Review your CQC registration, regulated activities, and annual fee obligations. Notify CQC of any changes to registered manager or nominated individual.
CQC uses a risk-based inspection approach. Outstanding services are inspected less frequently, while Requires Improvement or Inadequate services face more frequent monitoring. You must display your rating within 21 calendar days of it being published - failing to display is an offence punishable by a fine.
Applies to: All CQC-registered providers
Official guidance (opens in a new tab)
CQC inspection ratings explained
CQC rates services Outstanding, Good, Requires Improvement, or Inadequate across five key questions. An Inadequate rating can trigger special measures and potential closure.
Outstanding
Significantly exceeds fundamental standards
Good
Meets fundamental standards consistently
Requires Improvement
Not meeting all standards - action plan required
Inadequate
Serious failings - enforcement action likely
Rating domains
Safe, Effective, Caring, Responsive, Well-led
Re-inspection frequency
Risk-based - no fixed re-inspection intervals
Rating display requirement
Within 21 calendar days of publication
Penalty for not displaying
Offence - fine on summary conviction
CQC is replacing the single assessment framework with sector-specific frameworks during 2026; the four ratings and five key questions are retained.
You must notify CQC of specific events without delay: deaths of service users, serious injuries, safeguarding incidents, police involvement, abuse allegations, and absence of registered manager for 28+ days. Failure to notify is a criminal offence.
Applies to: All CQC-registered providers
Official guidance (opens in a new tab)
CQC enforcement powers
CQC can issue warning notices, impose conditions, suspend registration, or cancel registration entirely. Criminal prosecution is possible for operating without registration or failing to meet fundamental standards.
Operating without registration
Unlimited fine and/or up to 12 months' imprisonment (either-way offence, section 10(4))
Breach of fundamental standards
Unlimited fine (criminal prosecution)
Failure to display rating
Fine on summary conviction (Regulation 20A)
Obstruction of inspector
Unlimited fine
False statement in application
Level 4 fine (£2,500), summary only (section 37)
Warning notice (section 29)
Formal requirement to comply; representations within 10 working days
Conditions on registration (section 12)
Restrictions imposed via notice of proposals (section 26) and decisions (section 28)
Suspension (section 18) / urgent suspension or variation (section 31)
Temporary cessation; urgent cancellation via justice of the peace order (section 30)
Cancellation of registration (section 17)
Cannot provide regulated activities
Appeals
To the First-tier Tribunal within 28 days (section 32)
Understand registration requirements for doctors, nurses, dentists, pharmacists, and allied health professionals including fees and revalidation cycles.
All doctors must revalidate every 5 years to maintain their licence to practise. This requires annual appraisals, patient feedback, colleague feedback, CPD evidence, and quality improvement activities. Employers must have appraisal systems in place.
Applies to: All employing or contracting doctors
Official guidance (opens in a new tab)
GMC revalidation requirements
Doctors must demonstrate continued fitness to practise through appraisal, CPD, patient feedback, and colleague feedback. Responsible Officers oversee revalidation for employed doctors.
Know your revalidation date
Revalidation occurs every 5 years from when you obtained full registration. Check your personal revalidation date in GMC Online and set reminders.
Participate in annual appraisals
Have an annual appraisal with your designated appraiser (arranged by NHS employer or private appraisal service). Review your practice, create personal development plan, and document CPD activities.
Maintain supporting information portfolio
Continuously collect: CPD records (the GMC sets no minimum hours - follow your royal college or faculty guidance), quality improvement activities, significant events, colleague feedback (multisource feedback), patient feedback, complaints and compliments review.
Ensure connection to responsible officer
You must have a designated connection to a responsible officer who will review your evidence. Most NHS doctors are automatically connected through their employer.
Undergo responsible officer review
Near your revalidation date, your responsible officer reviews your portfolio and appraisal evidence and makes a recommendation to GMC: revalidate, defer, or non-engagement.
Receive GMC decision
GMC reviews the recommendation and makes final decision. You'll be notified via GMC Online. If revalidated, your new 5-year cycle begins immediately.
Nurses and midwives must revalidate every 3 years with 450 practice hours, 35 hours CPD, 5 written reflective accounts and 1 reflective discussion, practice-related feedback, and third-party confirmation. Line managers often provide confirmation.
