Duty of candour

The duty: Regulation 20 of the 2014 Regulations

The statutory duty of candour is Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, one of the fundamental standards. Regulation 20(1) is the general duty: "Registered persons must act in an open and transparent way with relevant persons in relation to care and treatment provided to service users in carrying on a regulated activity." The rest of the regulation sets out what must happen when a particular kind of incident, a notifiable safety incident, occurs.

CQC's guidance on Regulation 20 describes it as "a general duty to be open and transparent with people receiving care from you" and says plainly that "it applies to every health and social care provider that CQC regulates". Its background page explains the history: the Francis Inquiry into Mid Staffordshire recommended a statutory duty for all health and care providers, and it "was brought into law in 2014 for NHS Trusts and 2015 for all other providers". The duty falls on the registered person, meaning the registered provider and the registered manager; where there is no registered manager, as in an NHS trust, CQC says "responsibility sits with the leaders of the organisation".

There are two duties of candour, and they sit side by side. The statutory duty binds the organisation and is regulated by CQC. The professional duties of candour bind individual healthcare professionals and are overseen by their own regulators, such as the General Medical Council, the Nursing and Midwifery Council and the General Dental Council. The regulators made a joint statement on the professional duty in October 2014, and the GMC and NMC publish joint guidance, Openness and honesty when things go wrong, which covers being open and honest with patients when something goes wrong and within organisations when reporting adverse incidents or near misses. CQC warns that where something is a notifiable safety incident, "carrying out the professional duty alone will not be enough to meet the requirements of the statutory duty". A nurse who apologises at the bedside has done the right thing; the organisation still has steps to take and a record to keep.

Two points of law shape everything else. Apologising is not admitting fault: CQC says "The presence or absence of fault on the part of a provider has no impact on whether or not something is defined as a notifiable safety incident. Saying sorry is not admitting fault." And the core steps are enforceable as a criminal matter. Under Regulation 22(1) it is an offence to fail to comply with Regulation 20(2)(a) and (3), the notification and what it must contain, and CQC says Regulation 20 "allows us to move directly to criminal enforcement action" without first serving a warning notice.

What counts as a notifiable safety incident

CQC's guidance reduces the definition to three questions, and all three must be answered yes. The incident "must have been unintended or unexpected"; it "must have occurred during the provision of an activity we regulate"; and "in the reasonable opinion of a healthcare professional", it "already has, or might, result in death, or severe or moderate harm to the person receiving care". If any answer is no, it is not a notifiable safety incident, but the general duty to be open still applies.

The harm threshold is where NHS trusts and everyone else part company. For a health service body, which for this purpose means an NHS trust or NHS foundation trust, Regulation 20(8) catches "any unintended or unexpected incident" that could result in, or appears to have resulted in, death relating directly to the incident, or "severe harm, moderate harm or prolonged psychological harm". For every other registered person, including care homes, home care, GP practices, dentists and independent hospitals, Regulation 20(9) catches an incident that appears to have resulted in, or requires treatment to prevent:

• the death of the person, where the death relates directly to the incident rather than to the natural course of their illness or condition
• an impairment of sensory, motor or intellectual functions which has lasted, or is likely to last, for a continuous period of at least 28 days
• changes to the structure of the person's body
• prolonged pain or prolonged psychological harm, each meaning a continuous period of at least 28 days
• the shortening of the person's life expectancy

The definitions in Regulation 20(7) apply to both. Moderate harm is "harm that requires a moderate increase in treatment" and "significant, but not permanent, harm". A moderate increase in treatment means "an unplanned return to surgery, an unplanned re-admission, a prolonged episode of care, extra time in hospital or as an outpatient, cancelling of treatment, or transfer to another treatment area (such as intensive care)". Severe harm is a permanent lessening of bodily, sensory, motor, physiologic or intellectual functions related directly to the incident. CQC notes that the care provider thresholds match its own notification system for deaths and serious injuries, so a Regulation 18 serious injury in a care home will very often be a notifiable safety incident as well.

