Duty of Candour in Care Homes: CQC Guide

This guide is for general information only and does not constitute legal advice. Duty of candour involves legal obligations with potential criminal liability — always seek independent legal advice for specific situations. References are current as of the last reviewed date above; check legislation.gov.uk and CQC's guidance for the latest position.

Duty of candour is one of the most misunderstood obligations in adult social care. Many registered managers know the phrase but are unclear on exactly when it applies, what they must do, and how quickly. The consequences of getting it wrong are serious — CQC has used duty of candour failures as grounds for enforcement action, warning notices, and conditions on registration.

The Legal Framework

Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 establishes the statutory duty of candour for all CQC-registered providers, including care homes with and without nursing. It was introduced following the Francis Report (2013) into failings at Mid Staffordshire NHS Foundation Trust.

The statutory duty is triggered when a notifiable safety incident occurs. There is also a broader professional duty to be honest when things go wrong, but this guide focuses on the statutory requirements — those carrying specific legal obligations and, for two of them, criminal liability.

Duty of candour is owed to the person harmed and the people close to them. It sits alongside, but is separate from, the duty to send CQC a CQC statutory notification telling the regulator what happened. A single incident can trigger both, and meeting one does not discharge the other.

What Is a Notifiable Safety Incident?

Regulation 20 carries two different definitions, and care homes need the right one. Regulation 20(8) applies to health service bodies (NHS trusts and the like) and is framed around death, severe harm, moderate harm or prolonged psychological harm. Regulation 20(9) applies "in relation to any other registered person" — that is the limb a care home works to, and its outcome list is not the same.

Under Regulation 20(9), a notifiable safety incident means "any unintended or unexpected incident that occurred in respect of a service user during the provision of a regulated activity that, in the reasonable opinion of a health care professional" either:

(a) appears to have resulted in —

Death of the service user, "where the death relates directly to the incident rather than to the natural course of the service user's illness or underlying condition"
An impairment of the sensory, motor or intellectual functions "which has lasted, or is likely to last, for a continuous period of at least 28 days"
Changes to the structure of the service user's body
Prolonged pain or prolonged psychological harm — each defined in Regulation 20(7) as pain or harm experienced, or likely to be experienced, "for a continuous period of at least 28 days"
The shortening of the life expectancy of the service user

or (b) requires treatment by a health care professional "in order to prevent— (i) the death of the service user, or (ii) any injury to the service user which, if left untreated, would lead to one or more of the outcomes mentioned in sub-paragraph (a)."

That second limb is easy to miss. An incident can be notifiable because of the treatment needed to head off a serious outcome, even where the serious outcome never materialised. It is not, however, a trigger for any injury that happens to need treatment — the treatment must be needed to prevent death or one of the (a) outcomes.

Both paragraphs (8) and (9) were inserted with effect from 1 April 2015 by S.I. 2015/64. Guidance and templates that cite "Regulation 20(6)" for the definition are simply citing the wrong paragraph: 20(6) is the duty to keep a copy of the written correspondence, and always has been. The definition sits at 20(7), which since 1 April 2015 points to paragraphs (8) and (9).

In care homes, the most common triggers include: a fall resulting in a fracture requiring hospital treatment, a medication error causing adverse reaction requiring medical intervention, development of a grade 3 or 4 pressure ulcer that was potentially avoidable, a safeguarding incident causing harm, or an unexpected death where care delivery may have contributed.

The duty is triggered by the outcome, not the incident type. A fall with no injury does not trigger Regulation 20. The same fall resulting in a hip fracture does.

The Timeline

Step 1: In-Person Notification — As Soon As Reasonably Practicable

Contact the relevant person — the resident, or if they lack capacity, their representative. Regulation 20(3) sets out what this first notification must do:

Be given in person "by one or more representatives of the registered person" — a phone call or a letter does not discharge it
"Provide an account, which to the best of the registered person's knowledge is true, of all the facts the registered person knows about the incident as at the date of the notification"
Advise the relevant person what further enquiries you believe are appropriate
Include an apology — Regulation 20(3)(d). Regulation 20(7) defines "apology" as "an expression of sorrow or regret in respect of a notifiable safety incident." It does not prescribe any particular form of words, and neither the regulation nor CQC's guidance requires the specific word "sorry". CQC's position is that "you must apologise for the harm caused, regardless of fault"
Be recorded in a written record which is kept securely

Regulation 20(2) also requires you to "provide reasonable support to the relevant person in relation to the incident, including when giving such notification."

The regulation sets no deadline in days. The standard is "as soon as reasonably practicable after becoming aware that a notifiable safety incident has occurred," and CQC has criticised homes that delayed without justification. Many homes set an internal target of one to two working days so the duty does not drift — that is a sensible provider target, not a statutory deadline, and it should be described as such in your policy.

Step 2: Written Notification — Following the In-Person Notification

Regulation 20(4) requires the in-person notification to "be followed by a written notification given or sent to the relevant person." No paragraph of Regulation 20 sets a deadline in days or working days for this, and neither does CQC's guidance on the regulation. The 10-working-day figure that circulates widely in care-sector policy templates has no basis in Regulation 20; it is an NHS-side convention that has drifted into social care documents. Set your own internal target, state it in your policy, and hold to it — just do not present it to CQC, or to families, as the legal deadline.