Applies to: All employing nurses, midwives, or nursing associates
Official guidance (opens in a new tab)
NMC revalidation requirements
Nurses and midwives submit revalidation online every 3 years. Employers should support staff by providing practice hours confirmation and participating in reflective discussions.
Know your revalidation date
Revalidation is required every 3 years from your registration date. Check NMC Online for your exact date and set reminders (6 months, 3 months, 1 month before).
Log practice hours
Record minimum 450 practice hours over 3 years (or 900 if registered as both nurse and midwife). Log in the NMC revalidation form.
Complete CPD hours
Complete minimum 35 hours CPD over 3 years, with at least 20 hours being participatory learning. Document what you learned and how you applied it to practice.
Write reflective accounts
Write 5 reflections linking your CPD or practice-related feedback to NMC Code standards. Keep these in your portfolio.
Collect practice-related feedback
Obtain minimum 5 pieces of feedback from patients, service users, or colleagues over your 3-year cycle. Use in reflective accounts.
Have reflective discussion
Discuss your 5 reflective accounts with another NMC registrant. Record discussion details and obtain confirmation from your discussion partner.
Obtain confirmation
Have an NMC registrant (confirmer) review all your evidence and confirm your declaration is honest. May be the same person as your discussion partner.
Submit revalidation online
Submit via NMC Online up to 60 days before deadline. Complete the form, pay your fee, and make revalidation declaration. You may be selected for verification (a sample of submissions is checked).
You must verify professional registration before any healthcare professional starts clinical work. Check the relevant regulator's public register (GMC, NMC, GDC, GPhC, HCPC) and document the check. Individuals who practise or use a protected title while unregistered commit a criminal offence; employers who deploy unregistered staff breach Regulations 12 and 19 of the 2014 Regulations and face CQC enforcement.
Applies to: All healthcare employers
Professional register search services
All UK healthcare regulators maintain searchable public registers. Use these to verify staff registration status, check for conditions, and confirm specialty qualifications.
Understand DBS check levels, eligibility for enhanced checks, processing times, and using the DBS Update Service for ongoing monitoring.
All staff in regulated activity with adults or children require Enhanced DBS checks including barred list checks. It is a criminal offence to employ someone on the barred list in regulated activity. Use the DBS Update Service for annual portable checks.
Applies to: All healthcare staff in regulated activity
Official guidance (opens in a new tab)
Encourage staff to join the DBS Update Service (currently £16 per year). This allows you to conduct instant online status checks rather than full rechecks. Check annually and whenever concerns arise.
Applies to: All healthcare employers
Official guidance (opens in a new tab)
Understand your duties under the Care Act 2014, Mental Capacity Act 2005, and Making Safeguarding Personal approach.
You must have safeguarding policies, train all staff, recognise abuse indicators, report concerns to the local authority safeguarding team, and cooperate with Safeguarding Adults Boards. CQC assesses safeguarding effectiveness at every inspection.
Applies to: All health and care providers in England
Official guidance (opens in a new tab)
Care Act safeguarding framework
The Care Act 2014 established statutory safeguarding duties including the Making Safeguarding Personal approach. Multi-agency working and information sharing are essential.
Safeguarding adults at risk
The Care Act defines an 'adult at risk' as someone aged 18 or over who:
Has needs for care and support (whether or not the authority is meeting any of those needs)
Is experiencing, or is at risk of, abuse or neglect
As a result of those needs is unable to protect themselves
Types of abuse and neglect
Physical abuse
Domestic violence or abuse
Sexual abuse
Psychological or emotional abuse
Financial or material abuse
Modern slavery
Discriminatory abuse
Organisational or institutional abuse
Neglect or acts of omission
Self-neglect
Safeguarding duties
Under section 42 , the duty to make (or cause to be made) safeguarding
enquiries sits with the local authority , not the provider. Providers must:
Have robust safeguarding policies and procedures
Report safeguarding concerns to the local authority
Cooperate with local authority enquiries and with safeguarding adults boards
Take protective measures when abuse is suspected
Safeguard service users from abuse and improper treatment under Regulation 13 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 — the directly enforceable provider duty
Making Safeguarding Personal
Making Safeguarding Personal is a sector-led programme (not a creation of
the Act itself) promoting person-centred, outcomes-focused approaches where
the adult's views, wishes, feelings and beliefs are central to
safeguarding decisions.
