Duty of Candour Explained: What CQC Regulation 20 Requires of Care Providers

When something goes wrong in care, the first thing people who use services and their families want is an honest explanation, not a defensive silence. That obligation is not optional or a matter of goodwill: it is a specific legal duty on providers themselves. Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, commonly known as the statutory duty of candour, requires every provider registered with the Care Quality Commission (CQC) to be open and honest with people who use services, or their representatives, when things go wrong. It is a separate obligation from staff raising internal concerns, which is covered by whistleblowing and speak-up policies rather than Regulation 20 itself, and getting the distinction right matters for how a service documents and investigates incidents, a topic covered in more depth in Learnsignal's guide to incident investigation and documentation standards.

What the statutory duty of candour actually requires

Regulation 20 places two obligations on registered providers and managers. The first is a general duty to act in an open and transparent way with people receiving care or treatment about all aspects of their care, not just when something goes wrong. The second, more specific duty applies when a "notifiable safety incident" occurs. CQC's guidance is explicit that apologising for harm is not an admission of liability and will not affect a provider's indemnity cover, a point that often gets lost when managers are anxious about legal exposure.

The duty applies to every provider CQC regulates, from NHS trusts to small domiciliary care agencies, care homes and independent hospitals. It came into force for NHS bodies in November 2014 and was extended to all other CQC-regulated providers, including adult social care, from April 2015, following recommendations that grew out of the public inquiry into failings at Mid Staffordshire NHS Foundation Trust.

What counts as a "notifiable safety incident"?

Not every incident triggers the statutory duty. According to CQC's guidance, a notifiable safety incident is any unintended or unexpected incident that occurred during the provision of a regulated activity and that, in the reasonable opinion of a healthcare professional, resulted in, or could result in, one of the defined harm outcomes. Provider fault is irrelevant to whether an incident qualifies, and the person's consent to the treatment does not prevent an incident from being notifiable.

For providers that are not NHS bodies, such as most adult social care and independent healthcare services, the threshold is met where the incident appears to have resulted in:

• The death of the service user, where that death relates directly to the incident rather than to the natural course of their illness or condition
• Impairment of sensory, motor or intellectual function lasting, or likely to last, 28 continuous days
• Changes to the structure of the person's body
• Prolonged pain or prolonged psychological harm lasting, or likely to last, 28 continuous days
• A shortening of the person's life expectancy

For NHS bodies, CQC's guidance instead uses the terms death, severe harm, moderate harm and prolonged psychological harm, broadly aligned with NHS patient safety terminology. Near misses do not meet the threshold, and CQC guidance is clear that an unplanned return to surgery alone does not automatically make an incident notifiable; each case needs to be judged against the definitions on its own facts.

The steps Regulation 20 requires when an incident happens

Once a notifiable safety incident is identified, CQC's guidance sets out what "being open and transparent" looks like in practice. In broad terms, a registered person must:

• Notify the relevant person in person, as soon as reasonably practicable after becoming aware that a notifiable safety incident has occurred. This should be done face to face by one or more representatives of the provider.
• Give a truthful account of the facts as far as they are known at the time, and explain what further enquiries or investigations the provider considers appropriate.
• Apologise for the harm or distress caused, both at the initial notification and again in writing. CQC guidance confirms this does not constitute an admission of legal liability.
• Provide reasonable support to the person affected, which may include practical, emotional or communication support appropriate to their circumstances.
• Follow up in writing, giving the same factual account, a note of further enquiries planned or the results of investigations already completed, and a written apology. This letter or notice must be kept as part of the person's care record.
• Keep a secure written record of the initial notification, including who was told, when, and by whom, and retain copies of all correspondence with the relevant person.

If the person cannot be contacted, or declines to engage, the regulation allows the provider to demonstrate that reasonable attempts were made, with those attempts documented. Regulation 20 does not set a fixed number of working days for each step in the way some organisational policies do; the legal test is "as soon as reasonably practicable," which is why many providers build tighter internal timescales into their own duty of candour policy to avoid drift.

