What policies does a care home need?

What the law actually requires

There is no single statutory list of care home policies. The fundamental standards in Regulations 9 to 20A of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 are written as outcomes and systems, not documents. Regulation 13(2) says "systems and processes must be established and operated effectively to prevent abuse"; Regulation 16(2) requires "an accessible system" for complaints; Regulation 19(2) requires "recruitment procedures" that are "established and operated effectively"; and Regulation 17(1) requires systems "to ensure compliance with the requirements in this Part". A written policy and procedure is the ordinary way to show those systems exist, which is why every care home has them, but it is the system that the law requires.

CQC's guidance on Regulation 17 treats policies as part of the records of managing the service, which "may include governance arrangements such as policies and procedures, service and maintenance records, audits and reviews", and those records must be "created, amended, stored and destroyed in accordance with current legislation and guidance". Providers must also have regard to CQC's guidance on each regulation, under Regulation 21, and to nationally recognised guidance.

A handful of documents are required by name, by CQC's registration rules or by other law:

• A statement of purpose, under Regulation 12 of the Care Quality Commission (Registration) Regulations 2009, kept under review and sent to CQC within 28 days of any revision
• A written health and safety policy, under section 2(3) of the Health and Safety at Work etc. Act 1974: a "written statement of his general policy with respect to the health and safety at work of his employees and the organisation and arrangements" for carrying it out; the HSE says "If you have five or more employees, you must write your policy down"
• A fire risk assessment under the Regulatory Reform (Fire Safety) Order 2005, with the emergency and evacuation arrangements that follow from it
• A care home medicines policy, which is not in statute but is recommendation 1.1.2 in NICE's Managing medicines in care homes (SC1): "Care home providers should have a care home medicines policy, which they review to make sure it is up to date"

Everything else on the list below exists because a regulation requires a system and the policy is how the home shows it has one.

The list, tied to the regulation behind each policy

Grouped by the fundamental standard each one serves. The regulation is the reason the policy exists, and the policy should say so. (The regulations call each resident a service user; the policies can use the words your home uses.)

• Person-centred care (Regulation 9): assessment and admission; care planning and review; end of life care; activities and social inclusion; nutrition and hydration, which also serves Regulation 14.
• Visiting and accompanying (Regulation 9A): a visiting policy that facilitates visits and does not discourage residents from going out, with the exceptional circumstances in which visits might be limited and who decides.
• Dignity and respect (Regulation 10): privacy and dignity; equality, diversity and human rights, reflecting the protected characteristics under the Equality Act 2010.
• Consent (Regulation 11): consent to care and treatment; the Mental Capacity Act 2005, including best-interests decisions and advance decisions; Deprivation of Liberty Safeguards applications.
• Safe care and treatment (Regulation 12): medicines management; infection prevention and control, having regard to the Department of Health and Social Care's code of practice on the prevention and control of infections, which Regulation 21 requires; risk assessment; falls; pressure area care; moving and handling; choking and dysphagia; transfers to and from hospital.
• Safeguarding (Regulation 13): safeguarding adults, aligned with the local authority's duty to make enquiries under section 42 of the Care Act 2014 and the local Safeguarding Adults Board's procedures; restraint and restrictive practice, because Regulation 13(4)(b) prohibits control or restraint that is not necessary and proportionate; residents' money and property, since theft or misuse of it is abuse under Regulation 13(6); gifts and hospitality. Our care home safeguarding policy guide covers what that policy must say.
• Premises and equipment (Regulation 15): maintenance and servicing; equipment checks, including hoists and beds; cleanliness and hygiene; security of the building.
• Complaints (Regulation 16): a complaints policy that is accessible to residents and families, says who investigates, and records every complaint to outcome, not only the formal ones.
• Good governance (Regulation 17): quality assurance and audit; records management and retention; data protection under UK GDPR and the Data Protection Act 2018, confidentiality and information security, including the Data Security and Protection Toolkit that CQC lists under its governance quality statement; business continuity and emergency planning; notifications to CQC under the 2009 Registration Regulations.
• Staffing (Regulation 18): staffing levels and deployment; induction, commonly built on the Care Certificate standards for new care workers; staff training and competence, including the training often called mandatory, such as fire safety, moving and handling, infection control and safeguarding; supervision and appraisal. In a nursing home, add clinical supervision and the arrangements for nurses' professional revalidation.
• Fit and proper persons employed (Regulation 19): safer recruitment, covering the Schedule 3 checks, DBS checks, references, right to work and professional registration; managing staff who no longer meet the requirements.
• Duty of candour (Regulation 20): a candour policy with the steps and the written record; CQC expects "training, policies and systems in place" for it.
• Speaking up: whistleblowing and freedom to speak up, which CQC assesses under the well-led key question.
• Communication: staff use of personal phones, messaging and social media, and how work conversations about residents are held and kept.

Regulation 20A, displaying the rating, is a duty rather than a policy; make sure someone owns it. So is Regulation 12's requirement for staff to have the qualifications, competence, skills and experience to provide care safely, which the training policy has to deliver in practice.

Policies the care home needs as an employer and a building

A care home is also a workplace, and a set of policies follows from that rather than from CQC. They matter to inspectors because Regulation 17's "others who may be at risk" includes staff and visitors, and because a service in employment trouble is rarely a well-led one.

