Care home safeguarding policy

The rule: Regulation 13 and section 42

Two legal frameworks shape a care home’s safeguarding procedures, with different duties for the provider and the local authority. The first is Regulation 13 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, a condition of registration. “Service users must be protected from abuse and improper treatment”; “systems and processes must be established and operated effectively to prevent abuse of service users”; and “systems and processes must be established and operated effectively to investigate, immediately upon becoming aware of, any allegation or evidence of such abuse”. Care must not be provided in a way that discriminates, that “includes acts intended to control or restrain a service user that are not necessary … or not a proportionate response”, that “is degrading” or that “significantly disregards the needs of the service user”, and “a service user must not be deprived of their liberty for the purpose of receiving care or treatment without lawful authority”. The regulation defines abuse as sexual offences, “ill-treatment (whether of a physical or psychological nature)”, “theft, misuse or misappropriation of money or property” and “neglect”.

CQC’s guidance on Regulation 13 says what the policy has to achieve: providers “must have a zero tolerance approach to abuse, unlawful discrimination and restraint”, “must have robust procedures and processes to prevent people using the service from being abused by staff or other people they may have contact with when using the service, including visitors”, and “where any form of abuse is suspected, occurs, is discovered, or reported by a third party, the provider must take appropriate action without delay”, including “investigation and/or referral to the appropriate body”. Safeguarding “must have the right level of scrutiny and oversight, with overall responsibility held at board level or equivalent”. CQC can prosecute a breach of 13(1) to 13(4) that results in avoidable harm or significant risk of harm, without first serving a warning notice.

The second is section 42 of the Care Act 2014, which places the duty to make enquiries on the local authority, and chapter 14 of the Care and Support Statutory Guidance, which explains how providers fit into it. The duties apply to an adult who “has needs for care and support (whether or not the local authority is meeting any of those needs)”, “is experiencing, or at risk of, abuse or neglect”, and “as a result of those care and support needs is unable to protect themselves” (paragraph 14.2) – all three conditions must be considered in the individual case; living in a care home does not by itself establish that they are met. Paragraph 14.7 gives the definition the policy should open with: “Safeguarding means protecting an adult’s right to live in safety, free from abuse and neglect.”

What the policy has to contain: the statutory list

Chapter 14 tells providers what their internal guidelines must cover, and a policy that follows the list cannot go far wrong. Paragraph 14.231: “Provider agencies should produce for their staff a set of internal guidelines which relate clearly to the multiagency policy and which set out the responsibilities of all staff to operate within it. These should include guidance on:”

• “identifying adults who are particularly at risk”
• “recognising risk from different sources and in different situations and recognising abusive or neglectful behaviour from other service users, colleagues, and family members”
• “routes for making a referral and channels of communication within and beyond the agency”
• “organisational and individual responsibilities for whistleblowing”
• “assurances of protection for whistle blowers”
• “working within best practice as specified in contracts”
• “working within and co-operating with regulatory mechanisms”
• “working within agreed operational guidelines to maintain best practice in relation to: challenging or distressing behaviour; personal and intimate care; control and restraint; gender identity and sexual orientation; medication; handling of people’s money; risk assessment and management”

Paragraph 14.232 adds the clause about staff: “Internal guidelines should also explain the rights of staff and how employers will respond where abuse is alleged against them within either a criminal or disciplinary context.” The policy therefore has two audiences – the adult at risk it protects and the member of staff it may one day be used against – and it should be fair to both. It also needs the local names: safeguarding in a care home runs through the local authority’s safeguarding adults team and the safeguarding adults board’s multi-agency procedures, and the policy states the referral route, the out-of-hours number and the home’s designated safeguarding lead and deputy, so that care staff can report abuse or neglect without looking anything up. (Care homes in Wales follow Care Inspectorate Wales and the Social Services and Well-being (Wales) Act 2014 instead; this guide is for England.)

The policy also carries the framework the whole sector shares. The six principles of paragraph 14.13, which “apply to all sectors and settings including care and support services”: empowerment, prevention, proportionality, protection, partnership and accountability, each with its “I” statement (“I am asked what I want as the outcomes from the safeguarding process and these directly inform what happens”). Making safeguarding personal (paragraph 14.15): “person-led and outcome-focused”, engaging the person “in a conversation about how best to respond to their safeguarding situation”. And the ten types of abuse and neglect in paragraph 14.17: physical, domestic, sexual, psychological, financial or material, modern slavery, discriminatory, organisational, neglect and acts of omission, and self-neglect, with the reminder in paragraph 14.18 that “professionals and others should look beyond single incidents or individuals to identify patterns of harm”.