CQC's guidance settles several questions that come up again and again:

• Unexpected refers to the incident, not the outcome. If care went as intended and a known risk materialised, it may not qualify, though a known complication is not automatically excluded; the professionals involved must judge whether anything unexpected or unintended happened.
• No staff need to be present. An unwitnessed fall in a care home happened during the accommodation part of the regulated activity, so "provided the harm thresholds are met, this could qualify".
• Near misses are out of scope. The words "could result in" are there for harm that appears later, not to bring near misses in.
• Consent does not exclude it. An incident can qualify even where the person consented to the procedure.
• Found later still counts. An incident discovered through a retrospective case review or a patient recall is still covered.
• Another provider's incident should be passed to that provider, which must carry out the steps; you must still be open with the person about what you found.

CQC's worked examples include a care home resident whose occupational therapist had advised that he should not use the bath until grab rails were fitted; "the manager failed to update the man's care plan or inform the care staff of this change", he slipped getting out of the bath and broke his arm, and all three answers were yes. Another is a child with an unknown latex allergy who needed hospital treatment for anaphylaxis after a dental check-up: no fault at all, and the incident still qualified.

The steps, in order

Regulation 20(2) requires the registered person to act "as soon as reasonably practicable after becoming aware that a notifiable safety incident has occurred". CQC adds that it "will always expect to see providers acting promptly". The steps are:

1. Tell the relevant person, in person. The notification "must be given in person by one or more representatives" of the registered person. The relevant person is the service user or, where they have died, are under 16 and not competent, or are 16 or over and lack capacity, a person lawfully acting on their behalf.
2. Give a true account of "all the facts the registered person knows about the incident as at the date of the notification". Candour is about what is known now; it does not wait for the investigation to finish.
3. Explain what further enquiries the provider believes are appropriate.
4. Apologise. The regulation defines an apology as "an expression of sorrow or regret in respect of a notifiable safety incident". CQC's advice is that "simple straightforward expressions of sorrow and regret can and should be made" from the start, even while an investigation is under way.
5. Record the conversation in "a written record which is kept securely".
6. Follow up in writing, giving or sending the relevant person the account, the details of the enquiries, the results of those enquiries, and a written apology.
7. Keep copies of all correspondence with the relevant person, as Regulation 20(6) requires.

Throughout, the provider must give "reasonable support" to the relevant person. CQC's examples include an interpreter, information in accessible formats, an advocate, adjustments for a disability, signposting to mental health services, and pointing people to independent help such as Action against Medical Accidents or Cruse Bereavement Care. With the person's consent, CQC expects family members and carers to be involved.

If the relevant person cannot be contacted in person, or declines to speak to the provider, Regulation 20(5) says the notification steps do not apply, but "a written record is to be kept of attempts to contact or to speak to the relevant person". CQC adds that the incident must still be reported through the appropriate notification system and investigated. A family who does not want a meeting has not ended the provider's duty to record.

The written record, and how CQC checks it

Regulation 20 asks for three kinds of record: the written record of the in-person notification, the written follow-up and all later correspondence, and, where contact fails, the record of every attempt. CQC also says providers "must keep your own clear records of cases where you have responded to notifiable safety incidents", which in practice means a candour log alongside the incident log, showing for each incident whether it was judged notifiable, by whom, on whose clinical opinion, and when each step happened.

The same incident usually engages other duties, and the records should agree with each other. A notifiable safety incident in a care home is often a Regulation 18 notification to CQC, and CQC's death notification form asks directly whether the death was a notifiable safety incident and whether the relevant person has been told. In the NHS it will usually also be recorded through NHS England's Learn from Patient Safety Events service, and CQC notes that the NHS Standard Contract carries its own requirement for candour. Our incident reporting guide and CQC notifications guide cover those routes.

CQC's page on how it regulates the duty lists what inspectors do. They follow up notifications marked as triggering the duty, and those not marked "but appear from the descriptions and harm levels to have required it"; ask providers about recent incidents; ask people who experienced an incident how the provider responded; question frontline staff about their understanding of the duty; question the registered person about policies, recording and training; and look at senior staff's and board members' understanding and "how they ensure staff feel supported to speak up". CQC also points out that a provider can be open and transparent under Regulation 20(1) and still breach the specific requirements, because Regulation 20(2) is exact about the steps, the timing and the records.

