COSHH risk assessment in care homes

The rule: COSHH regulation 6, and who enforces it

Regulation 6 of the Control of Substances Hazardous to Health Regulations 2002 (COSHH) says an employer “shall not carry out work which is liable to expose any employees to any substance hazardous to health” unless it has “made a suitable and sufficient assessment of the risk created by that work to the health of those employees and of the steps that need to be taken to meet the requirements of these Regulations” and has “implemented the steps” the assessment identifies. The assessment comes before the work, not after the first skin rash.

Regulation 6 has four working parts:

• 6(1), assess first. No work that exposes employees to a hazardous substance until the assessment is made and its steps are in place.
• 6(2), what the assessment considers. Twelve matters: the hazardous properties of the substance; the supplier's information on health effects, “including information contained in any relevant safety data sheet”; the level, type and duration of exposure; the circumstances of the work, including the amount used; activities such as maintenance where exposure could be high; any workplace exposure limit; the effect of the control measures under regulation 7; “the results of relevant health surveillance”; the results of exposure monitoring; the risk of combined exposure to more than one substance; the approved classification of any biological agent; and any other information the employer needs.
• 6(3), review. The assessment “shall be reviewed regularly and forthwith if” there is reason to suspect it is no longer valid, the work has changed significantly, or monitoring shows a review is needed. No fixed interval is set.
• 6(4), the record. “Where the employer employs 5 or more employees, he shall record– (a) the significant findings of the risk assessment as soon as is practicable after the risk assessment is made; and (b) the steps which he has taken to meet the requirements of regulation 7.”

A home with fewer than five employees still has to assess; only the written record is tied to the headcount. HSE's page on how to carry out a COSHH risk assessment adds that “even if you have fewer than 5, it makes sense to write down what steps you have taken to identify the risks.”

Who enforces it. COSHH is health and safety law, not a CQC regulation, and in a care home without nursing HSE is usually not the enforcer either. HSE's publication page for HSG220 Health and safety in care homes says that at the time of publication (June 2014): “Under the Enforcing Authority Regulations, HSE regulates homes with nursing and local authority owned or run care homes. Other homes are regulated by local authorities.” HSE's current page on whether HSE is the correct enforcing authority lists “hospitals and nursing homes” as HSE's and tells care homes to contact the “local authority environmental health department”. The Health and Safety (Enforcing Authority) Regulations 1998, Schedule 1 allocates “the provision of permanent or temporary residential accommodation” to local authorities. So a privately or voluntarily run care home without nursing will usually deal with the council's environmental health officers on COSHH; a nursing home, or a home the council itself runs, deals with HSE. CQC's interest is the resident, through Regulation 12 (section 04).

COSHH 2002 extends to England, Wales and Scotland. Northern Ireland has its own Control of Substances Hazardous to Health Regulations (Northern Ireland) 2003, enforced there by HSENI and district councils, so guidance from HSENI is not a source for a home in Great Britain, and the reverse holds too.

What counts as a hazardous substance in a care home

HSE's HSG220 Health and safety in care homes (second edition, 2014) gives the care home list at paragraph 8.1: “Hazardous substances found in care homes include drugs and medicines, cleaning materials, disinfectants and maintenance products containing chemicals (eg pesticides). Infections and diseases can be caused by micro-organisms (eg those associated with soiled laundry or exposure to body fluids).”

The legal definition is in COSHH regulation 2. A “substance hazardous to health” includes a substance or mixture that meets the criteria for any health hazard class under the CLP Regulation, whether or not it is classified under it; one with a workplace exposure limit approved by HSE; a biological agent, meaning a micro-organism, cell culture or human endoparasite “which may cause infection, allergy, toxicity or otherwise create a hazard to human health”; dust of the kinds the regulation sets out; and anything else that, because of its properties and the way it is used, “creates a risk to health”. HSE's assessment page puts it simply: “Remember that health hazards are not limited to substances labelled as 'hazardous'.”

Walk a typical home and the list writes itself:

• Housekeeping and cleaning products: bleach, toilet cleaner, descaler, oven cleaner, surface sprays and disinfectants, including the products agency and night staff use.
• Laundry: detergents and the micro-organisms on soiled linen, which are biological agents.
• Clinical and personal care: body fluids, clinical waste and the medicines staff handle. A carer crushing tablets or applying a cream is exposed; regulation 5 excludes only the risk to the resident receiving the treatment (below).
• Kitchen: dishwasher chemicals, and caustic descalers and oven cleaners, which HSG220 paragraph 8.5 says “may require heavy-duty gloves, goggles or face shields and a well-ventilated area while the products are being used”.
• Maintenance and grounds: paints, adhesives, pesticides and the dust from sanding or drilling.
• Wet work and gloves: frequent handwashing and glove wear are skin hazards in their own right, and latex is a sensitiser (section 05).

