Infection Prevention and Control in Care Homes: CQC Compliance Guide

Infection prevention and control is not a side issue for CQC inspectors — it sits at the centre of how they judge whether a care home is safe. Outbreaks of flu, COVID-19, norovirus and drug-resistant organisms remain a routine feature of care home life, and how well a service prevents, detects and manages them shapes both resident wellbeing and the rating on the front of the inspection report. For registered managers, understanding exactly what CQC expects — and where that expectation comes from in law and guidance — is the difference between a confident inspection and a defensive one.

This guide sets out the regulatory basis for infection prevention and control (IPC) in English care homes, what CQC's single assessment framework quality statements actually ask providers to evidence, and how to build a programme that holds up under scrutiny rather than one that only looks good on paper.

Where IPC Sits in CQC Regulation

The legal foundation is Regulation 12 (Safe care and treatment) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. Regulation 12 requires providers to assess risks to the health and safety of people using the service and to do "all that is reasonably practicable to mitigate" those risks — and CQC's own guidance on Regulation 12 makes clear this explicitly covers "preventing and controlling the spread of infection."

Sitting alongside Regulation 12 is a separate, older instrument that many managers forget about: the Health and Social Care Act 2008 Code of Practice on the prevention and control of infections and related guidance — often still called the "Hygiene Code." It sets out the criteria CQC uses when judging whether a provider is meeting its infection control duties, covering areas such as clean environments, appropriate isolation facilities, antimicrobial stewardship, and staff education. Every new provider applying for registration with CQC must also submit an infection prevention and control policy as one of the standard supporting documents, so this is assessed from day one, not just at inspection.

What CQC's Single Assessment Framework Actually Asks

Since CQC moved to its single assessment framework, IPC is assessed as a named quality statement under the "Safe" key question. The quality statement reads: "We assess and manage the risk of infection. We detect and control the risk of it spreading and share any concerns with appropriate agencies promptly." Assessors are looking for evidence across several linked areas, including:

• Infection risk assessments that are specific to the service, kept current, and actually used to change practice — not generic templates left untouched for years
• Clean, well-maintained premises and equipment, with cleaning schedules that match national cleanliness standards
• Clearly defined roles and responsibilities for IPC, usually including a named IPC lead with protected time for the role
• Correct use of personal protective equipment (PPE), hand hygiene practice, and safe waste and laundry management
• Prompt, appropriate information-sharing with the local health protection team, GPs, and families when an outbreak or infection risk is identified

CQC's framework points providers toward established clinical guidance rather than inventing its own standards from scratch. It references NICE quality standard QS61 on infection prevention and control, NICE guideline PH36 on healthcare-associated infections, and NHS England's National Standards of Healthcare Cleanliness. In practice, this means an inspector assessing your service is likely to ask whether your policies and practice are actually aligned with these external documents, not just whether you have a policy that mentions infection control.

The Guidance Documents Every Registered Manager Should Know

Three sources of guidance matter most for day-to-day IPC practice in care homes:

NHS England's National Infection Prevention and Control Manual (NIPCM) sets out the evidence-based standard and transmission-based precautions used across health and care settings in England — hand hygiene, PPE selection, safe management of care equipment and the care environment, and management of blood and body fluid spillages. It is a living document, reviewed and updated regularly (version 2.12 was published in July 2025), so relying on a printed copy from several years ago is a common and avoidable gap.

UKHSA's guidance for adult social care, published on GOV.UK, covers understanding and managing infection in adult social care settings, including outbreak thresholds, when to notify the local health protection team, and management of specific organisms such as multidrug-resistant organisms. UKHSA also issues seasonal guidance — for example, winter readiness materials for care homes covering respiratory illness, norovirus and flu vaccination uptake — that CQC inspectors increasingly expect providers to be actively using, not just aware of.

The Hygiene Code described above remains the formal statutory backdrop that CQC's compliance judgements are built on, even though most day-to-day operational detail now comes from the NIPCM and UKHSA guidance.

Common IPC Gaps That Trigger Enforcement Action

IPC failings are a recurring theme in CQC's published findings on why services fall short of "Good." The pattern is consistent across most reports that flag concerns in this area: outdated or generic risk assessments, inconsistent PPE and hand hygiene practice among agency or bank staff, poor segregation of clinical waste, insufficient isolation capacity during an outbreak, and — perhaps most damaging — an inability of staff to explain what the service's own IPC policy actually requires of them when asked directly by an inspector. Our guide on why providers fail CQC inspections covers the wider pattern of documentation-practice gaps that IPC failings typically sit within; the same root causes — policies that exist on paper but aren't embedded in daily routine — show up again and again.

Because IPC sits under Regulation 12, a serious or persistent breach can lead to a warning notice, and in the most serious cases contributes to a service being rated Inadequate or placed in special measures. This is one area where the gap between "we have a policy" and "our staff can demonstrate the policy in practice" is scrutinised particularly closely.

Building an IPC Programme That Holds Up at Inspection

A credible IPC programme for a care home typically includes the following elements, mapped to what assessors are trained to look for:

Good governance underpins all of this — an IPC policy is only as strong as the oversight that checks it is being followed, with clear accountability for who reviews audit findings and who is responsible for closing out actions.

Training and Staff Competency

Training is where many otherwise solid IPC programmes fall down. A staff member who completed an e-learning module eighteen months ago but cannot explain, in their own words, when to escalate a suspected outbreak or how to don and doff PPE correctly is a red flag CQC assessors are trained to spot in conversation, not just in the training matrix. IPC competency should be refreshed regularly, tested practically (not just via a multiple-choice quiz), and extended to agency and bank staff on their first shift, not weeks later. Learnsignal's CPD training courses for care providers include infection prevention and control modules built around current UK guidance, giving managers a straightforward way to demonstrate structured, evidenced staff development at inspection.

Outbreak Management and Notifications

When an outbreak does occur, CQC expects prompt, accurate notification alongside the clinical response. Providers are required to notify CQC of certain events, and getting this wrong — either by under-reporting or by failing to notify at all — is treated as seriously as the outbreak itself. If you are unsure which infection-related events require a statutory notification and which don't, our guide on CQC statutory notifications sets out the reporting duties in detail, including timeframes and the information CQC expects in each notification.

Frequently Asked Questions

Does every care home need a dedicated infection prevention and control lead?

CQC's framework expects a clearly identified person with responsibility for IPC, with enough protected time to carry out audits, lead training and liaise with the local health protection team. In smaller services this may be a role held alongside other management duties, but the responsibility and the time allocated to it must be genuine, not nominal.

How often should IPC policies be reviewed?

There is no single fixed interval set in legislation, but policies should be reviewed at least annually, whenever national guidance changes (such as an updated version of the National Infection Prevention and Control Manual), and after any significant incident or outbreak. What matters most to inspectors is evidence that a review actually changed practice, not just the date on the document.

What happens if CQC finds IPC failings during an inspection?

Findings can range from a requirement notice asking for an action plan, through to a warning notice under Regulation 12 for more serious or persistent breaches. Where failings are severe or repeated, they can contribute directly to an Inadequate rating and closer regulatory scrutiny, including more frequent re-inspection.

Where should staff go for the most current UK IPC standards?

NHS England's National Infection Prevention and Control Manual and UKHSA's adult social care guidance on GOV.UK are the two primary references, and both are updated periodically — services should check for the latest version rather than relying on a document saved locally some time ago.

Infection prevention and control will never be a box-ticking exercise that a good inspector accepts at face value. The services that consistently score well are the ones where the policy, the practice, and the staff's ability to explain both line up — day in, day out, not just on inspection day.