Duty of Care in Health and Social Care: Care Certificate Standard 3, Not a CSTF Subject

Ask a care provider which subjects are mandatory training and you will get a list: safeguarding, moving and handling, fire safety, infection control. Duty of care is almost always on that list. It does not belong there, and understanding why is the difference between a defensible training record and a confused one.

Duty of care is not one of the eleven Core Skills Training Framework subjects. It is Care Certificate Standard 3. That is not a pedantic distinction: the CSTF subjects map onto statutory duties, and duty of care maps onto something else entirely, which is the law of negligence and the statutory duty of candour.

What the eleven CSTF subjects actually are

Skills for Health describes the Core Skills Training Framework as the trusted standard for statutory and mandatory training in the health sector. The eleven subjects are equality, diversity and human rights; health, safety and welfare; conflict resolution; fire safety; infection prevention and control; moving and handling; safeguarding adults; preventing radicalisation; safeguarding children; resuscitation; and information governance.

Duty of care is not among them. Nor is the CSTF itself a statutory instrument. It is an alignment framework with no independent legal force, which is why a provider cannot point at it as the source of a legal obligation. For how the refresher intervals in that framework relate to what the law actually demands, see our guide to how often mandatory training must be refreshed.

Care Certificate Standard 3, and what changed in 2025

The Care Certificate was updated in March 2025 and now runs to sixteen standards, not the fifteen most providers still cite. Standard 3 remains Duty of care, but outcome 3.1 was rewritten. The 2015 wording was to understand how duty of care contributes to safe practice. The 2025 wording is to understand duty of care and duty of candour, and criterion 3.1a requires the worker to define both.

That change matters. The 2025 standard folds the organisational concept of candour into an induction standard aimed at individual care workers, which means a provider using 2015-era induction material is now training to a superseded outcome.

Standard 3 has five outcomes. Beyond 3.1 they cover the support available for dilemmas between duty of care and an individual rights (3.2), dealing with comments and complaints (3.3), dealing with incidents, errors and near misses (3.4), and dealing with confrontation and difficult situations (3.5).

Two criteria that e-learning cannot evidence

Criterion 3.3a requires the worker to demonstrate how to respond to comments and complaints in line with legislation and agreed ways of working. Criterion 3.5d requires them to demonstrate how and when to access support and advice about resolving conflicts.

Demonstrate is not describe or explain. Those two criteria require observed practice. A provider evidencing Standard 3 entirely through a completed e-learning module has not met 3.3a or 3.5d, and an inspector who reads the standard carefully will notice.

The Care Certificate is not mandatory

Skills for Health describes it in its own guidance as a recommended tool to support minimum training, supervision and assessment, and is explicit that the standards do not replace statutory and mandatory training. The Care Quality Commission says it continues to support and expect to see the Care Certificate being used by providers. Expectation is not the same as legal requirement, and providers should be clear with staff about which it is.

The Level 2 Adult Social Care Certificate is a separate thing, not a replacement. Skills for Health puts it plainly: these are two different learning products. The Care Certificate standards are recommended and non-accredited; the Level 2 qualification is accredited and regulated by Ofqual. Dedicated funding through the Adult Social Care Training and Development Fund was withdrawn on 31 July 2024, but the qualification remains fundable through the Learning and Development Support Scheme at 1,540 pounds, first come first served, administered by NHS Business Services Authority from April 2026.

The legal meaning: negligence

In law, duty of care is the first of four elements a claimant must establish: duty, breach, causation and damage. All four are needed. The standard against which breach is measured comes from Bolam v Friern Hospital Management Committee [1957] 1 WLR 582, where McNair J directed that the test is the standard of the ordinary skilled man exercising and professing to have that special skill, and that a practitioner is not negligent if acting in accordance with a practice accepted as proper by a responsible body of medical men skilled in that particular art.

Bolitho v City and Hackney Health Authority [1997] UKHL 46 did not overturn Bolam. It added that the practice relied on must withstand logical scrutiny. The practical effect is that some professionals do it this way is a defence only where the practice is defensible, not merely common.

