Incident reporting in care homes

Five duties, five bodies, one incident

"Incident reporting" in a care home is not one duty but five, owed to five different bodies, and the phrase covers all of them at once. The first is owed to nobody but yourselves: the internal record. Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires the registered person to "maintain securely an accurate, complete and contemporaneous record in respect of each service user, including a record of the care and treatment provided to the service user and of decisions taken in relation to the care and treatment provided", and the Care Quality Commission's (CQC's) guidance on Regulation 12 says how that applies to incidents: they "must be reported internally and to relevant external authorities/bodies. They must be reviewed and thoroughly investigated by competent staff, and monitored to make sure that action is taken to remedy the situation, prevent further occurrences and make sure that improvements are made as a result." The same guidance adds the sentence that defines the scope: "Incidents include those that have potential for harm." A near miss is an incident, and the purpose CQC gives for recording it is to improve safety, not to allocate blame.

The regulatory framework for the other four is outward-facing, and each is owed to a different body. Certain incidents must be notified to CQC under the Care Quality Commission (Registration) Regulations 2009, principally Regulation 16 (deaths) and Regulation 18 (serious injury, abuse, police involvement, events that stop the service, DoLS outcomes). Certain accidents must be reported to the Health and Safety Executive (HSE), or the local authority as enforcing authority, under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013, RIDDOR. Where an adult with care and support needs is experiencing or at risk of abuse or neglect and cannot protect themselves, the local authority's safeguarding duty under section 42 of the Care Act 2014 is engaged and the provider's duty under Regulation 13 is to act "without delay", including "referral to the appropriate body". And where the incident is a notifiable safety incident within the meaning of Regulation 20, the duty of candour requires the registered person to tell the person or their representative, apologise, explain and follow up in writing.

Beyond those five, a death is reported to the coroner where the circumstances require it, a crime to the police, and most local authority and NHS contracts require the commissioner to be told of serious incidents involving the people they fund. None of these discharges any other. CQC's own question page answers "does reporting to the local authority cover the CQC notification?" with a no, and HSE says the reporting requirements of other regulators "are separate to and distinct from the legal duty to report incidents under RIDDOR". The rest of this guide takes them in turn: the internal record in section 02, CQC in 03, RIDDOR in 04, safeguarding and candour in 05.

The one thing they have in common is that each turns on a decision the service must take, and take quickly, and each decision is a record in its own right. A service that notifies, reports and refers correctly but cannot show who decided, on what information and when, has met four duties and failed the first.

What counts as an incident, and the record every one needs

There is no statutory list of what a care home must treat as an incident; there is a statutory duty to record the care and treatment provided and the decisions taken, and CQC's expectation that anything with potential for harm is reviewed and investigated. In practice the incident categories a care home's or nursing home's own policy should name, and that other care providers will recognise, are falls, whether or not injured; medication errors, including omissions and late administration; pressure damage discovered or deteriorating; choking and aspiration; incidents between residents, and behaviour that challenges; a resident absent without explanation; a safeguarding concern or allegation, whoever it is about; equipment failure or misuse, including hoists, bed rails, slings and call bells; injuries to staff, visitors and contractors; fire, flood, power and heating failures; and near misses in any of those categories. The accident book required of employers under the Social Security (Claims and Payments) Regulations 1979 records injuries to employees; it is not an incident record for residents, and a home that uses it as one has a residents' record in a book that must, under data protection, be kept so that one entry cannot be read from another.

Whatever the category, the record needs the same elements, and they are the elements every external report will ask for.

1. When and where. Date, time and place of the incident, and the date and time it was discovered if different. HSE's RIDDOR record requires "the date, time and place of the event"; CQC's notification forms ask the same.
2. Who. The person or people affected, by the code your records use rather than by name in the incident log; the staff on duty; who found or witnessed it; who was told and when.
3. What happened. A factual account in the words of the person who found it, written at the time, including what the person says happened if they can say. Not a conclusion: "found on the floor beside the bed, bed rails down, call bell on the floor" rather than "fell out of bed".
4. Injury and treatment. What was observed, who examined the person, the professional opinion if a GP, nurse or paramedic gave one, and whether the person was taken to hospital and by what means. The CQC serious injury test and the RIDDOR test both turn on this line.
5. Immediate action. First aid, the 999 call, the observations started, the equipment taken out of use, the room made safe.
6. The decisions. For each of the four outward duties, whether it applies, who decided, when, and the reference if a report was sent. For each that does not apply, the reason in one line.
7. Follow-up. The care plan and risk assessment reviewed, the family told, the staff debriefed, the learning shared, the audit trend updated.