Step 1
Develop comprehensive safeguarding policy aligned with local Safeguarding Adults Board procedures
Step 2
Appoint a designated safeguarding lead within your organisation
Step 3
Provide safeguarding training to all staff (minimum annually)
Step 4
Implement whistleblowing procedures for staff to raise concerns
Step 5
When abuse is suspected, report immediately to local authority safeguarding team
Step 6
Maintain detailed records of safeguarding concerns and actions taken
Step 7
Participate in safeguarding enquiries and multi-agency meetings
Step 8
Review safeguarding incidents to identify learning and improve practice
Mental Capacity Act 2005
Healthcare providers must follow Mental Capacity Act principles when caring for adults who may lack capacity. This includes capacity assessments, best interests decisions, and understanding Deprivation of Liberty Safeguards (DoLS).
The five statutory principles
Presumption of capacity: Every adult has the right to make decisions unless proven otherwiseSupport to make decisions: All practicable help must be given before concluding someone lacks capacityUnwise decisions: People have the right to make unwise decisionsBest interests: Decisions for people who lack capacity must be in their best interestsLeast restrictive: Any intervention must be the least restrictive of the person's rights and freedom
Assessing capacity
Capacity is decision-specific and time-specific. A person lacks capacity if they cannot:
Understand information relevant to the decision
Retain that information
Use or weigh that information as part of decision-making
Communicate their decision
Best interests decisions
When making best interests decisions, you must:
Consider all relevant circumstances
Consider if the person will regain capacity
Involve the person as much as possible
Consider their past and present wishes, feelings, beliefs and values
Consult family, carers and attorneys/deputies
Consider less restrictive alternatives
Deprivation of Liberty Safeguards (DoLS)
DoLS apply to people in care homes and hospitals who lack capacity and
are subject to continuous supervision and control, and are not free to leave.
A standard authorisation must be sought from the local authority supervisory
body, which must decide the request within 21 days. Where the deprivation
needs to begin immediately, the care home or hospital can grant itself an
urgent authorisation lasting up to 7 days (extendable once by up to a
further 7 days) and must request a standard authorisation at the same time.
Liberty Protection Safeguards (LPS)
LPS were enacted by the Mental Capacity (Amendment) Act 2019 but are not
in force : implementation was postponed indefinitely in April 2023, so DoLS
remain the operative scheme. If implemented, LPS would extend to domestic
settings and be arranged by responsible bodies rather than local authorities.
Step 1
Train all staff in MCA principles and capacity assessment
Step 2
Always presume capacity unless assessment demonstrates otherwise
Step 3
Document capacity assessments clearly, including decision-specific reasoning
Step 4
For people lacking capacity, hold best interests meetings involving family/advocates
Step 5
Identify situations that may constitute deprivation of liberty
Step 6
Request standard authorisation from the local authority supervisory body before the deprivation of liberty begins wherever possible
Step 7
Where the deprivation must begin urgently, grant an urgent authorisation (up to 7 days, extendable once by up to 7 days) and request a standard authorisation at the same time
Step 8
Review DoLS authorisations before expiry and reapply if restrictions continue
Step 9
Maintain DoLS register tracking applications, authorisations and expiry dates
Mental Capacity Act Code of Practice (opens in a new tab)
All CQC-registered providers must meet fundamental standards including: person-centred care, dignity and respect, consent, safety, safeguarding, nutrition, premises and equipment, complaints handling, good governance, staffing, fit and proper staff, and duty of candour.
Applies to: All CQC-registered providers
Official guidance (opens in a new tab)
You have a statutory Duty of Candour to be open and transparent when a notifiable safety incident occurs. You must inform the patient/family, apologise, explain what happened, and document the conversation. Breach is a regulatory offence.
Applies to: All CQC-registered providers
Official guidance (opens in a new tab)
Implement robust incident reporting systems. Report serious incidents through statutory notification routes. Use incidents for learning - CQC expects evidence of incident analysis, root cause investigation, and implemented improvements.
