CQC Regulation 13: Safeguarding Service Users From Abuse and Improper Treatment

Every registered manager knows the phrase "safeguarding is everyone's business." Regulation 13 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 is the legal backbone behind that phrase. It is the fundamental standard the Care Quality Commission uses to judge whether a care home genuinely protects the people living there from abuse, neglect, discrimination and improper treatment — and it is one of the few regulations CQC can, and does, prosecute providers for breaching without issuing a warning notice first.

For registered managers and senior care staff, understanding Regulation 13 in detail is not an academic exercise. It shapes recruitment decisions, staffing rotas, restraint policy, how incidents are recorded, and how quickly concerns are escalated. This article sets out what the regulation actually requires, how CQC assesses it during inspection, what happens when providers get it wrong, and the practical systems a home needs to demonstrate compliance.

What Regulation 13 legally requires

Regulation 13 sits within the CQC's fundamental standards — the baseline every registered provider must meet, below which care must never fall. According to CQC's own guidance, the regulation requires providers to have "systems and processes in place to prevent abuse of service users" and to take a zero-tolerance approach to abuse, unlawful discrimination and restraint.

Regulation 13(4) is the operative clause most inspectors focus on. It prohibits care or treatment that:

• Discriminates against a service user on the basis of a protected characteristic under the Equality Act 2010 (age, disability, gender reassignment, pregnancy and maternity, race, religion or belief, sex, or sexual orientation)
• Uses restraint that is unnecessary or disproportionate to the risk of harm
• Is degrading for the service user — for example, leaving someone in soiled clothing or bedding, or speaking to them in a way that humiliates or ridicules them
• Significantly disregards the service user's assessed needs relating to their care or treatment

The regulation defines abuse broadly, covering sexual offences under the Sexual Offences Act 2003, physical or psychological ill-treatment, theft, misuse or misappropriation of money or property, and neglect. "Improper treatment" extends this further to cover unlawful restraint and inappropriate deprivation of liberty, which is why Regulation 13 sits so closely alongside Mental Capacity Act and Deprivation of Liberty Safeguards (DoLS) obligations.

Restraint, deprivation of liberty and DoLS

Where restraint is used — physical, mechanical or chemical — Regulation 13 requires it to be absolutely necessary, proportionate to the risk of harm, used for no longer than needed, and used in line with current legislation and guidance. Blanket restrictions applied "for everyone's safety" without an individual risk assessment are a common inspection finding that breaches this standard.

The regulation is explicit that a service user must not be deprived of their liberty for the purpose of receiving care or treatment without lawful authority. In practice, that means any restriction amounting to a deprivation of liberty — locked doors, constant supervision, sedation used to manage behaviour — must be authorised through the DoLS process, or the wider Liberty Protection Safeguards framework once in force, with mental capacity properly assessed and recorded first. Getting staff competent in this area is one of the most common gaps CQC identifies, and it is worth reviewing your home's approach against current Mental Capacity Act and DoLS training requirements rather than assuming existing training covers it.

How CQC assesses Regulation 13 on inspection

Under the single assessment framework, safeguarding sits within the "Safe" key question, and inspectors gather evidence against specific quality statements rather than ticking off the regulation in isolation. They will look for evidence that staff know how to recognise and report different types of abuse, that safeguarding concerns are raised promptly with the local authority and, where relevant, the police, that recruitment checks (including DBS and reference checks) are robust, and that lessons from past incidents are visibly fed back into practice.

Inspectors will also test whether a home's culture supports raising concerns — asking staff directly whether they would feel safe whistleblowing, and checking that safeguarding policies are not just filed away but actively used. A home with a well-written policy and no evidence of staff applying it in practice will still fail this standard.

When Regulation 13 fails: a real enforcement case

CQC's enforcement powers under Regulation 13 are not theoretical. In one of the most significant care sector prosecutions on record, Hillgreen Care Limited was fined £300,000 plus £141,000 in costs at Highbury Corner Magistrates' Court after CQC prosecuted the provider for failing to protect residents at its Colne Road home in Enfield. A resident with a known history of sexual offending was not given the one-to-one supervision his care plan required — at the time of the incident, just two staff were supervising six residents — and he sexually assaulted another resident who was non-verbal, autistic and had limited mental capacity to consent. The court found a "woefully inadequate system of care" despite management being aware of the risk, and CQC subsequently cancelled the service's registration (CQC press release, "Hillgreen Care Limited fined £300,000 — for not monitoring 'sexual predator'").

