The Health and Social Care Act 2008 and the 2014 Regulations: How the CQC's Rulebook Fits Together

Thirteen posts in this library explain an individual CQC regulation by number. Twenty-five cite the statute those numbers come from. None of them explains how the two fit together, and that gap causes a specific and common misreading: providers look to the Health and Social Care Act 2008 for the standards they are judged against, and the standards are not in it.

The Act contains the power to make the standards. The standards themselves live in a statutory instrument made four to six years later, and understanding that split is what makes the regulation numbers legible.

The architecture

The Health and Social Care Act 2008 is the parent statute. The operative rules are in the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, S.I. 2014/2936, made under sections 8, 20(1) to (5A), 35, 86(2) and (4), 87(1) and (2), and 161(3) and (4) of the Act.

So when an inspection report cites "Regulation 12", it is citing the 2014 Regulations, not the 2008 Act. And when a provider is told they have breached a fundamental standard, the breach is of a regulation made under section 20, exercised by the Secretary of State, rather than of a section of the Act itself.

Registration, and the trap in it

Registration attaches to regulated activities, which are defined in Schedule 1 to the 2014 Regulations. Among those named are nursing care and personal care, each where it is not already part of another regulated activity; accommodation for persons who require nursing or personal care; accommodation for persons who require treatment for substance misuse; and treatment of disease, disorder or injury.

The point most often missed is this: each regulated activity requires a separate registration. A provider is not registered as an organisation and then permitted to deliver whatever falls within its competence. It is registered activity by activity, and delivering an activity it is not registered for is not a quality failing but an unregistered one.

The regulations, and the dates they arrived

Part 3 of the 2014 Regulations runs from regulation 4 to regulation 20A:

• 4 Requirements where the service provider is an individual or partnership
• 5 Fit and proper persons: directors
• 6 Requirement where the service provider is a body other than a partnership
• 7 Requirements relating to registered managers
• 8 General
• 9 Person-centred care
• 10 Dignity and respect
• 11 Need for consent
• 12 Safe care and treatment
• 13 Safeguarding service users from abuse and improper treatment
• 14 Meeting nutritional and hydration needs
• 15 Premises and equipment
• 16 Receiving and acting on complaints
• 17 Good governance
• 18 Staffing
• 19 Fit and proper persons employed
• 20 Duty of candour
• 20A Requirement as to display of performance assessments

Almost all of these came into force on 1 April 2015. Two did not. Regulation 5, fit and proper persons: directors, and Regulation 20, the duty of candour, both commenced on 1 December 2014 — four months ahead of the rest.

That sequencing is worth noticing. Of the eighteen provisions, the two singled out for early commencement were the one making individual directors personally assessable and the one requiring openness with patients when something goes wrong. The inference is not stated in the instrument, but the drafters evidently treated accountability and candour as more urgent than the rest of the framework.

Why it matters that the standards are secondary legislation

Putting the fundamental standards in a statutory instrument rather than in the Act has a consequence that shows up in practice rather than in theory: the standards can be changed without new primary legislation, and they have been.

Two of the eighteen provisions were not in the instrument as originally made. Regulation 20A was inserted by S.I. 2015/64, within months of the main commencement. Regulation 9A, covering visiting and accompanying, arrived later again. Neither required a new Act of Parliament, because section 20 of the 2008 Act already supplied the power.

For a provider, that means the rulebook is a living document on a timescale shorter than most policy review cycles. A policy manual that mapped the regulations in 2015 and has been reviewed for content but not for completeness since will be missing provisions entirely rather than merely out of date on detail — and a gap of that kind is invisible to a review that checks what is written rather than what is absent.

It also means the citation discipline matters more than it looks. An internal document that refers to "the fundamental standards" without naming the instrument and regulation number gives a reader no way to check whether it reflects the current set.

The cluster, mapped

For each regulation with a dedicated treatment, the detail sits here:

• Registration and leadership — Regulation 5, fit and proper persons: directors, Regulation 7, registered managers, and Regulation 19, fit and proper persons employed.
• Care delivery — Regulation 9, person-centred care, Regulation 9A, visiting and accompanying, Regulation 10, dignity and respect, and Regulation 11, the need for consent.
• Safety — Regulation 12, safe care and treatment, Regulation 13, safeguarding, Regulation 14, nutrition and hydration, and Regulation 15, premises and equipment.
• Governance and transparency — Regulation 16, complaints, Regulation 17, good governance, Regulation 18, staffing, and Regulation 20, the duty of candour.

Four provisions have no dedicated treatment in this library, and it is worth saying which: regulations 4, 6, 8 and 20A. Three of those are structural — they set out what is required depending on whether the provider is an individual, a partnership or a body corporate, with regulation 8 operating as a general provision. Regulation 20A, the requirement to display performance assessments, is a substantive obligation in its own right and the omission there is a genuine one.

Where the training obligations sit

Two regulations carry most of the workforce weight. Regulation 18 governs staffing, and Regulation 19 governs the fitness of people employed. Between them they are the route by which an inspection finding about competence or supervision becomes a regulatory breach rather than a recommendation.

The practical consequence is that training records are not a separate compliance stream sitting alongside the regulations. They are evidence under Regulation 18, and recruitment and vetting records are evidence under Regulation 19. A provider with excellent training and no way to produce it per person has a Regulation 18 problem rather than an administrative one.

How this compares with the Irish framework

Ireland splits the same job differently. The equivalent statutory architecture runs through the Health Act 2007 and the regulations made under it for designated centres, with HIQA as the monitoring body, and the registration of individual health and social care professionals sits separately again with CORU under the Health and Social Care Professionals Act 2005 — the 30-credit framework we set out in our guide to CORU CPD requirements.

So an English provider's obligations and an English professional's obligations both run through the CQC framework, whereas in Ireland the provider answers to HIQA and the professional answers to their registration board. Groups operating on both sides of the Irish Sea need two compliance models, not one with a geographic switch.

Our suggestions

Cite the instrument, not the Act. Internal policies that say "under the Health and Social Care Act 2008" where they mean S.I. 2014/2936 make it harder to find the actual wording, and the wording is short enough to quote.

Check your registrations against the activities you actually deliver, activity by activity. Scope creep into an unregistered activity is a different and more serious category of problem than a quality shortfall in a registered one.

And treat Regulations 5, 18, 19 and 20 as the workforce set. Those four are where people, competence, fitness and candour become enforceable, and they are the ones a training function can directly affect.