Applies to: All healthcare providers
You must have a complaints procedure that meets NHS Complaints Regulations (or equivalent standards). Acknowledge complaints within 3 working days. Investigate thoroughly. Respond within the period agreed with the complainant (the regulations set a six-month backstop). Allow escalation to ombudsman.
Applies to: All healthcare providers
Official guidance (opens in a new tab)
Understand legal requirements for storing, prescribing, administering, and recording medicines including controlled drugs.
Schedule 2 drugs (and specified Schedule 3 drugs such as temazepam and buprenorphine) require locked storage in a CD cabinet under the Misuse of Drugs (Safe Custody) Regulations 1973. Schedule 1 and 2 drugs must be recorded in a controlled drugs register. Witnessed administration is good practice rather than a blanket statutory requirement. Carry out regular stock checks, with destruction witnessed by an authorised person. Home Office licence required for some activities.
Applies to: All providers holding controlled drugs
Official guidance (opens in a new tab)
Controlled drugs regulations
The Misuse of Drugs Regulations 2001 classify controlled drugs into five schedules with varying levels of control. Healthcare providers must comply with storage, recording, and destruction requirements.
Controlled drug schedules
Schedule 1: No therapeutic use (e.g. LSD, cannabis) - special licence requiredSchedule 2: High therapeutic value but high abuse potential (e.g. morphine, diamorphine, fentanyl, methadone, oxycodone) - strictest controlsSchedule 3: Moderate abuse potential (e.g. buprenorphine, temazepam, midazolam, tramadol) - some exemptions from Schedule 2 requirementsSchedule 4: Lower abuse potential (e.g. most benzodiazepines except temazepam and midazolam, zopiclone) - minimal controlsSchedule 5: Very low strength preparations - invoice records only
Safe custody and record keeping
Safe custody: Under the Misuse of Drugs (Safe Custody) Regulations 1973, Schedule 2 drugs and specified Schedule 3 drugs (temazepam, buprenorphine, diethylpropion, flunitrazepam) must be kept in a locked metal cabinet fixed to the wall or floor meeting BS 2881:1989 standard
Record keeping: Schedule 1 and 2 drugs require a Controlled Drugs Register with entries in chronological order, retained for 2 years
Each entry must include:
Date supply received or administered
Name and address of supplier (for receipts)
Quantity received
Name and address of person supplied (for administrations: patient name, prescriber)
Quantity supplied/administered
Running balance
Prescriptions
Schedule 2 and 3 CD prescriptions must be written in indelible ink and include:
Patient name and address
Drug name, form and strength
Total quantity in words and figures
Dose and frequency
Prescriber signature and date
CD audits
Designated bodies (NHS trusts and foundation trusts, NHS England and independent hospitals) must appoint a Controlled Drugs Accountable Officer (CDAO). Care homes do not appoint a CDAO - they report CD concerns to the NHS England area CDAO through the local intelligence network. All providers should conduct regular CD stock reconciliations - at least weekly is widely recommended in care settings.
Step 1
Install compliant CD cabinet (BS 2881:1989) fixed to structural wall or floor
Step 2
Obtain Controlled Drugs Register (bound book with numbered pages, not loose-leaf)
Step 3
Implement two-person CD administration checks for Schedule 2 drugs
Step 4
Maintain running balance in CD Register, updated after each transaction
Step 5
Conduct regular CD stock reconciliation against the register - at least weekly is widely recommended in care settings
Step 6
Report CD incidents, errors and discrepancies to your CD Accountable Officer or, for care homes, to the NHS England area CDAO via the local intelligence network
Step 7
Report significant CD incidents to CQC via Statutory Notification
Step 8
Ensure safe destruction of CDs witnessed by authorised person, recorded in register
Step 9
Appoint a CD Accountable Officer if you are a designated body (NHS trust or foundation trust, NHS England, independent hospital) - care homes report to the NHS England area CDAO instead
Controlled drugs guidance (opens in a new tab)
Understand MHRA registration, UKCA/CE marking, vigilance reporting, and equipment maintenance requirements.
Report medical device incidents to MHRA via the Yellow Card scheme. This includes malfunctions, safety concerns, near misses, and patient harm. Healthcare providers have a duty to report - manufacturers have legal obligations.