The provider acts first: the duty most policies understate

A care home’s policy often reads as if safeguarding were something the local authority does. The statutory guidance says the opposite. Paragraph 14.68: “It is important that all partners are clear where responsibility lies where abuse or neglect is carried out by employees or in a regulated setting, such as a care home, hospital, or college. The first responsibility to act must be with the employing organisation as provider of the service.” Paragraph 14.69: “When an employer is aware of abuse or neglect in their organisation, then they are under a duty to correct this and protect the adult from harm as soon as possible and inform the local authority, CQC and CCG where the latter is the commissioner.” The local authority “may well be reassured by the employer’s response so that no further action is required”, but it must satisfy itself that the response was sufficient, and if not, undertake its own enquiry. The guidance retains the historic term CCG; use the current NHS commissioning contact, usually the integrated care board where it commissions the service.

That shapes the procedure section, which is where care staff, managers and staff on call need the roles and responsibilities set out plainly: who may report a safeguarding concern (anyone – care home staff, care home residents, families, visiting professionals), who decides, and who refers. Local authorities run the section 42 enquiry; the home runs everything before and around it. On a concern the home does, in order: make the person safe now; preserve evidence and do not question the alleged perpetrator; tell the registered manager or the person on call; refer concerns promptly under local procedures, seeking advice where the threshold is uncertain; the local authority determines whether its section 42 enquiry duty is engaged; tell the police where a crime may have been committed; notify CQC under Regulation 18 of the Care Quality Commission (Registration) Regulations 2009 (“allegations of abuse” is one of the listed notifications); start the response required by Regulation 13(3) immediately, coordinating any internal enquiries with the local authority and police so evidence and external investigations are not compromised; support the resident and their family; and support the staff member, who has rights under the disciplinary procedure and the ACAS Code. Paragraph 14.200 makes the recording duty explicit: “Where the source of abuse or neglect is a member of staff it is for the employer to take immediate action and record what they have done and why.”

Then the end of the process. Paragraph 14.75: where someone is dismissed or moved out of regulated activity following a safeguarding incident, or leaves to avoid a hearing the employer believes would have led to dismissal, “the regulated activity provider has a legal duty to refer to the Disclosure and Barring Service”. That duty, under the Safeguarding Vulnerable Groups Act 2006, sits with the provider and not the local authority, and a policy that does not mention it has left the provider exposed at the point where its own judgment matters most.

What CQC looks for: the safeguarding quality statement

Under the single assessment framework CQC assesses safeguarding against a quality statement in the safe key question, written as a commitment the provider makes: “We work with people to understand what being safe means to them as well as with our partners on the best way to achieve this. We concentrate on improving people’s lives while protecting their right to live in safety, free from bullying, harassment, abuse, discrimination, avoidable harm and neglect. We make sure we share concerns quickly and appropriately.” CQC says the statement means “there is a strong understanding of safeguarding and how to take appropriate action”, that “people are supported to understand safeguarding, what being safe means to them, and how to raise concerns”, and that “there are effective systems, processes and practices to make sure people are protected from abuse and neglect”. The statement covers mental capacity and human rights as subtopics and lists Regulations 10, 11, 12 and 13 as the regulations behind it, with 9, 17 and 20 to consider.

Inspectors gather evidence under six categories – people’s experience, feedback from staff and leaders, feedback from partners, observation, processes and outcomes – so the policy is tested by what residents say about feeling safe, what staff say when asked what they would do, what the local authority says about the home’s referrals, what inspectors see, and what the records show. CQC’s Regulation 13 guidance sets the process expectations: staff “must receive safeguarding training that is relevant, and at a suitable level for their role” at induction and updated “at appropriate intervals”; “information about current procedures and guidance about raising concerns about abuse should be accessible to people who use the service, advocates, those lawfully acting on their behalf, those close to them and staff”; providers “should use incidents and complaints to identify potential abuse”; and “providers and staff must know and understand the local safeguarding policy and procedures, and the actions they need to take in response to suspicions and allegations of abuse, no matter who raises the concern or who the alleged abuser may be”.

So the policy needs a training section (levels, frequency, records), a section on the local arrangements (the safeguarding adults board’s procedures, the referral route and its out-of-hours number), a named safeguarding lead and deputy with board-level oversight, a section on the Mental Capacity Act and Deprivation of Liberty Safeguards (capacity is decision-specific, and staff should support the resident to express their wishes and participate; a best-interests decision is needed only where the person lacks capacity for the particular decision), a section on restraint that meets 13(4)(b) and 13(7), the whistleblowing and “freedom to speak up” route, and a section on what residents and families are told. It also has to say how the home learns: 13(3) requires providers to “respond without delay to the findings of any investigations” and, where allegations are substantiated, to “take action to redress the abuse and take the necessary steps to ensure the abuse is not repeated”.