How CQC regulates and enforces the duty

CQC monitors compliance with Regulation 20 through routine inspection, looking at whether a service can evidence that notifiable incidents were identified, that people were told promptly and honestly, and that support and a written follow-up were provided. Where it finds shortfalls, CQC typically starts with its usual regulatory tools: requirement notices, warning notices or conditions on registration, scaled to the severity and pattern of the failing.

Failing to notify a person of a notifiable safety incident, or failing to provide the required apology, is also capable of being a criminal offence, and CQC has used its prosecution powers in practice. In September 2020, Plymouth Magistrates' Court fined University Hospitals Plymouth NHS Trust after it pleaded guilty to breaching Regulation 20 by failing to give a patient's family a full and timely account, and an apology, after an unsuccessful procedure, resulting in a total of £12,565 in fines, a victim surcharge and prosecution costs. In April 2021, CQC secured what it described as its first prosecution of an independent (non-NHS) healthcare provider for a duty of candour breach, at Leeds Magistrates' Court, resulting in penalties totalling over £20,000 after the provider failed to share information about incidents involving several patients in a timely way. CQC has said both prosecutions were intended to send a clear signal to the sector that breaches will be pursued, not just noted at inspection.

Recent guidance updates and what may change next

CQC last substantially updated its Regulation 20 guidance in June 2022, clarifying definitions and the regulatory approach described above. Since then, two further developments are worth tracking. First, the Department of Health and Social Care ran a call for evidence reviewing how well the statutory duty of candour is working in practice, published in response to the government's Hillsborough-related commitments; the review examined whether the duty is being met as intended and whether it is doing enough to maintain public trust, with outcomes expected to inform future policy. Second, CQC and NHS England have been working through how the harm definitions in Regulation 20 (and the related Regulation 18) align with NHS England's Learn From Patient Safety Events (LFPSE) service, which replaced the old National Reporting and Learning System. Any formal change to the regulatory wording would need a public consultation, but providers are being encouraged in the meantime to take an inclusive approach and treat incidents meeting the newer LFPSE "moderate harm" definitions as notifiable, rather than waiting for the regulations to catch up.

Building duty of candour into everyday practice

Getting Regulation 20 right is rarely about knowing the legal text; it is about culture and process holding up under pressure, soon after something has gone wrong and emotions are running high. That is where governance matters: a provider needs a clear route from "an incident has happened" to "has this met the notifiable threshold, and has someone acted on it," backed by training so staff recognise a notifiable safety incident when they see one. Learnsignal's guide to good governance in health and social care sets out how that oversight should work in practice, and it is worth reading alongside why providers fail CQC inspections, since duty of candour failings are a recurring theme. Registered managers who want a structured way to keep their knowledge current can explore Learnsignal's CPD courses for health and social care professionals.

Duty of candour versus whistleblowing: a quick distinction

It is easy to conflate duty of candour with whistleblowing, since both sit under the broader banner of openness in care, but they answer different questions. Whistleblowing and speak-up policies protect a member of staff who raises a concern, often internally, about poor practice or wrongdoing they have witnessed. Duty of candour is the provider's own obligation to be honest with the person harmed, or their family, once a notifiable safety incident has occurred, regardless of who raised it. A service can have an excellent speak-up culture and still fail its statutory duty of candour if the follow-through with the affected person is not documented and completed properly, which is why both need distinct policies rather than one "openness" box to tick.

Frequently asked questions

Does duty of candour apply to complaints as well as safety incidents? No. The statutory duty under Regulation 20 is specifically triggered by a notifiable safety incident as defined in the regulations. General complaints handling is a separate process, though the same principles of honesty and transparency should still apply.

Does an apology under duty of candour admit legal liability? No. CQC's guidance is explicit that an apology given as part of meeting the duty of candour is not an admission of liability and should not affect a provider's insurance or indemnity position.

Who is responsible for ensuring the duty of candour is met? The registered provider and registered manager are accountable to CQC for compliance, but in practice this depends on frontline and clinical staff recognising a notifiable safety incident and escalating it promptly so the required steps can be carried out without delay.

Duty of candour is ultimately a test of whether a provider tells the truth when it matters most. Building the recognition, escalation and documentation steps into everyday practice, well before an incident occurs, is what turns a legal requirement into a habit that protects people who use services and the provider's own registration.