Healthcare provider annual compliance checklist

Healthcare Regulatory Overview

Sector-specific regulatory guide: Key regulators and compliance requirements for healthcare businesses

Healthcare businesses are subject to rigorous regulatory oversight to protect patients and service users:

Care Quality Commission (CQC): Registration and inspection for health and social care providers
General Medical Council (GMC): Doctor registration and fitness to practise
Nursing & Midwifery Council (NMC): Nurse and midwife registration
Health & Care Professions Council (HCPC): Allied health professional registration
Medicines & Healthcare products Regulatory Agency (MHRA): Medical devices and medicines regulation

Most healthcare businesses providing regulated activities must register with the CQC before operating. Staff must be registered with appropriate professional bodies, and you must prepare a statement of purpose - a provider-level requirement under the CQC (Registration) Regulations 2009.

Registration and legal

CQC annual fee paid (invoiced annually on your registration anniversary)
CQC registration details up to date (locations, nominated individual, registered manager)
All professional registrations verified (GMC, NMC, GDC, GPhC, HCPC)
Employers' liability insurance renewed (minimum £5 million cover)
Public liability insurance renewed
Professional indemnity insurance renewed
Medical malpractice insurance renewed (if applicable)
ICO data protection fee paid (due annually on registration anniversary)

CQC Annual Fees

Annual fees for CQC registration (England only) - there is no application fee

Application fee: None - CQC does not charge a fee to apply for registration
Variation fee: None - no fee to vary your registration
Annual fee (care and nursing homes): Banded by maximum service users, from £313 (fewer than 4 places) to £15,710 (more than 90 places) per location
Annual fee (community social care): £239 plus £54.305 per service user, per location
Billing: Invoiced annually on your registration anniversary
Fees scheme: 2019/20 fees scheme still in force (2024/25 figures shown)

Workforce

DBS checks current for all staff in regulated activity (periodic rechecking is good practice, not a statutory requirement - set a policy)
DBS Update Service status checked for subscribed staff
Fit and proper persons requirement reviewed for directors and registered manager
Mandatory training completed by all staff (safeguarding, IPC, fire, manual handling, MCA/DoLS, medicines, basic life support)
Staff appraisals completed for all employees
Clinical supervision sessions completed and recorded
Professional revalidation dates tracked and upcoming renewals flagged
Right to work checks repeated for time-limited permissions before expiry

Clinical governance

Medicines audit completed (stock check, expiry dates, storage conditions)
Regular controlled drugs stock checks done (at least weekly is widely recommended) and CD register reconciled (Schedule 2)
Infection prevention and control audit completed and action plan in place
Clinical waste contracts reviewed and consignment notes filed
Incident reports reviewed and learning disseminated to staff
Complaints log reviewed and themes reported to governance meeting
Clinical policies reviewed within their stated review dates
Duty of candour notifications completed for all notifiable safety incidents

Premises and safety

Fire risk assessment reviewed (annually minimum)
Fire drill conducted and evacuation procedure tested
Equipment maintenance and calibration up to date (PAT testing, medical devices)
Health and safety risk assessments reviewed
Legionella risk assessment current and water management plan followed
Emergency procedures tested and staff briefed
First aid supplies checked and replenished
Waste disposal arrangements reviewed (clinical and non-clinical streams)

Data and information governance

NHS Data Security and Protection Toolkit (DSPT) submitted by 30 June deadline
Privacy notices reviewed and up to date
Subject access request process tested
Data breach reporting procedure reviewed
Information governance training completed by all staff
Caldicott Guardian role assigned and active (if processing NHS patient data)

Policy reviews

Safeguarding adults and children policy reviewed
Whistleblowing (raising concerns) policy reviewed
Business continuity plan reviewed and tested
Complaints procedure reviewed
Medicines management policy reviewed
Infection prevention and control policy reviewed
Health and safety policy reviewed
Recruitment and selection policy reviewed (including DBS procedures)
Data protection and confidentiality policy reviewed

What to do next

For items where you identified gaps:

See Register with the CQC for registration update procedures
See Healthcare professional registration for revalidation guidance
See Medicines and controlled drugs compliance for medicines audit procedures
See Healthcare data protection for DSPT and information governance
See Clinical governance and quality improvement for governance framework guidance

Legal basis

Official guidance

CQC registration and fees (opens in a new tab)

Current CQC fee schedules and registration update procedures

www.cqc.org.uk

NHS Data Security and Protection Toolkit (opens in a new tab)

Annual DSPT self-assessment submission portal

www.dsptoolkit.nhs.uk

DBS Update Service (opens in a new tab)

Check and manage DBS certificates through the Update Service

DBS

ICO data protection fee (opens in a new tab)

Pay or renew your annual ICO data protection fee

ICO

Dental mythbuster 4: Drugs and equipment for a medical emergency - Care Quality Commission (opens in a new tab)

CQC

Dental mythbuster 2: Keeping up to date for the dental practice team - Care Quality Commission (opens in a new tab)

CQC

Dental mythbuster 18: Decontamination in the dental treatment room - Care Quality Commission (opens in a new tab)

CQC

Regulation 20: Duty of candour - Care Quality Commission (opens in a new tab)

CQC

Reporting medicine related incidents - Care Quality Commission (opens in a new tab)

CQC

Good governance of medicines - Care Quality Commission (opens in a new tab)

CQC

CQC Regulation 15 - Premises and equipment (opens in a new tab)

www.cqc.org.uk

CQC Regulation 19 guidance (opens in a new tab)

Healthcare provider annual compliance checklist

Registration and legal

Workforce

Clinical governance

Premises and safety

Data and information governance

Policy reviews

What to do next

Legal basis

Official guidance

Related guides in CQC Registration

Register with the Care Quality Commission (CQC)

Healthcare and social care regulation (CQC)

Start a clinical laboratory service

Run a care home or other residential care service

Set up and run a regulated health practice