CQC notifications

The duty, and where it comes from

Statutory notifications are the changes, events and incidents a registered person must report to the Care Quality Commission (CQC). CQC's own summary is one sentence: "Registered providers must notify us about certain changes, events and incidents that affect their service or the people who use it." The notification requirements sit in the Care Quality Commission (Registration) Regulations 2009, made under the Health and Social Care Act 2008, and it attaches to the carrying on of a regulated activity: a care home, a domiciliary care agency, a supported living service, a hospice, a GP practice, a dental practice, an NHS trust. Six regulations do the work. Regulation 12 covers the statement of purpose, Regulation 14 the absence of a registered manager or provider, Regulation 15 changes to the registration, Regulation 16 the death of a service user, Regulation 17 the death or unauthorised absence of a person detained under the Mental Health Act 1983, and Regulation 18, the widest, "notification of other incidents". Regulation 22A says notifications must be made in the form CQC publishes.

The person who must notify is the registered person. CQC's guidance for providers spells it out: registered persons are "organisations, partnerships or individuals registered to provide regulated activities" and "any managers the provider employs who are registered for the regulated activity". A registered manager can delegate the task of submitting a notification to a deputy or an administrator, "but you are still responsible and accountable for making sure notifications are submitted correctly". Delegation needs to be written down, and the person doing the submitting needs to know which events are notifiable and which are not.

The consequence of not notifying is stated just as plainly. CQC's guidance says: "It is an offence not to notify us when a relevant change, event or incident has happened." For Regulation 18 in particular CQC's regulation guidance adds that it "can prosecute for a breach of this regulation or a breach of part of the regulation", which means it "can move directly to prosecution without first serving a warning notice", and CQC must refuse registration to a provider that cannot satisfy it that it can and will comply. Providers must notify CQC whether or not anyone else has been told, and in practice a missed notification is more often found by an inspector than prosecuted, and what it then tells the inspector is the subject of the second half of this guide.

CQC uses notifications to know what is happening to people who use services, to identify issues of concern, to decide whether regulatory action is needed and to monitor trends across health and care. A notification is not an admission of fault. A well-run service notifies more, not less, because it recognises more of what it sees.

What must be notified: the events and incidents

CQC publishes the complete list of statutory notifications with a form and a page for each, and the CQC website is the only place to take the current form from. Grouped by regulation, the events and incidents are these.

Death of a person using the service (Regulation 16). The registered person "must notify the Commission without delay of the death of a service user" where the death occurred while services were being provided in the carrying on of a regulated activity, or "has, or may have, resulted from" it. For a care home that means every death of a resident, expected or not; for a domiciliary care agency it means a death during or arising from a visit. The notification "must include a description of the circumstances of the death". NHS bodies and providers of primary medical services have a narrower test: deaths that cannot reasonably be attributed to the natural course of the person's illness, and these can be reported to NHS England instead.

Death or unauthorised absence of a detained patient (Regulation 17). A person detained, or liable to be detained, under the Mental Health Act 1983. This is the one notification in which the person must be identified by name and date of birth, because the coroner needs to be able to link it; every other notification uses a code, not a name.

Regulation 18 notifications: the "other incidents". The registered person "must notify the Commission without delay of the incidents specified" where they occur while services are being provided or as a consequence of them. The list in Regulation 18(2) is:

• Serious injury to a service user: any injury which, "in the reasonable opinion of a health care professional", has resulted in an impairment of the sensory, motor or intellectual functions of the service user which is not likely to be temporary; changes to the structure of a service user's body; prolonged pain or prolonged psychological harm; or the shortening of life expectancy. Also any injury which, in that professional opinion, "requires treatment by that, or another, health care professional" to prevent death or one of those outcomes. A fracture is a change to the structure of the body and is notifiable. A bruise that heals is not; a head injury sent to A&E for treatment is.
• Any abuse or allegation of abuse in relation to a service user, whether the alleged abuser is a member of staff, another person using the service, a relative or a stranger, and whether or not you believe the allegation.
• Any incident which is reported to, or investigated by, the police. A missing resident whom the police were called to find is notifiable on this ground even though the unauthorised-absence form applies only to detained patients.
• Any event which prevents, or appears likely to threaten to prevent, the provider's ability to carry on the regulated activity safely or in accordance with the registration requirements; CQC's form calls these events that stop a service running safely and properly. The regulation names four: an insufficient number of suitably qualified, skilled and experienced persons; an interruption to electricity, gas, water or sewerage "for longer than a continuous period of 24 hours"; physical damage to premises with a detrimental effect on treatment or care; and the failure of fire alarms or other safety devices for longer than a continuous period of 24 hours. CQC's form page adds the plain version: you must notify if you cannot meet people's assessed needs safely, for example because of staff absence or damage to premises.
• The outcome of an application to deprive a person of their liberty, under the Deprivation of Liberty Safeguards or to the Court of Protection, including an application made by someone else such as the local authority, and including a withdrawn application. CQC's page is explicit: "Do not tell us you are making an application. Only tell us about outcomes or withdrawn applications."
• Any placement of a person under 18 in an adult psychiatric unit for longer than a continuous period of 48 hours.