Recording: the safeguarding log and what goes in it

Every concern, whether or not it is referred, is recorded, and the record is what the local authority, CQC and, later, a safeguarding adults review will read. Regulation 17 requires an accurate, complete and contemporaneous record of care “and of decisions taken”, and paragraph 14.200 requires the employer to “record what they have done and why”. A safeguarding log entry that meets both:

1. The date and time the concern was received, from whom and how; the resident concerned; the alleged source of harm.
2. The concern in the words it was raised in, kept apart from the home’s view of it.
3. The immediate actions taken to make the person safe, with times.
4. The decision on the section 42 criteria and the referral made or not made, with the reason; the reference number from the local authority.
5. Notifications: CQC (with the notification reference), the police, the commissioner, the family or attorney, and when each was told.
6. The internal investigation: who led it, who was spoken to, what was found, and the outcome for the staff member, including any DBS referral.
7. The resident’s wishes and outcomes, in their words or those of their advocate, and how they were met.
8. The learning: what changed in practice, training or the policy, and the date the board or equivalent reviewed the case.

The log is reviewed as a whole, not only case by case, because paragraph 14.18 asks providers to “look beyond single incidents or individuals to identify patterns of harm”: the same shift, the same unit, the same member of staff, the same family visitor. A monthly review of the log at the home’s governance meeting, minuted, is the simplest evidence that the provider looks for patterns, and it is what “overall responsibility held at board level or equivalent” means in practice.

The concern that is first raised in a message

Every safeguarding policy describes a concern about the risk of abuse arriving through a route: a carer tells the senior, the senior tells the manager, the manager decides and refers. Following procedures is what the six safeguarding principles and the training assume. Now look at how concerns arrive in a real home. A carer on a night shift thinks a colleague was rough with a resident and messages a friend on the day staff: “did you see how he was with room 8?” A relative sends the unit lead a WhatsApp about bruising she noticed on Sunday. A senior who cannot reach the on-call manager sends a text and gets “keep an eye, we’ll talk tomorrow”. The deputy who is uneasy about a pattern raises it in the managers’ group chat. Each of those is a safeguarding concern being raised, and each is the first record of it.

None of them is in the safeguarding log until someone writes it up, and the write-up is what the home can produce when the local authority asks when the concern was first raised, what exactly was said, and what the on-call manager decided at eleven at night. Paragraph 14.200 requires the employer to record “what they have done and why”; the decision and the reason are on a personal phone, in an app the home cannot open, and the home cannot search a member of staff’s personal chat without the questions the ICO’s guidance on personal devices raises. The pattern paragraph 14.18 asks the home to look for – three carers each with the same nagging doubt, shared with each other and never with the manager – is invisible to a log that only holds what was formally referred.

Use a restricted reporting route, with access limited to the people who need the information. A recorded message is not proof that someone has read or acted on a concern: follow the safeguarding procedure, contact the responsible person directly when action is urgent, and use the local authority or emergency route when required. Add the relevant information and decisions promptly to the formal safeguarding record.

Use the service’s escalation procedure for urgent care or safeguarding concerns; do not wait for a message to be read. Clinical decisions need the appropriate professional input. Record the outcome in the care or safeguarding system, with access to the conversation limited to those who need it.

The policy cannot move the doubt off the phone; that is where staff think and talk. It can move the raising of it onto a channel the home runs, where the manager or the safeguarding lead is in the conversation from the first message, where everyone in the channel has been told it is on the record, and where the concern, the reply and the decision are the record rather than a reconstruction of it. The question for the registered manager and the board is whether the home’s safeguarding policy names such a channel, or whether it assumes that concerns arrive by a route nobody actually uses at night.

Official guidance and your next step

The primary sources are Regulation 13 and CQC’s guidance on it; section 42 of the Care Act 2014 and chapter 14 of the Care and Support Statutory Guidance (paragraphs 14.2, 14.7, 14.13 to 14.18, 14.68 to 14.75, 14.200 and 14.231 to 14.232); CQC’s safeguarding quality statement; the Care Quality Commission (Registration) Regulations 2009 (Regulation 18, notifications); the Safeguarding Vulnerable Groups Act 2006 and the DBS’s referral guidance; and the Mental Capacity Act 2005 Code of Practice. The local safeguarding adults board publishes the multi-agency procedures the policy must relate to.

This guide is a summary of published guidance for England, not a substitute for it and not legal advice. Services in Wales, Scotland and Northern Ireland are regulated under different frameworks; providers of children’s services follow Working Together to Safeguard Children as well.

Then do one thing: ask three members of staff, on different shifts, what they did the last time they were worried about a colleague’s conduct and who they told first. If the honest answer is “a friend on the team, by message”, the policy’s reporting route is not the one in use.