
2

DBS Update Service status checked for subscribed staff
3

Fit and proper persons requirement reviewed for directors and registered manager
4

Mandatory training completed by all staff (safeguarding, IPC, fire, manual handling, MCA/DoLS, medicines, basic life support)
5

Staff appraisals completed for all employees
6

Clinical supervision sessions completed and recorded
7

Professional revalidation dates tracked and upcoming renewals flagged
8

Right to work checks repeated for time-limited permissions before expiry

1

Medicines audit completed (stock check, expiry dates, storage conditions)
2

Regular controlled drugs stock checks done (at least weekly is widely recommended) and CD register reconciled (Schedule 2)
3

Infection prevention and control audit completed and action plan in place
4

Clinical waste contracts reviewed and consignment notes filed
5

Incident reports reviewed and learning disseminated to staff
6

Complaints log reviewed and themes reported to governance meeting
7

Clinical policies reviewed within their stated review dates
8

Duty of candour notifications completed for all notifiable safety incidents

1

Fire risk assessment reviewed (annually minimum)
2

Fire drill conducted and evacuation procedure tested
3

Equipment maintenance and calibration up to date (PAT testing, medical devices)
4

Health and safety risk assessments reviewed
5

Legionella risk assessment current and water management plan followed
6

Emergency procedures tested and staff briefed
7

First aid supplies checked and replenished
8

Waste disposal arrangements reviewed (clinical and non-clinical streams)

1

NHS Data Security and Protection Toolkit (DSPT) submitted by 30 June deadline
2

Privacy notices reviewed and up to date
3

Subject access request process tested
4

Data breach reporting procedure reviewed
5

Information governance training completed by all staff
6

Caldicott Guardian role assigned and active (if processing NHS patient data)

1

Safeguarding adults and children policy reviewed
2

Whistleblowing (raising concerns) policy reviewed
3

Business continuity plan reviewed and tested
4

Complaints procedure reviewed
5

Medicines management policy reviewed
6

Infection prevention and control policy reviewed
7

Health and safety policy reviewed
8

Recruitment and selection policy reviewed (including DBS procedures)
9

Data protection and confidentiality policy reviewed

If you answered 'no' to any items in the registration and legal or workforce sections, address these as a priority. Operating with lapsed CQC registration, expired insurance, or unchecked DBS records exposes your organisation to enforcement action and potential criminal liability.

What to do next

For items where you identified gaps:

See Register with the CQC for registration update procedures
See Healthcare professional registration for revalidation guidance
See Medicines and controlled drugs compliance for medicines audit procedures
See Healthcare data protection for DSPT and information governance
See Clinical governance and quality improvement for governance framework guidance

Official compliance resources

CQC registration and fees (opens in a new tab)
Current CQC fee schedules and registration update procedures
cqc.org.uk
NHS Data Security and Protection Toolkit (opens in a new tab)
Annual DSPT self-assessment submission portal
dsptoolkit.nhs.uk
DBS Update Service (opens in a new tab)
Check and manage DBS certificates through the Update Service
gov.uk
ICO data protection fee (opens in a new tab)
Pay or renew your annual ICO data protection fee
ico.org.uk

Related guides in CQC Registration

CQC annual fee paid (invoiced annually on your registration anniversary)

CQC registration details up to date (locations, nominated individual, registered manager)

All professional registrations verified (GMC, NMC, GDC, GPhC, HCPC)

Employers' liability insurance renewed (minimum £5 million cover)

Public liability insurance renewed

Professional indemnity insurance renewed

Medical malpractice insurance renewed (if applicable)

ICO data protection fee paid (due annually on registration anniversary)

DBS checks current for all staff in regulated activity (periodic rechecking is good practice, not a statutory requirement - set a policy)

DBS Update Service status checked for subscribed staff

Fit and proper persons requirement reviewed for directors and registered manager

Mandatory training completed by all staff (safeguarding, IPC, fire, manual handling, MCA/DoLS, medicines, basic life support)

Staff appraisals completed for all employees

Clinical supervision sessions completed and recorded

Professional revalidation dates tracked and upcoming renewals flagged

Right to work checks repeated for time-limited permissions before expiry

Medicines audit completed (stock check, expiry dates, storage conditions)

Regular controlled drugs stock checks done (at least weekly is widely recommended) and CD register reconciled (Schedule 2)

Infection prevention and control audit completed and action plan in place

Clinical waste contracts reviewed and consignment notes filed

Incident reports reviewed and learning disseminated to staff

Complaints log reviewed and themes reported to governance meeting

Clinical policies reviewed within their stated review dates

Duty of candour notifications completed for all notifiable safety incidents

Fire risk assessment reviewed (annually minimum)

Fire drill conducted and evacuation procedure tested

Equipment maintenance and calibration up to date (PAT testing, medical devices)

Health and safety risk assessments reviewed

Legionella risk assessment current and water management plan followed

Emergency procedures tested and staff briefed

First aid supplies checked and replenished

Waste disposal arrangements reviewed (clinical and non-clinical streams)

NHS Data Security and Protection Toolkit (DSPT) submitted by 30 June deadline

Privacy notices reviewed and up to date

Subject access request process tested

Data breach reporting procedure reviewed

Information governance training completed by all staff

Caldicott Guardian role assigned and active (if processing NHS patient data)

Safeguarding adults and children policy reviewed

Whistleblowing (raising concerns) policy reviewed

Business continuity plan reviewed and tested

Complaints procedure reviewed

Medicines management policy reviewed

Infection prevention and control policy reviewed

Health and safety policy reviewed

Recruitment and selection policy reviewed (including DBS procedures)

Data protection and confidentiality policy reviewed

What to do next

Official compliance resources