Montgomery v Lanarkshire Health Board [2015] UKSC 11 then removed risk disclosure from the Bolam test altogether. There is a duty to take reasonable care to ensure the person is aware of material risks, and a risk is material if a reasonable person in that person position would be likely to attach significance to it. Lady Hale put the principle in one line: once the argument departs from purely medical considerations, the Bolam test is inapposite. Montgomery was a Scottish appeal but binds across the UK, and the transferable point for social care is that information-giving is judged by what this person would want to know, not by professional consensus.

Where duty of care becomes enforceable: candour

Duty of care itself carries no training mandate and no regulatory offence. The duty of candour does both. In England it is regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014.

A citation point worth getting right: as made, regulation 20 bound health service bodies only. It was extended to all registered providers by SI 2015/64, in force 1 April 2015, which added paragraphs (8) and (9). A post or policy citing only the as-made text will look wrong to a care home reader.

Those two paragraphs set two different thresholds, and this is where lifting an NHS policy wholesale goes wrong. For health service bodies under 20(8), a notifiable safety incident is one that could result in, or appears to have resulted in, death, severe harm, moderate harm or prolonged psychological harm. For every other registered person under 20(9) the test is narrower in one respect and differently drawn in another: the incident must appear to have resulted in death, impairment of function lasting or likely to last at least 28 continuous days, structural bodily changes, prolonged pain or psychological harm, or shortened life expectancy.

Regulation 20 is also one of the few regulations CQC can prosecute without first issuing a warning notice, though only paragraphs 20(2)(a) and 20(3). The first such prosecution, of University Hospitals Plymouth NHS Trust on 23 September 2020, produced a fine of 1,600 pounds and costs of 10,845.43 pounds. The costs were the penalty, not the fine. Our guide to regulation 20 covers the notification mechanics in full.

Scotland and Wales diverge, and one of them mandates training

Scotland has an organisational duty of candour under Part 2 of the Health (Tobacco, Nicotine etc. and Care) (Scotland) Act 2016, in force 1 April 2018, with the procedure in SSI 2018/57. Two features have no English equivalent. The professional giving the opinion that the duty is triggered must not have been involved in the incident. And regulation 8 requires that employees who carry out the duty of candour procedure receive relevant training and guidance. Scotland also reaches social care: local authorities and non-individual providers of care or social work services are responsible persons under section 25, and section 24 requires an annual published report.

Wales commenced its duty on 1 April 2023 under Part 3 of the Health and Social Care (Quality and Engagement) (Wales) Act 2020, with a materially lower threshold: harm that is more than minimal, where the care may have been a factor. But the Welsh duty binds NHS bodies and contracted primary care providers only. It does not bind independent social care providers in Wales, who are regulated by Care Inspectorate Wales under the 2016 Act instead.

The professional duty is separate, and lower

Openness and honesty when things go wrong, the professional duty of candour, took effect on 29 June 2015 and was last updated on 13 December 2024. Its threshold is far lower than any statutory one: professionals must be open and honest when something goes wrong that causes, or has the potential to cause, harm or distress. Harm or distress, actual or potential. No 28-day test.

The guidance draws the division of labour explicitly: the organisational duty of candour does not apply to individuals. The professional duty binds individuals; the statutory duty binds organisations. An apology does not admit legal liability, and professionals are not expected to take personal responsibility for errors they did not cause.

So what does a provider actually have to train?

There is no statutory requirement anywhere in the UK to train staff on duty of care as a named subject. Regulation 18 of the 2014 Regulations requires that staff receive such appropriate support, training, professional development, supervision and appraisal as is necessary, and names no subjects at all. Section 2(2)(c) of the Health and Safety at Work etc. Act 1974 is equally subject-agnostic.

The one express duty-related training mandate in the UK is Scottish, and it is about the candour procedure rather than duty of care.

The honest position, then: duty of care is a legal standard the organisation is held to, not a mandatory training subject. Providers train on it because the Care Certificate includes it, because regulation 18 requires training as is necessary and competence here is plainly necessary, and because it is the conceptual foundation for the things that are enforceable. Untrained staff is not a defence to a breach of duty; it is usually an aggravating fact. The same logic applies to the frameworks behind safeguarding, where the levels and refresher expectations are set out in our guide to safeguarding training levels.