The written notification must contain:

The account of the facts given under Regulation 20(3)(b)
Details of any enquiries to be undertaken in accordance with Regulation 20(3)(c)
The results of any further enquiries into the incident
An apology — Regulation 20(4)(d), the same definition as above

In practice you should also record any support available to the person affected, though that is good practice rather than a Regulation 20(4) item.

Step 3: Investigation and Follow-Up

Complete a thorough investigation. Regulation 20 sets no deadline here either — 20(4)(c) requires "the results of any further enquiries into the incident" without stating when. Four to eight weeks is a common provider target rather than a legal one; pick a window you can meet and record it. If findings differ from the initial written notification, provide an updated written account. Keep the relevant person informed throughout.

Recording Requirements

Regulation 20 imposes three distinct record duties, and they are frequently conflated:

Regulation 20(3)(e) — the in-person notification must "be recorded in a written record which is kept securely by the registered person."
Regulation 20(6) — "The registered person must keep a copy of all correspondence with the relevant person under paragraph (4)," i.e. the written notification and anything that follows it.
Regulation 20(5) — this is the failed-contact provision, not a general record duty. If the relevant person "cannot be contacted in person or declines to speak to the representative of the registered person," then paragraphs (2) to (4) do not apply and "a written record is to be kept of attempts to contact or to speak to the relevant person." Homes that cite 20(5) as the source of their incident-recording duty have the wrong paragraph.

Beyond those three, a complete file is good practice rather than a Regulation 20 requirement. Aim to hold:

The incident itself
In-person notification: date, who was told, what was said (this part is required, by 20(3)(e))
Written notification: date sent and a copy (required by 20(6))
Attempts to make contact, where contact failed (required by 20(5)(b))
Investigation: findings, actions, outcome
Further communications with the relevant person

Retain these in the person's care record. A separate duty of candour log — a register of all notifiable incidents and corresponding actions — is not legally required but strongly recommended for governance oversight.

For background on how CQC assessments are structured, see our complete guide to CQC compliance for small care homes.

The Criminal Offence

The offence is not created by Regulation 20 itself — Regulation 20(7) is the definitions paragraph. It is created by Regulation 22(1), which makes it "an offence for a registered person to fail to comply with any of the requirements in the following regulations, as read with regulation 8—" and then lists, among others, "regulation 20(2)(a) and (3)".

So the criminal exposure attaches to two specific things: failing to notify the relevant person as soon as reasonably practicable (20(2)(a)), and failing to meet the content requirements of the in-person notification (20(3)). The truthfulness element sits inside 20(3)(b) — the account must be one "which to the best of the registered person's knowledge is true". A deliberately false or incomplete account is therefore a breach of 20(3)(b), and it is Regulation 22(1) that criminalises it.

On the penalty, be precise. Regulation 23(5) provides that "a person guilty of an offence under regulation 22(1) for breach of regulation 16(3), 17(3) or 20(2)(a) and (3) is liable, on summary conviction, to a fine not exceeding level 4 on the standard scale." It is a capped fine, not an unlimited one. Regulation 22(4) gives a defence where the registered person proves they "took all reasonable steps and exercised all due diligence to prevent the breach."

The practical point does not change: an account you know to be untrue is the version of a candour failure that carries criminal, not just regulatory, consequences.

CQC Enforcement

CQC treats duty of candour failures seriously. Common findings in enforcement actions include:

No written notification despite a notifiable incident occurring
Delayed notification — families contacted weeks later rather than promptly
Apology missing or inadequate — no expression of sorrow or regret at all, or one buried in defensive language
No investigation completed after the notification
No record of the in-person notification

CQC's enforcement options include a warning notice under Section 29 of the Health and Social Care Act 2008 (the equivalent power for NHS trusts and NHS foundation trusts, Section 29A, is a separate route that does not apply to care homes), an Action Plan request — CQC's current term for what it previously called a requirement notice, used where there is a breach but people are not at immediate risk of harm, and not itself a power under any specific statutory section — conditions on registration, or prosecution under Regulation 22(1) for breach of Regulation 20(2)(a) and (3).

Practical Steps for Care Home Managers

Build duty of candour into your incident process. When an incident occurs: provide immediate clinical response, then within 24 hours the registered manager assesses whether the outcome meets the notifiable threshold. If yes, initiate the in-person notification immediately, then send the written notification to the internal target set in your policy, then complete the investigation.

Train staff to recognise triggers. Care staff witness incidents first. They need to understand that fractures, hospital admissions, serious medication reactions, and significant pressure ulcers require immediate escalation — not just for incident reporting, but because they may trigger legal obligations. Include this in induction and annual mandatory training.

Separate the apology from the investigation. The apology is for the fact that an incident caused harm. It is not an admission of fault — section 2 of the Compensation Act 2006 confirms this, and CQC's own guidance states plainly that "apologising is not an admission of liability." The in-person notification says: "We are sorry this happened. Here is what we know. We are investigating and will share findings in writing."

Personalise notifications. CQC has noted in inspection reports that generic, template-like notifications suggest box-ticking rather than genuine openness. Every notification must address the specific incident and person.

For guidance on how complaints can reveal incidents triggering the duty, see our guide to care home complaints procedures.

Compliance Checklist

Duty of candour is about honesty when something goes wrong. Homes that approach it promptly, openly, and with genuine concern consistently fare well in CQC assessments. Those that avoid difficult conversations or treat it as paperwork do not.