Applies to: All healthcare providers using medical devices
Official guidance (opens in a new tab)
Medical Devices Regulations
Medical devices must meet UK safety standards, carry appropriate UKCA/CE marking, and comply with post-market surveillance requirements. Healthcare providers must report adverse incidents.
What are medical devices
Medical devices range from simple items (bandages, thermometers) to
complex equipment (MRI scanners, ventilators, implantable devices).
Software and apps can also be medical devices.
Device classification
Class I: Low risk (e.g. bandages, walking sticks)Class IIa: Medium risk (e.g. hearing aids, ultrasound)Class IIb: Medium-high risk (e.g. ventilators, defibrillators)Class III: High risk (e.g. heart valves, implantable devices)
CE/UKCA marking
Devices on the Great Britain market can carry CE marking (accepted until 30 June 2028 for devices certified under the EU medical devices and active implantable devices directives, and until 30 June 2030 for IVDs and devices certified under the EU MDR/IVDR) or UKCA marking as an alternative. CE marking remains the requirement in Northern Ireland. Marking demonstrates conformity with safety and performance requirements.
Provider responsibilities
Healthcare providers must:
Only use devices with valid CE/UKCA marking
Maintain medical devices in safe working order
Ensure staff are trained in device use
Report adverse incidents and near misses to MHRA
Implement medical device management systems
Vigilance - reporting incidents
Report to MHRA when a device has:
Malfunctioned or deteriorated
Been subject to inadequate labelling or instructions
And this has led to death or serious injury, or could do so if it recurs
The immediate (death or serious public health threat) and 10-day (serious injury) reporting deadlines are manufacturer duties under the vigilance system, strengthened by the Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024, in force since 16 June 2025. As a healthcare provider, report adverse incidents to MHRA via the Yellow Card scheme as soon as possible.
Step 1
Maintain inventory of all medical devices with device details and maintenance schedules
Step 2
Verify devices carry valid CE or UKCA marking before procurement
Step 3
Implement preventative maintenance programme based on manufacturer instructions
Step 4
Ensure equipment testing (PAT testing for electrical devices) is up to date
Step 5
Provide device-specific training to staff before use
Step 6
Report adverse incidents via MHRA Yellow Card scheme as soon as possible
Step 7
Investigate incidents locally and implement corrective actions
Step 8
Maintain device incident log and review trends
Report a medical device incident (opens in a new tab)
All medical equipment must be maintained, calibrated, and serviced according to manufacturer specifications. Keep maintenance logs. Ensure staff training on equipment use. Faulty equipment must be removed from service immediately.
Applies to: All healthcare providers
Understand UK GDPR requirements, lawful bases for processing, ICO registration, and data breach notification obligations.
Health records are special category data . For most providers the condition for processing is UK GDPR Article 9(2)(h) (provision of health or social care) together with DPA 2018 Schedule 1 - consent is rarely the operational basis. You must identify a lawful basis for each processing activity. NHS and social care providers have additional Caldicott Guardian requirements.
Applies to: All healthcare providers
Official guidance (opens in a new tab)
Healthcare records have specific retention requirements: adult records 8 years after last treatment; children's records until 25th birthday (or 26th if 17 at last treatment); maternity records 25 years; mental health records 20 years. Destruction must be secure.
Applies to: All healthcare providers
Official guidance (opens in a new tab)
Personal data breaches likely to result in risk to individuals must be reported to ICO within 72 hours . High-risk breaches require notification to affected individuals without undue delay. Healthcare breaches often meet this threshold.
Applies to: All data controllers
Official guidance (opens in a new tab)
Understand your legal obligations when a data breach occurs, including ICO notification requirements and communicating with affected individuals.
Understand your duties under the Health and Safety at Work Act 1974 and associated regulations including risk assessment requirements.
Healthcare employers must assess and control: sharps injuries (safety-engineered devices required), manual handling (hoisting, patient transfers), infection control (PPE, standard precautions), work-related violence , and lone working . RIDDOR reporting applies to serious incidents.
Applies to: All healthcare employers
Official guidance (opens in a new tab)
Complete fire risk assessments, maintain fire safety systems, train staff, and conduct regular drills. Healthcare premises have specific requirements for sleeping risk.