CQC's Regulation 12 guidance says the staff involved "should receive information about" incidents "and this should be shared with others to promote learning", and that the outcomes of investigations "must be shared with the person concerned and, where relevant, their families, carers and advocates". Regulation 17 guidance lists "action plans in response to risk and incidents" among the management records a provider must keep. An incident that is recorded, investigated and closed with no change to the care plan or the risk assessment is, in the inspector's reading, an incident that was recorded and nothing else.

All of this belongs in one written policy, and the policy is what an inspector reads first at inspection and what a new member of staff is inducted on. A care home's incident reporting policy should specify the categories the service treats as incidents, including near misses; the form or reporting system staff use and the time within which the first entry must be made; who is told on each shift and how the manager is reached out of hours; the role with responsibility for each of the four outward reports, with a named deputy; the review step, by whom and within what time; how the person and their family are told; how learning is shared with staff; and the governance loop, usually a monthly analysis of incident trends by category, time of the incident, location and person, reported to the provider. A documentary review of 25 safety incident reporting policies from 23 English care home organisations, published in 2026, found that every policy set out a post-incident review and most (80%) post-incident learning, but that only 14 of the 25 mentioned the duty of candour, 19 relied on paper reporting systems, six were off-the-shelf documents, and just one incorporated the resident's own perspective. The policy is not the record, but a policy that does not say who decides is the reason the record has blanks in it. Check yours against the latest inspection report for your own service type: what the inspector asked for last time is what they will ask for again.

When the incident must be notified to CQC

Our CQC notifications guide covers the 2009 Registration Regulations in full, including absences and changes of registration; this section is the incident half. The registered person must notify CQC "without delay" of the death of a service user under Regulation 16, and under Regulation 18 of any of the following where it occurs while services are being provided or as a consequence of them: a serious injury; any abuse or allegation of abuse in relation to a service user; any incident reported to or investigated by the police; any event which prevents or threatens to prevent the service from being carried on safely, including a utility interruption of more than 24 continuous hours, physical damage to the premises and the failure of fire alarms or other safety devices for more than 24 hours; the outcome of any application to deprive a person of their liberty; and the placement of a person under 18 in an adult psychiatric unit for more than 48 hours.

"Serious injury" has a definition and it is not the everyday one. It is an injury which, "in the reasonable opinion of a health care professional", has resulted in an impairment of sensory, motor or intellectual function that is not likely to be temporary, a change to the structure of the body, prolonged pain or prolonged psychological harm, or a shortened life expectancy, or which requires treatment by a health care professional to prevent one of those. A fracture is a change to the structure of the body and is notifiable. A head injury sent to A&E for treatment is notifiable. A bruise that heals is not. "Health care professional" means a person registered with a statutory health regulator, so the opinion that decides the question is a GP's, a nurse's or a paramedic's, and the record should say whose.

Three incidents that are commonly assumed to be notifiable are not, on their own: a fall with no injury, a medication error without harm, and a complaint. Each belongs in the internal record and each carries an implicit Regulation 18 decision that should be written down. And three things that are commonly assumed to discharge the notification do not: a safeguarding referral to the local authority, a RIDDOR report, and telling the commissioner. CQC's guidance is direct: "It is an offence not to notify us when a relevant change, event or incident has happened." Notifications are made on CQC's forms through its provider portal; the registered manager may delegate the submitting but remains "responsible and accountable for making sure notifications are submitted correctly".

When the accident must be reported to the HSE under RIDDOR

RIDDOR is health and safety law, not care regulation, and its test is different from CQC's. HSE's information sheet for the sector, Reporting injuries, diseases and dangerous occurrences in health and social care (HSIS1), is the document to keep. RIDDOR requires the "responsible person", usually the employer, to report deaths, specified injuries to workers, certain occupational diseases and dangerous occurrences that "arise out of or in connection with work", which HSE explains means "incidents where the work activity, equipment or environment (including how work is carried out, organised or supervised) contributed in some way to the circumstances of the accident".