How to do a COSHH risk assessment, step by step

HSE's guidance on the steps needed to manage risk says of risk assessment: “You can do it yourself or appoint a competent person to help you.” In a care home that is usually the registered manager, a deputy or the head of housekeeping, with the people who actually use each product in the room. A workable order:

1. List the substances and the processes. Go room by room: sluice, laundry, kitchen, housekeeping store, clinical room, hairdressing room, maintenance store and garden shed. Include the processes that create a hazard with no bottle attached, such as handling soiled linen or emptying commodes. HSE: “Identify which substances are harmful by reading the product labels and safety data sheets (SDS). If in doubt, contact your supplier.”
2. Decide who might be harmed, and how. HSE asks “whether the substance can be breathed in, get onto or through the skin or can even be swallowed”. Name the groups: housekeepers, laundry staff, care staff, kitchen staff, the maintenance person, night staff who clean alone, and “maintenance workers, contractors and other visitors or members of the public who could be exposed”.
3. Evaluate the risk and choose controls in the legal order. COSHH regulation 7 says exposure must be “either prevented or, where this is not reasonably practicable, adequately controlled”, and, in preventing it, “substitution shall by preference be undertaken”: replacing the substance with one that “either eliminates or reduces the risk”. HSE starts with elimination: “Do you really need to use a particular substance, or is a safer alternative available?” Where exposure cannot be prevented, control follows an order of priority: (a) appropriate work processes, systems and engineering controls and suitable equipment; (b) control at source, “including adequate ventilation systems and appropriate organisational measures”; and (c) personal protective equipment “where adequate control of exposure cannot be achieved by other means”, in addition to (a) and (b). PPE is the last resort, not the first control. HSE: “Do not automatically opt for personal protective equipment (PPE) as a control measure. It is not as reliable or effective as other measures.”
4. Match the control to the product. HSG220 paragraph 8.5: “Toilet cleaning chemicals may only require the use of rubber gloves, whereas caustic descalers and oven cleaners may require heavy-duty gloves, goggles or face shields and a well-ventilated area while the products are being used. Many of the risks for hazardous substances used in a care home can be grouped together when considering suitable control measures.” Grouping similar products is allowed; what the law requires is that the assessment is suitable and sufficient, not one sheet per bottle.
5. Plan storage, handling and waste. Regulation 7(4)(a) requires “arrangements for the safe handling, storage and transport of substances hazardous to health, and of waste containing such substances”. HSG220's checklist asks: “Are hazardous substances safely stored, eg locked in a cupboard and out of reach of vulnerable adults?” A product decanted into an unlabelled spray bottle loses the label information the assessment relied on.
6. Tell and train the staff who use them. COSHH regulation 12 requires “suitable and sufficient information, instruction and training”, including “the significant findings of the risk assessment”. HSG220 paragraph 8.6 spells out the content: “how to use and store the product safely, how to clear up spillages, and how to check and wear protective equipment correctly.” The care home training matrix guide covers recording who has had it.
7. Record, then review. Write down the significant findings and the regulation 7 steps if you have five or more employees (section 05), and set the triggers that will reopen the assessment.

Two HSE cautions belong at the top of any care home's COSHH file. “Do not rely purely on paperwork as your main priority should be to control the risks in practice.” And for products that come in with someone else: “Contractors in your workplace also need to know what the risks are and how you are controlling them. In addition, you need to know if they are bringing hazardous substances onto your premises, and how they will prevent harm to your workers.” For control advice on common tasks, HSE's COSHH essentials publishes “straightforward advice in 'factsheets' called 'control guidance sheets'”.

Residents, visitors and contractors: who regulates which harm

The assessment duty in regulation 6 is owed to employees. COSHH regulation 3(1) extends the employer's duties, “so far as is reasonably practicable”, to “any other person, whether at work or not, who may be affected by the work carried out by the employer”, with two limits: the duties “under regulation 11 (health surveillance) shall not extend to persons who are not his employees”, and monitoring, information and training and the accident duties extend to them only while they are on the premises. HSG220 paragraph 8.2 puts the care home reading plainly: “You must assess the health risk to your staff, residents and visitors”.

In practice the resident question is mostly storage and supervision. A resident living with dementia may not recognise a bottle of descaler as dangerous, a trolley left in a corridor is within reach, and a sluice door propped open defeats a locked cupboard. The assessment should say how products are kept away from residents while they are in use, not only when they are stored.

