The Infection Prevention Code of Practice: Ten Criteria and the Training They Require

The infection prevention code of practice contains a sentence that almost no training provider quotes: "they do not by law have to comply with the code."

That is the Department of Health and Social Care describing its own statutory guidance. Understanding why it says that — and what the hard duty underneath actually is — is the difference between buying infection control training that evidences compliance and buying training that just exists.

The hard duty is one line of regulation

Regulation 12 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires that care and treatment be provided in a safe way, and specifies that the things a registered person must do include, at 12(2)(h), "assessing the risk of, and preventing, detecting and controlling the spread of, infections, including those that are health care associated."

That is the enforceable obligation. Note what it does not contain: no named course, no level, no interval, no percentage.

The code's status, precisely

The code of practice on the prevention and control of infections was first published in July 2015 and last updated in December 2022, reflecting the NHS structural changes from July 2022 and the role of infection prevention in optimising antimicrobial use and reducing antimicrobial resistance. It applies to NHS bodies and to providers of independent healthcare and adult social care in England, including primary dental care, independent sector ambulance providers and primary medical care.

Its own account of its legal force, verbatim: section 21 of the 2008 Act enables the Secretary of State to issue a code of practice; the law states the code must be taken into account by CQC when it makes registration decisions; providers must have regard to the code when deciding how to comply. "So, by following the code, registered providers will be able to show that they meet the regulation on IPC (including cleanliness). However, they do not by law have to comply with the code. A registered provider may be able to demonstrate that it meets the registration requirement regulation in a different way (equivalent or better) from that described in the code."

The code adds, of its own compliance guidance: it "is not mandatory but is considered to represent the basic steps that are required to ensure that the criteria can be met."

So following the code is the straightforward way to show compliance with Regulation 12(2)(h). It is not the only way, and if you do something different you need to be able to show it is equivalent or better.

The ten criteria

Part 2 of the code sets out what a registered provider needs to demonstrate:

1. Systems to manage and monitor the prevention and control of infection, using risk assessments and considering the susceptibility of service users and risks posed by their environment and other users.
2. Provision and maintenance of a clean and appropriate environment in managed premises.
3. Appropriate antimicrobial use and stewardship to optimise outcomes and reduce adverse events and antimicrobial resistance.
4. Provision of suitable, accurate information on infections to service users, visitors and any person concerned with providing further care, in a timely fashion.
5. A policy for ensuring people who have or are at risk of an infection are identified promptly and receive appropriate treatment and care to reduce transmission risk.
6. Systems to ensure all care workers, including contractors and volunteers, are aware of and discharge their responsibilities in preventing and controlling infection.
7. Provision of, or ability to secure, adequate isolation facilities.
8. Ability to secure adequate access to laboratory support.
9. Policies designed for the individual's care, and for provider organisations, that help prevent and control infections.
10. A system or process to manage staff health and wellbeing, and the organisational obligation to manage infection prevention and control.

Not all criteria apply to every regulated activity. Domiciliary care and extra care in people's own homes are not expected to comply with criterion 2, and the full criterion 4 applies only in some circumstances. If you are a home care provider being audited against all ten, that is worth pointing out.

Criterion 6 is the training criterion, and it is more demanding than it looks

Criterion 6 is where the training duty lives, and its sub-paragraphs are specific.

At 6.2: the registered provider "should include IPC (including cleanliness) in all job descriptions. It should also be included, together with antimicrobial stewardship, in induction programmes, and a suitable and sufficient programme of continual training for IPC should be organised for all staff and volunteers. The content should reflect the post holder's role and level of responsibility and a record of all training should be kept."

Four separate obligations in one paragraph: job descriptions, induction, a continual programme, and records. Most providers can evidence induction and records. Fewer can show infection prevention in all job descriptions, and fewer still can show a programme differentiated by role and level of responsibility rather than one module for everyone.

At 6.3: "Where staff undertake procedures, which require skills such as aseptic technique, staff must be trained and demonstrate proficiency before being allowed to undertake these procedures independently." Note "must" and note "demonstrate proficiency" — that is a competence gate, not a completion record.

At 6.4: the provider should have systems to regularly assess the infection prevention skills and competencies of its staff.

And note who criterion 6 covers: all care workers including contractors and volunteers. Cleaning contractors, maintenance contractors, agency staff and volunteers are inside the criterion. In most services they are outside the training matrix. Our guide to the Care Workforce Pathway supporting roles covers what the national role descriptions say about domestic and catering staff, who do a great deal of the actual infection prevention work.

No interval, again

"A suitable and sufficient programme of continual training" is the standard. Not annual. The code sets no refresher interval for infection prevention, which is consistent with almost every other mandatory subject — the statutory position being only that training be repeated periodically where appropriate. We set that out in our guide to how often mandatory training is actually required.

What criterion 6 does require, which an annual module does not deliver, is differentiation by role and level of responsibility, and a competence demonstration before independent practice for procedural skills.

What to do

Four things that map directly onto criterion 6 and are each independently evidenceable.

Check infection prevention actually appears in all job descriptions, including administrative, catering, domestic and maintenance posts. It is the easiest of the four to fix and the one most often missing.

Differentiate the programme by role. One module for everyone fails the "reflect the post holder's role and level of responsibility" test on its face.

Bring contractors and volunteers inside the matrix, or record how you assure yourself they are covered by their own employer's arrangements.

And for any procedural skill, hold a proficiency record rather than a completion record — because 6.3 says "must", and it says demonstrate.