Implement infection control policies covering hand hygiene, PPE, environmental cleaning, waste management, outbreak management, and antimicrobial stewardship. CQC assesses IPC at every inspection - failures led to increased enforcement during COVID-19.
Applies to: All healthcare providers
Official guidance (opens in a new tab)
Review your full duties under health and safety law including policy requirements, training, and consultation with workers.
Understand which insurance is legally required, recommended insurance types, and how to ensure adequate coverage for healthcare activities.
All healthcare providers should carry professional indemnity insurance appropriate to their activities. For medical practitioners, clinical negligence cover is usually required by professional regulators. CQC expects evidence of adequate insurance at registration and ongoing.
Applies to: All healthcare providers
Professional indemnity insurance
Professional indemnity insurance covers claims arising from professional negligence, errors, or omissions in clinical practice. Healthcare insurance costs vary significantly based on specialty and activity risk.
Legal requirement
Required under profession-specific regulatory rules for many solicitors, financial advisers and architects. Healthcare requirements vary by role and regulator. For accountants, PI cover is generally a professional-body requirement (e.g. ICAEW, ACCA) rather than a statutory one
Solicitors minimum
£2-3 million per claim (SRA minimums)
Financial advisers minimum
€1.25 million per claim (FCA requirement)
Architects minimum
£250,000 for domestic work
What it covers
Claims of negligent advice or services causing client financial loss
Employers' liability insurance is legally required with minimum cover of 5 million if you employ anyone (including temporary or part-time staff). Display certificate at premises or make available electronically. Failure to insure: up to 2,500 per day.
Applies to: All employers
Official guidance (opens in a new tab)
Legally required insurance
Employers' liability insurance is a legal requirement. Most healthcare providers also need professional indemnity and public liability insurance, though only EL is statutory.
UK law requires certain types of insurance depending on your business activities. Failing to have the correct insurance can result in fines, prosecution, and inability to claim compensation.
Employers' Liability Insurance - Requirement
Mandatory if you employ anyone (including part-time, casual, and family members working for you)
Employers' Liability Insurance - Minimum cover
£5 million (though most policies provide £10 million)
Employers' Liability Insurance - Penalty for no insurance
£2,500 fine for every day without cover
Employers' Liability Insurance - Display requirement
Must display certificate or make available to employees, or face £1,000 fine
Employers' Liability Insurance - Certificate retention
Retaining certificates for 40 years is recommended best practice (but no longer legally required since October 2008) as claims for occupational diseases can be made decades after exposure
Motor Insurance - Requirement
Mandatory for any vehicle used for business purposes (company car, deliveries, client visits)
Motor Insurance - Minimum cover
Third party liability (personal car insurance may not cover business use)
Motor Insurance - Penalty
Criminal offence with unlimited fine, 6-8 penalty points, possible disqualification, and vehicle seizure
Professional Indemnity - Requirement
Mandatory for some regulated professions (solicitors, financial advisers, architects, accountants, healthcare)
Professional Indemnity - Minimum cover
Varies by regulator (e.g., £2-3m for solicitors per SRA requirements, €1.25m per claim for FCA-regulated financial advisers converted to sterling, £250k for architects)
Professional Indemnity - Penalty
Regulatory action, removal from professional register, FCA enforcement (financial services)
Exemptions and special cases Employers' Liability exemptions:
Family businesses where all employees are close relatives Employees working outside Great Britain for more than 14 consecutive days Some companies with one employee who owns 50% or more of the share capital Important: Even if exempt, you may still want cover as you could be liable for employee injuries.
Employers' liability insurance (opens in a new tab)
Sources:
Employers' Liability (Compulsory Insurance) Act 1969 Health and Safety Executive (HSE) guidance Road Traffic Act 1988 Financial Conduct Authority (FCA) requirements Professional regulatory bodies (SRA, ARB, etc.)
If you manufacture medicines or medical devices, understand MHRA licensing requirements including MIA, WDA, and device registration.
Overview of MHRA authorisation types for manufacturers and distributors of medicines and medical devices.
If you conduct clinical trials, understand MHRA authorisation, ethics approval, GCP requirements, and safety reporting obligations.