Regulation 18(5) defines two of the words the list turns on. "Abuse", in relation to a service user, means "sexual abuse, physical or psychological ill-treatment, theft, misuse or misappropriation of money or property, or neglect and acts of omission which cause harm or place at risk of harm"; a missing twenty-pound note and a missed hoist check are both inside it. "Health care professional" means a person registered with one of the statutory health regulators, so the reasonable opinion that decides whether an injury is serious is a GP's, a nurse's or a paramedic's, not the senior carer's, and the record should say whose it was. The regulation does not define "prolonged" or "not likely to be temporary". The duty of candour regulation does define prolonged pain and prolonged psychological harm, as harm which a service user has experienced, or is likely to experience, "for a continuous period of at least 28 days", and most providers apply the same 28-day yardstick to Regulation 18, treating an impairment as not temporary where it is likely to last beyond that, and notifying where in doubt. Serious injuries are the notification most often under-reported, because the definition is read as "serious" in the everyday sense rather than in these terms.

Two things are often assumed to be on this list and are not. A safeguarding referral to the local authority does not discharge the CQC notification; they are separate duties to separate bodies, and CQC's own question page answers "does reporting to the local authority or NHS England cover it?" with a no for everyone except the NHS bodies described below. And a complaint, a medication error without harm, or a fall without injury is not in itself notifiable, though each belongs in your own record, which is the subject of the next section but one.

What must be notified: absences and changes

The second group of notifications is about the registration itself rather than about people using the service, and it is where established services most often slip, because nothing dramatic has happened.

Absence of a registered person for 28 days or more (Regulation 14). Where the registered manager, or a provider who is in day-to-day charge, "proposes to be absent from carrying on or managing the regulated activity for a continuous period of 28 days or more", the registered person must give CQC written notice. Except in an emergency the notice must be given "no later than 28 days before the proposed absence commences", and it must state the length of the absence, the reason, the arrangements for managing the service meanwhile, the name, address and qualifications of the person who will be responsible, and, for a manager's absence, the arrangements for appointing a replacement and the proposed date. Where the absence arises from an emergency, notice must be given "within 5 working days of its occurrence". A manager who has already been away 28 days without notice must be notified forthwith, and the return to duty must be notified "not later than 7 working days after the date of that return". Long-term sickness, maternity leave and a sabbatical are all absences; so is a resignation with a gap before the next registered manager.

Changes to the registration (Regulation 15). The registered person must give notice in writing "as soon as it is reasonably practicable" if any of the following takes place or is proposed: a person other than the registered person carries on or manages the activity; a registered person ceases to carry on or manage it; an individual registered person changes their name; the membership of a partnership changes; a body changes its name or address, a director, secretary or similar officer, or its nominated individual; or a trustee in bankruptcy, receiver, manager or liquidator is appointed. CQC's list breaks these out into separate forms: change of contact details, change of an individual's name, nominated individuals, officers and directors, provider's name and address, insolvency, and a provider stopping regulated activities.

Changes to the statement of purpose (Regulation 12). The statement of purpose is a registration document, and a revision to it, such as a change to the regulated activities, the service types, the people the service is for or the places it operates from, must be sent to CQC in writing "within 28 days of any such revision" (Regulation 12(3)). The statement of purpose is also the document an inspector reads to see what you say you do, so a service that has quietly started taking people with dementia when its statement says otherwise has a notification to make and a statement to revise.

Death of a registered provider (Regulation 21) where the provider is an individual, and a liquidator's or trustee's plans for a service, complete the list. Fees are Regulation 19 and are not a notification.

How quickly, how, and who is exempt

The timescale depends on the notification, and CQC states it on each notification's page. Deaths, detained-patient deaths and absences, and every Regulation 18 incident must be notified "without delay". CQC's form pages translate that as "as soon as possible", and the working assumption in a well-run service is the same day, or the next working morning for something that happened overnight. Regulation 15 changes are "as soon as it is reasonably practicable". A planned absence is 28 days in advance, an emergency absence within five working days, a return within seven working days, and a revised statement of purpose within 28 days. Nothing in the regulations allows a notification to wait for the end of an internal investigation; the notification describes what is known, and more can follow under the same reference.

There is a specific form for each notification. CQC's guidance is emphatic: "You must use our forms to make a notification" and "you must use the latest version from this website", because the forms are updated often and an out-of-date or incomplete form is returned. Most notifications can now be submitted through the CQC provider portal, which "automatically gives a reference number to each form you submit"; the rest are Word forms emailed to CQC, acknowledged by email with a reference. The acknowledgement may carry an ENQ number, a notification ID or a case ID, and any of them identifies the notification. Keep it: it is the proof that the notification was made and the handle for any further information.

Notifications about a person are anonymised. CQC asks providers to use "a unique identifier or code" rather than the person's name, date of birth, NHS number or room number, in line with data protection law, and to keep the key to that code safely. The exception is the death of a detained patient, for the coroner's sake. The same discipline belongs in your own incident record: a code in the record, a key held separately.