Candour in the NHS, in care, and across the UK

For NHS organisations, the statutory duty sits inside a larger set of patient safety expectations: national incident reporting, the NHS England Patient Safety Incident Response Framework, the contractual requirement for candour in the NHS Standard Contract, and the professional duty on every clinician. Families who want to discuss what happened outside the formal process can also go to the trust's Patient Advice and Liaison Service. The risk in a trust is less that candour is forgotten than that it becomes a letter template, which CQC's consultation evidence warns against: people said cover-ups "and a lack of apology compounded the level of harm", and valued a "heartfelt apology" and a provider that was "honest from the outset".

For a care provider the risk runs the other way. The registered manager is often the only person who knows the regulation exists, the professional duty applies only to the registered nurses on the team, and the incident happens at night with bank staff on shift. CQC expects to see at registration that the registered person "understands their obligations under Regulation 20" and has "training, policies and systems in place" so that employees can carry it out. In a small home or agency that means three concrete things: staff who recognise an incident that might qualify and escalate it the same day; a named person who decides, with a health care professional's opinion recorded; and a template for the letter that is used rather than filed.

The regulation described here applies in England. Wales has its own organisational duty of candour for NHS bodies under the Health and Social Care (Quality and Engagement) (Wales) Act 2020, in force since April 2023, and Scotland has an organisational duty of candour procedure under the Health (Tobacco, Nicotine etc. and Care) (Scotland) Act 2016. Their definitions and steps differ from Regulation 20, so providers working across borders need each one's guidance.

The English duty is also under review. The Department of Health and Social Care ran a call for evidence in 2024 and published its findings on 26 November 2024, ahead of a final response. Respondents commonly said some incidents are not recorded, or are recorded inaccurately, because of uncertainty about the definition or "an unwillingness to accept that a notifiable safety incident has occurred". Check for changes before relying on the detail here.

The first candid conversation is often a message

Regulation 20 imagines a meeting in a quiet room. The first conversation after an incident rarely happens there. A daughter texts the key worker whose number she has: "Mum sounded confused on the phone, is everything all right?" The key worker replies from her own phone at the end of the shift. The nurse in charge messages the manager to ask whether to ring the family tonight or wait for the GP. In a staff group chat, someone writes "don't say anything to the family until the manager's seen it", which is exactly the instinct the duty was written to end.

Each of those messages is part of the provider's communication with the relevant person, or part of the decision about whether and when to have it. Regulation 20 requires a written record of the notification, copies of all correspondence, and a record of every attempt to make contact. A reply sent from a personal phone is correspondence the provider cannot produce, and a family keeps its own messages. When the candour process is later questioned, the provider is relying on staff, some of whom may have left, to hand over what they said.

ComplyChat provides a channel for those work conversations, including with families who have no account on your systems: a mobile number verified by SMS is the identity, everyone added is told the channel is on the record, and messages are recorded on the server as they are sent. On paid plans the lasting record files into the provider's own Microsoft 365 once the tenant is connected, under the provider's retention rules. It does not decide whether an incident is notifiable, it does not write the letter, and the in-person conversation Regulation 20 requires cannot be replaced by a message; it gives the conversations around it somewhere the provider holds.

A question for the next governance or board meeting: for the last notifiable safety incident, could you produce every communication with the relevant person, including the first text from the family and the reply to it?

Official guidance and your next step

The primary source is Regulation 20 itself, with Regulation 22 on offences. CQC's duty of candour guidance has pages on notifiable safety incidents, what you must do and worked examples, and it is the best short training material available. For clinicians, read the GMC and NMC joint guidance on the professional duty. Quotations are from those pages as published on 25 September 2026.

This guide is a practical summary for providers in England, not legal advice about a particular incident, claim or prosecution. Where an incident may lead to a claim, involve your insurer or legal adviser, and do not let that delay the apology the regulation requires.

Then do one thing: take your incident log for the last six months and mark each entry that met, or might have met, the harm threshold. For each one, find the written record of the in-person conversation and the follow-up letter. Any incident with a threshold decision but no record is the gap an inspector will find.