When a resident is harmed, the investigating regulator in England is usually CQC. HSE's HSG220 page notes that “from 1st April 2015 the Care Quality Commission (CQC) in England became the lead investigator of incidents where residents have been harmed because of unsafe or poor quality care”, and HSE's page on who regulates health and social care says: “Where those regulators have patient or service user safety within their remit, and have powers to secure justice, we will not, in general, investigate or take action.” HSG220 itself is dated 2014 and predates that change, so read its enforcement passages with the publication page.

For staff, visitors and contractors, HSE or the council stays the lead, “irrespective of registration”, under the CQC–HSE memorandum of understanding (March 2024). Its examples of incidents where CQC may take the lead include unsecured storage of cleaning chemicals, which “may be an issue under the Control of Substances Hazardous to Health Regulations but the greater risk of harm may be to vulnerable patients/service users”.

CQC's hook is Regulation 12 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, which requires “ensuring that the premises used by the service provider are safe to use for their intended purpose and are used in a safe way” (12(2)(d)) and “assessing the risk of, and preventing, detecting and controlling the spread of, infections, including those that are health care associated” (12(2)(h)). CQC's guidance on Regulation 12 says providers “should have systems and processes that assure compliance with statutory requirements, national guidance and safety alerts”, so a COSHH file that is out of date is a Regulation 12 question as well as a COSHH one. The CQC Regulation 12 guide covers the offence and the evidence.

In Wales and Scotland, COSHH applies in the same way; the care regulators are Care Inspectorate Wales and the Care Inspectorate, and CQC's Regulation 12 does not apply.

The COSHH record, reviews and health checks

There is no official COSHH assessment form. The law fixes the content, not the layout: under regulation 6(4) the record holds the significant findings and the steps taken under regulation 7. A record that maps onto regulation 6(2) usually has these columns:

• Product or process, and where it is used.
• Hazard, from the label and safety data sheet, with any workplace exposure limit.
• Who is exposed, how (inhalation, skin or eye contact, ingestion), at what level and for how long.
• Controls in place, in the regulation 7 order, ending with the PPE required.
• Storage, spillage and disposal arrangements.
• Further action needed, by whom and by when.
• Occupational health checks needed under regulation 11, if any.
• Date assessed, assessor, and the date and reason for each review.

HSE's risk pages also offer a general risk assessment template and examples. A supplier's safety data sheet is an input to the assessment, not the assessment itself.

How often to review. The regulations set no fixed period: regulation 6(3) says “regularly”, and “forthwith” on a trigger. An annual review is a sensible house rule, but it is house practice, not law, and it does not replace the triggers. HSE adds: “Also consider a review if your workers have spotted any problems or there have been any accidents or near misses.” HSE also says: “You must review the controls you have put in place to make sure they are working.” In a care home, the common triggers are a new or substituted product introduced by a supplier, a new laundry or cleaning process, a building change that affects ventilation, a staff member's skin or breathing complaint, and an incident or near miss.

Health checks and wet work. HSE's page on dermatitis in health and social care says “Contact dermatitis is the most common form of work-related skin disease suffered by nurses and other health and social care professionals”, and gives a rule of thumb for when the higher level of health checks is needed: “a worker is at risk of developing occupational contact dermatitis, if they wash their hands more than 20 times a day”. HSG220 paragraph 8.8 gives the same guideline. HSE adds that “Health surveillance programmes must include keeping a health record for each individual”, and COSHH regulation 11(3) requires that record to be kept “for at least 40 years from the date of the last entry made in it”. The 40 years applies to the health records, not to the COSHH assessment itself; the guide to how long to keep employee records sets it beside the other periods.

Gloves and latex. HSE's page on latex allergies in health and social care says employers “must be able to demonstrate they have carried out an assessment to select which (if any) type of gloves they should provide”, and it reports the 2008 guidelines from the NHS Plus Occupational Health Clinical Effectiveness Unit and the Royal College of Physicians, whose recommendations are that “Powdered latex gloves should therefore not be used in the workplace” and that employees with a latex allergy “should use non-latex gloves”. Where the assessment does choose latex, HSG220 paragraph 8.11 says “single-use latex gloves should be low-protein and powder-free”. Glove choice is part of the COSHH record, not a purchasing detail.

When it becomes reportable. Under RIDDOR 2013 regulation 8, a diagnosis of “occupational dermatitis, where the person's work involves significant or regular exposure to a known skin sensitizer or irritant” or “occupational asthma, where the person's work involves significant or regular exposure to a known respiratory sensitizer” is reportable. The RIDDOR in care homes guide covers who reports, how and when.