The case illustrates the pattern CQC pursues under Regulation 13: a known, documented risk; a system (staffing, supervision, monitoring) that was not adequate to manage that risk; and avoidable harm as a result. It is also a reminder that being open and honest with residents, families and regulators when something goes wrong is a separate legal duty in its own right — see our explainer on Duty of Candour under CQC Regulation 20 for how the two obligations interact when a safeguarding incident occurs.

Regulation 13 and the Care Act 2014

Regulation 13 does not operate in isolation. Under Section 42 of the Care Act 2014, the local authority has a statutory duty to make (or cause to be made) safeguarding enquiries whenever it has reasonable cause to suspect that an adult in its area has needs for care and support, is experiencing or at risk of abuse or neglect, and is unable to protect themselves against that abuse or neglect (or the risk of it) because of those needs. Every registered manager should understand this duty runs alongside, not instead of, CQC's own regulatory role: a Section 42 enquiry addresses the individual's protection and the local Safeguarding Adults Board process, while CQC's Regulation 13 powers address whether the provider's systems allowed the harm to happen in the first place. Providers are expected to notify CQC of safeguarding incidents through statutory notifications — a process our guide to CQC statutory notifications and what to report covers step by step, and getting this wrong (late, incomplete or missing notifications) is itself treated as an aggravating factor in enforcement decisions.

Building a Regulation 13-compliant safeguarding system

Meeting Regulation 13 in a way that survives inspection scrutiny means treating safeguarding as a live operational system, not a policy document. In practice, that means:

• Robust recruitment — enhanced DBS checks, verified references covering the full employment history, and safe recruitment interviews that probe attitudes to power and vulnerability, not just competence.
• Mandatory, role-specific training — safeguarding awareness at induction for all staff, refreshed at least annually, with deeper training for the registered manager and safeguarding lead covering Section 42 enquiries, Mental Capacity Act assessments and restraint reduction.
• A genuinely open reporting culture — a whistleblowing policy staff have actually seen and trust, regular safeguarding supervision, and visible evidence that raised concerns lead to action rather than silence.
• Individual, reviewed risk assessments — particularly where restraint, one-to-one supervision, or restrictions that could amount to a deprivation of liberty are in place, rather than blanket "house rules."
• Clear escalation routes — staff must know exactly who to tell, when to involve the local authority safeguarding team and police, and how quickly a CQC statutory notification needs to go out.
• Thorough incident investigation and learning — every safeguarding concern properly recorded, investigated, and used to update risk assessments and training rather than filed and forgotten.

None of this is achievable through documentation alone. Staff need to demonstrably understand why each safeguard exists, which is why ongoing, verifiable training matters as much as the policies behind it. Learnsignal's accredited CPD safeguarding courses are built specifically for UK care home and domiciliary care staff who need evidence-ready training records covering safeguarding, Mental Capacity Act and restraint-reduction content that maps directly onto what CQC inspectors ask to see.

Frequently asked questions

Can CQC prosecute a provider directly under Regulation 13?

Yes. Regulation 13 is one of a small number of fundamental standards that carries criminal liability without CQC first needing to serve a warning notice, as demonstrated by the Hillgreen Care prosecution above. A breach that results in, or risks, avoidable harm can lead directly to prosecution, an unlimited fine, and in serious cases cancellation of the provider's registration.

Does Regulation 13 apply to registered managers personally, or only the provider organisation?

Both can be held liable. CQC has prosecuted registered managers as individuals as well as the provider organisation where evidence shows the manager knew of a risk and failed to act on it, so accountability cannot simply be delegated upward or downward.

How does Regulation 13 relate to restrictive practice and restraint reduction?

Regulation 13 requires any restraint to be necessary, proportionate and legally authorised. A restraint-reduction approach — individual risk assessment, least-restrictive options tried first, regular review — is the practical way most homes demonstrate this in day-to-day practice.

Regulation 13 compliance is ultimately judged on outcomes for real people, not paperwork. Homes that treat safeguarding as a continuously reviewed system — trained staff, open culture, fast escalation, and honest reporting when things go wrong — are the ones that consistently satisfy CQC on this standard and, more importantly, keep the people in their care safe.