• Health and safety, with the risk assessments behind it: lone working at night, violence and aggression, hazardous substances used for cleaning, sharps where nursing care is provided, and accident reporting including RIDDOR.
• Fire safety, following the fire risk assessment: evacuation plans, personal emergency evacuation plans for residents, drills and training.
• Disciplinary and grievance procedures, which should follow the Acas Code of Practice; an employment tribunal takes it into account.
• Equality and dignity at work, including bullying and harassment.
• Sickness absence, and staff wellbeing, which CQC's caring key question includes as workforce wellbeing and enablement.
• Data protection for staff records as well as residents' records, and a privacy notice for each.

None of these is specific to care, which is why generic versions work reasonably well. The care-specific policies in the previous section are the ones that most often fail, because they were written for someone else's service.

Why a complete list is not compliance

A home can hold every policy on the list and still be in breach of the regulation each one names. CQC does not assess the folder; it assesses whether the system works. Under the single assessment framework it gathers evidence from people using the service, staff and leaders, partners, observation, processes and outcomes, and a policy is only one line of that evidence. The questions an inspector actually asks are practical: does the night carer know what to do if she finds a bruise, does the complaints log match what families say, does the medicines policy describe how medicines are actually given in this home.

The difference between residential homes and nursing homes matters too. A home registered for nursing care carries clinical policies a residential home does not need, such as wound care, catheter and enteral feeding care, and verification of expected death, and a residential home that has copied them in suggests a service it does not provide.

Four things turn a document into a policy that counts:

1. It describes this home. Its service type, its residents, its staffing pattern, its local authority's safeguarding procedures, its own escalation routes, its own names. A policy that refers to a domiciliary care visit in a residential home, or to a local authority it has never dealt with, tells an inspector that nobody read it. The ones residents and families use, such as complaints and visiting, should be written in plain English and available in accessible formats.
2. Staff know it and follow it. Staff do not need to sign every policy by law, but the home needs to show they have read and understood the ones that matter to their role, through induction, training and supervision, and that practice matches what is written.
3. It is reviewed. On a set cycle, usually annually, and whenever there are changes in law, national guidance or the service, such as the new Regulation 9A in 2024 or a revision to CQC's or NICE's guidance for care homes. Each version dated, with what changed and who approved it.
4. It is tested. Audits check practice against the policy, and incidents, complaints and safeguarding concerns are reviewed for what they say about whether the policy works. That is Regulation 17's governance loop, and it is the evidence that the system operates effectively.

Bought-in policy packs are a reasonable starting point for a new provider or a small one; nobody needs to draft an infection control policy from nothing. The risk is treating the pack as finished. Adapt each policy to the home, remove what does not apply, and keep the statement of purpose, the policies and the actual service in agreement with each other.

Where to start if the folder needs work

If the policies have drifted, fix them in the order that protects residents first. A reasonable sequence is:

1. Safeguarding, medicines, and infection prevention and control. These are the policies where a gap is most likely to lead to avoidable harm, and failures under Regulations 12 and 13 that result in avoidable harm, or expose someone to significant risk of it, can be criminal offences under Regulation 22.
2. Consent, mental capacity and DoLS, and restraint. Regulation 11 is itself an offence provision, and restraint is where good intentions most often become a breach.
3. Complaints, duty of candour and notifications. These are the policies about telling people things, and each has a record CQC can check against what it already knows.
4. Recruitment, training and staffing. The evidence for these is in files and rotas, and the policy must match what the files show.
5. Governance, records and data protection. The policies that make the rest auditable.

Give each policy a named owner, a review date and a line in the audit programme. Then ask the board, owner or trustees to see the review schedule at least once a year, which is the "scrutiny and overall responsibility at board level or equivalent" CQC's Regulation 17 guidance expects.

The policy says one route; the message goes another

Almost every policy on the list describes a route: report a safeguarding concern to the manager, record a complaint in the log, escalate a medicines error to the nurse in charge, tell the family after an incident. In most homes the first step on that route is now a message. A carer sends a photo of a pressure sore to the senior's personal phone. A daughter raises a complaint by text to the key worker. The night team's handover lives in a staff group chat. The manager approves an agency shift by WhatsApp on a Sunday.

Those messages are the first record of the event each policy governs, and they are held on personal phones that the home does not control. A policy can say that everything must be recorded in the care system, and it should, but the gap between the first message and the entry is where the detail, the timing and sometimes the whole event is lost. Our personal phone policy guide covers what a staff policy should say about that.

ComplyChat provides a channel for those work conversations. A mobile number verified by SMS is the identity, so bank and agency staff and families with no work account can be in it; everyone added is told the channel is on the record and can object or leave; and messages are recorded on the server as they are sent. On paid plans the lasting record files into the home's own Microsoft 365 once the tenant is connected, under its own retention rules. It does not replace the care planning system, it does not do rostering or medicines, and it is not a policy library; it gives the first message on each policy's route somewhere the home holds.

A question for the next managers' or board meeting: for the five policies that matter most, where does the first report actually arrive, and is that route written into the policy?

Official guidance and your next step

The primary sources are the 2014 Regulations and CQC's guidance on each of them in regulations for service providers and managers; CQC's plain-English list of the fundamental standards; NICE's Managing medicines in care homes; the Health and Safety Executive's guidance on writing a health and safety policy; and, for safeguarding, your local Safeguarding Adults Board's procedures. Quotations are from those pages as published on 25 September 2026. This guide is for care homes in England; Wales, Scotland and Northern Ireland have their own regulators and standards.

It is a practical starting point, not legal advice, and not a substitute for policies written for your own service.

Then do one thing: print the list of policies your home holds, write the regulation each one serves beside it, and add the date it was last reviewed. Any policy without a regulation may not be needed; any regulation without a policy is a gap; any review date more than a year old is the next job.