Where the review trigger usually arrives

The COSHH file is written in the office. The reason to reopen it rarely arrives there. A carer messages the night senior that the new descaler burnt her hands. Someone posts a photo of an unlocked sluice cupboard to the staff group. The housekeeper texts the manager that the supplier sent a different product this week. An agency worker mentions on her first shift that she cannot wear latex.

Each of those can be a regulation 6(3) trigger: a “reason to suspect that the risk assessment is no longer valid”, a “significant change in the work”, or, in HSE's words, a sign that “your workers have spotted any problems”. If a skin condition is later diagnosed, or an inspector or environmental health officer asks why the assessment was not reviewed, the first question is when the home first knew. When the answer sits in a consumer app on personal phones, the home may not be able to produce it, and it can leave with whoever leaves.

ComplyChat provides channels for those work conversations, with everyone added told that the channel is on the record, and a mobile number verified by SMS as the identity, so housekeeping, kitchen, bank and agency staff with no work account can be in the same channel as the manager. Messages are recorded on the server as they are sent, and on paid plans, once the home's Microsoft 365 tenant is connected, conversations are kept there, under the retention schedules the home already runs. ComplyChat does not do risk assessments, hold safety data sheets or run occupational health checks; the COSHH file stays where it is.

A question for the next management meeting: for the last change to one of your COSHH assessments, could you show what prompted it and the date you first heard?

Questions people ask

What is COSHH in care homes?

COSHH is the Control of Substances Hazardous to Health Regulations 2002, which require a care home employer to assess, then prevent or adequately control, staff exposure to hazardous substances. HSE's HSG220 says those include “drugs and medicines, cleaning materials, disinfectants and maintenance products”, and micro-organisms from soiled laundry or body fluids.

Can I do a risk assessment myself?

Yes. HSE says: “You can do it yourself or appoint a competent person to help you”, and its care home guidance says COSHH assessments “should be relatively simple in a care home”. The legal duty stays with the employer whoever does the work.

Who must complete a COSHH risk assessment?

The employer. Regulation 6(1) says an employer “shall not carry out work which is liable to expose any employees to any substance hazardous to health” until it has made “a suitable and sufficient assessment”. The task can be given to a competent person, such as a deputy or head of housekeeping; the duty cannot.

Can you provide an example of a COSHH assessment form?

There is no prescribed form. With five or more employees, regulation 6(4) requires a record of “the significant findings of the risk assessment” and “the steps which he has taken to meet the requirements of regulation 7”. The columns in section 05 – product, hazard, who is exposed and how, controls, storage, further action, health checks and review dates – cover what regulation 6(2) asks the assessment to consider.

How often should a COSHH assessment be reviewed?

The regulations set no fixed interval. Regulation 6(3) says the assessment “shall be reviewed regularly and forthwith” if it may no longer be valid, the work has changed significantly or monitoring shows a need; a new product, a new laundry process or a staff skin reaction are all triggers.

Who enforces COSHH in a care home?

It depends on the home. HSE's HSG220 page says that at its publication in June 2014: “Under the Enforcing Authority Regulations, HSE regulates homes with nursing and local authority owned or run care homes. Other homes are regulated by local authorities.” HSE's current enforcing authority page still lists nursing homes as HSE's and sends care homes to the local authority environmental health department. When a resident in England is harmed because of unsafe or poor quality care, CQC has usually been the lead investigator since 1 April 2015.

Official guidance and your next step

The primary source is the Control of Substances Hazardous to Health Regulations 2002, regulation 6 on legislation.gov.uk, with regulations 2, 3, 5, 7, 11 and 12. HSE's HSG220 Health and safety in care homes (2014; read its enforcement passages with its publication page), How to carry out a COSHH risk assessment, the steps needed to manage risk, COSHH essentials, Dermatitis in health and social care and Latex allergies in health and social care are the practical guidance. On who enforces, see HSE's enforcing authority page, Who regulates health and social care, the CQC–HSE memorandum of understanding (March 2024) and the Health and Safety (Enforcing Authority) Regulations 1998, Schedule 1; on reporting, RIDDOR 2013 regulation 8. For residents in England, read Regulation 12 of the 2014 Regulations and CQC's guidance on Regulation 12. Quotations are from those pages as published on 29 and 30 October 2026.

This guide covers care homes in Great Britain, with the CQC material for England only, and is not legal advice. Your local authority's environmental health service, or HSE for a home with nursing or one the council runs, is the enforcer to ask about a particular product or process.

Then do one thing: take your three most-used cleaning products, find the current safety data sheet for each, and check that the product named in your COSHH record is the one actually on the trolley today. Where it is not, that assessment is due for review now.