NHS trusts and NHS Blood and Transplant may report four kinds of incident, serious injuries, abuse and allegations of abuse, events that stop a service running safely and properly, and deaths, through the Learn from Patient Safety Events service to NHS England (the National Health Service Commissioning Board, in the words the regulations still use), which forwards them to CQC under an information-sharing agreement; every other notification they must send to CQC directly. Primary medical services may report deaths the same way. For everyone else, a care home, a home care agency, a supported living provider, a hospice, the notification goes to CQC and nowhere else counts, however many other bodies were told.

The record behind every notification, and behind every decision not to

Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires every provider to "maintain securely an accurate, complete and contemporaneous record in respect of each service user", and our CQC record-keeping guide covers that duty as a whole. The notification duties sit on top of it. For every notifiable event the inspector will expect to find, in your own records, the incident itself recorded at the time; the decision that it was notifiable, by whom and when; the notification reference; and what was done afterwards. For every event that was considered and judged not notifiable, the inspector will expect the same record minus the reference, and a reason.

That second category, the incidents that affect people but do not meet the notification criteria, is where the real discipline lies. Most incidents in a care service are not notifiable: the fall with no injury, the medication given late, the argument between two residents that came to nothing. Each of them is still recorded under Regulation 17, and each carries an implicit decision that Regulation 18 was not engaged. When the decision was right, the record shows it. When it was wrong, the record shows the service noticed the event and misjudged it, which is a training matter. When there is no record at all, the inspector cannot tell the difference between a service that judged correctly and one that never looked, and will assume the latter.

CQC's own guidance describes what an inspector sees when the accident book and the notification log disagree: an incident in the records that was never notified "raises a question that goes wider than the incident itself: what else is not being reported, and does the manager understand their statutory duties?" That is the question a single missed fracture opens, and it is answered by the pattern in the rest of the record, not by the explanation for the one event.

Keep the duty of candour separate in your mind and together in your file. Regulation 20 of the 2014 Regulations requires the provider to tell the person, or their representative, about a notifiable safety incident, to apologise and to record it; that is a duty owed to the person. The CQC notification is a duty owed to the regulator. A serious injury usually triggers both, they use different definitions, and a good incident record shows each discharged with its own date.

"Do we need to tell CQC about this?" – the decision taken in a chat

Most notification failures do not begin in the portal. They begin in the conversation after the event. The night carer messages the registered manager at three in the morning to say a resident has fallen and seems all right. The manager, half awake, replies "keep an eye on her, we'll see in the morning". The morning handover happens in a staff group chat on personal phones. The GP's opinion arrives in a phone call nobody minutes. The deputy asks "do we need to tell CQC about this?" in a direct message and the answer, "no, she's fine", is a decision under Regulation 18 taken by someone who was not looking at the definition, recorded nowhere the service controls, and then contradicted by the X-ray at four in the afternoon.

Each of those is a decision the record is required to show, and each has instead been taken in a place the provider cannot search. When the inspector asks when the service first knew the injury was serious and who decided it was not notifiable, the honest answer is "it will be in someone's messages".

The fix is not to stop staff messaging the manager at three in the morning; that message is the service working. It is to give the message somewhere to land, so that "resident fell, seems all right, GP called for the morning" is itself the first line of the incident record, and the decision "notifiable, submitted, reference logged" is the last. ComplyChat provides a channel for those work conversations, with everyone in it told that it is on the record, and a mobile number verified by SMS is an identity on it, which matters in a service where bank and agency staff rarely have a work account. On paid plans the lasting record files into the provider's own Microsoft 365 once the archive is connected and filing, so the exchange in which the decision was taken is producible later without a search of personal phones. It is not an incident management system, it does not submit notifications, and it does not decide whether an event meets Regulation 18; the registered manager does. ComplyChat Free is personal messaging with one private group, direct messages and three calendar months of recent history, with no Microsoft 365 archive or Replay; upgrading cannot restore expired history.

A question for the next managers' or board meeting: if an inspector took the last three months of the accident book and asked, for each entry, who decided whether it was notifiable and when, would the answers come from the incident record or from somebody's phone?

Official guidance and your next step

The primary sources are the Care Quality Commission (Registration) Regulations 2009, Regulations 12 to 18 and 21, and CQC's own pages: the list of notifications with a form for each, the notifications guidance for providers, and the guidance on Regulation 18. Quotations in this guide are from those documents as published on 15 September 2026; CQC updates its forms and pages often, so use the current form from the CQC website rather than a saved copy.

This guide is a practical starting point for registered providers and managers in England, not legal advice about an individual incident, a prosecution or a disputed registration. Have the registered manager and the nominated individual review the events list against your own incident policy, and check that whoever is delegated to submit notifications has read the definitions in Regulation 18.

Then do one thing: take the last three months of your accident and incident records and, for each entry, write beside it whether it was notifiable, who decided, and the CQC reference if it was sent. Every entry without an answer is a gap in the record, whatever the right answer would have been.