For residents and visitors, people not at work, an injury must be reported if it results from an accident arising out of or in connection with work being undertaken by others and "results in them being taken from the premises where the accident occurred directly to a hospital for treatment, by whatever means (for example by taxi, private car or ambulance)"; HSE adds that "examinations and diagnostic tests do not constitute 'treatment'". The work connection is the part care homes get wrong in both directions. HSE's own examples for falls: reportable where "a service user falls in the lounge area, there is previous history of fall incidents, but reasonably practicable measures to reduce the risks have not been put in place", where a resident falls out of bed and "the assessment identified the need for bedrails but they, or other preventative measures, had not been provided", where a resident "trips over a loose or damaged carpet in the hallway", or where a resident "requires hospital treatment after sliding through a sling after being hoisted from a chair. The wrong-sized sling was used." Not reportable where a resident "falls and breaks a leg. They were identified as not requiring special supervision or falls prevention equipment. There are no slips or trips obstructions or defects in the premises or environment, nor any other contributory factors." HSE's advice is to consult the care plan: "You may need to consult the patient's/service user's care plan to decide what care was assessed as being appropriate for them." Suicide and deliberate self-harm "are not considered 'accidents' and are not RIDDOR reportable", and nor is an injury to a resident "by an act of physical violence from another patient".

For staff, a specified injury (a fracture other than to fingers, thumbs or toes, an amputation, a loss of consciousness from a head injury, a burn over ten per cent of the body, among others), an absence from work or inability to do normal duties for more than seven consecutive days, and a diagnosed occupational disease are reportable; an injury that keeps a worker off for more than three days must be recorded but not reported, and the accident book entry is enough. Non-consensual violence to a worker that causes a specified or over-seven-day injury is reportable. A sharps injury is reportable as a dangerous occurrence only where the sharp is known to be contaminated with a blood-borne virus. Work-related stress is not reportable.

Dangerous occurrences are reportable whether or not anyone is hurt; HSE's example is "a patient hoist collapses or overturns but the patient in the hoist is not injured". Deaths of any person, at work or not, are reportable if caused by an accident arising out of or in connection with work.

The clocks: a death, specified injury or dangerous occurrence must be notified "without delay" and reported within ten days; an over-seven-day injury within fifteen days. Reports go through HSE's online reporting system, under the industry "Government administrative functions, Education, Health" and, for a care home, the main activity "Residential care activities" with the sub-activity "Residential nursing care" or "Elderly, disabled", never "Accommodation"; HSE estimates that thirty per cent of the health and social care sector's RIDDOR reports are coded wrongly. The record of every reportable event must be kept for three years and must include "the date and method of reporting". "Failure to report a reportable injury, dangerous occurrence, or disease, in accordance with the requirements of RIDDOR, is a criminal offence", and, in HSE's words too, "reporting an incident is not an admission of liability".

Safeguarding and the duty of candour: the two the incident also triggers

Safeguarding. Regulation 13(3) requires that "systems and processes must be established and operated effectively to investigate, immediately upon becoming aware of, any allegation or evidence of" abuse, and CQC's guidance says that where abuse "is suspected, occurs, is discovered, or reported by a third party, the provider must take appropriate action without delay", including "investigation and/or referral to the appropriate body". The appropriate body is the local authority, whose duty under section 42 of the Care Act 2014 is to make or cause enquiries where an adult with needs for care and support is experiencing or at risk of abuse or neglect and is unable to protect themselves. CQC also says providers "should use incidents and complaints to identify potential abuse": a pattern of unexplained bruising, repeated medication omissions for one person, or money that keeps going missing is a safeguarding matter arrived at through the incident log. Our safeguarding guide covers the referral and the record behind it. A safeguarding allegation is also a Regulation 18 notification to CQC in its own right.

The duty of candour. Regulation 20 applies to every incident in the general sense, as "a general duty to be open and transparent with people receiving care from you", so transparency about every incident is the baseline and the specific steps sit on top of it, and imposes specific steps for a notifiable safety incident, which CQC defines by a three-part test: "it must have been unintended or unexpected"; "it must have occurred during the provision of an activity we regulate"; and, "in the reasonable opinion of a healthcare professional", it "already has, or might, result in death, or severe or moderate harm". For a care home the harm threshold is Regulation 20(9): death directly due to the incident, a sensory, motor or intellectual impairment lasting or likely to last at least 28 days, changes to the structure of the body, prolonged pain or prolonged psychological harm (each meaning a continuous period of at least 28 days), or a shorter life expectancy, or an injury that requires treatment to prevent one of those. CQC's own care home example is exact: an occupational therapist advised grab rails and morning washes instead of baths, "the manager failed to update the man's care plan or inform the care staff of this change", the man slipped getting out of the bath and broke his arm, and all three answers were yes.

CQC lists the steps the regulation requires: "Tell the relevant person, face-to-face, that a notifiable safety incident has taken place. Apologise. Provide a true account of what happened, explaining whatever you know at that point. Explain to the relevant person what further enquiries or investigations you believe to be appropriate. Follow up by providing this information, and the apology, in writing, and providing an update on any enquiries. Keep a secure written record of all meetings and communications with the relevant person." It must begin "as soon as reasonably practicable". "The presence or absence of fault on the part of a provider has no impact on whether or not something is defined as a notifiable safety incident. Saying sorry is not admitting fault." Failing to take the notification and written follow-up steps is an offence under Regulation 22(1).

Five duties, then, and one incident. The card shows what a single record looks like when every one of them has been decided.

"Found on the floor, seems all right" – the first report is a message

Every one of the five decisions above turns on what was known, by whom, and when, and in most care homes the first report of an incident is not a form. It is a message. The night carer messages the nurse in charge at ten to three: "R-14 on the floor, seems ok, helping her up". The nurse replies from another floor: "check her over, I'll be up". At seven the day senior asks in the staff group whether anyone knows why the rails were not fitted, and the maintenance person replies that the request is on his list. The deputy asks the manager by text whether it is a RIDDOR, and the manager, driving in, replies "don't think so, she wasn't pushed". The daughter is told by WhatsApp. Later, a hip fracture is confirmed, and every question an inspector, an HSE officer or a safeguarding enquiry will ask, from what time she was found to when the service knew the rails were outstanding, is answered in messages on personal phones.

HSE's own test makes this concrete: whether the fall was reportable depends on what the care plan said and whether it was acted on, and CQC's care home example of a notifiable safety incident was a manager who "failed to update the man's care plan or inform the care staff". The informing is the record. When it happened in a chat the service cannot search, on an app that cannot produce it, the service has done the informing and cannot show it, and the difference between "we told the night staff" and "we can show we told the night staff" is the difference between a defence and an assertion.

The fix is not to stop the night carer messaging; that message is the incident being reported, and it is the best first line of the record the service will get. It is to give the message somewhere to land, so that "R-14 on the floor, seems ok" at 02:50 is itself the first entry, the nurse's reply is the review, and "RIDDOR – yes, reported, reference logged" is the last. ComplyChat provides a channel for those work conversations, with everyone in it told that it is on the record, and a mobile number verified by SMS is an identity on it, which matters at night and at weekends when the people reporting are bank and agency staff with no work account. On paid plans the lasting record files into the provider's own Microsoft 365 once the archive is connected and filing, so the exchange in which each decision was taken is producible later without a search of anyone's phone. It is not an incident management system, it does not submit CQC notifications or RIDDOR reports, and it does not decide whether an event meets any of the five tests; the registered manager does. ComplyChat Free is personal messaging with one private group, direct messages and three calendar months of recent history, with no Microsoft 365 archive or Replay; upgrading cannot restore expired history.

A question for the next managers' meeting: take the last serious fall. For each of the five duties, can the service show who decided, on what information, at what time – from the incident record, or only from somebody's phone?

Official guidance and your next step

The primary sources are CQC's guidance on Regulation 12, Regulation 13, Regulation 17 and Regulation 20, its list of statutory notifications, HSE's RIDDOR in health and social care page and the HSIS1 information sheet, and section 42 of the Care Act 2014. Quotations in this guide are from those documents as published on 16 September 2026; CQC and HSE update their pages and forms, so use the current versions rather than a saved copy.

This guide is a practical starting point for registered managers and providers in England, not legal advice about an individual incident, a prosecution or a safeguarding enquiry. Where an incident has caused serious harm, take advice before the investigation closes, and check the local authority's own safeguarding procedures, which set the referral route and timescales for your area.

Then do one thing: take the last twenty entries in your incident record and, beside each, write which of the five duties applied, who decided and when, and the reference if a report went out. Every entry with a blank beside it is a decision the service took and cannot show.