Summary
Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 applies to all registered persons, but the trigger is not the same for everybody. Paragraph 8 defines a notifiable safety incident for a health service body by reference to death, severe harm, moderate harm or prolonged psychological harm. Paragraph 9 defines it for every other registered person, including a private clinic, by a different list, and that list includes an impairment lasting at least 28 days, prolonged pain, a shortening of life expectancy and changes to the structure of the service user's body. A clinic applying the NHS test to itself is applying the wrong one.
Duty of candour is the regulation most often described in NHS terms and most often owed by somebody who is not an NHS body. The duty was extended to all registered providers in 2015, and the amendment did not simply copy the definition across.
What that means for a private clinic is that the threshold at which the duty starts is defined in its own paragraph, with its own list, and that list reads very differently in a surgical or aesthetic setting.
Part of the CQC hub, with the framework explained, a readiness checklist and 10 guides.
See it in your clinicThe incident, who was told, when, what was said and the correspondence that followed, on one record with a clock on it.
Request a demo| Health service body, paragraph 8 | Any other registered person, paragraph 9 | |
|---|---|---|
| Death | Where it relates directly to the incident rather than the natural course of the illness | Same wording |
| Harm thresholds | Severe harm, moderate harm or prolonged psychological harm | Impairment of sensory, motor or intellectual functions lasting or likely to last at least 28 days |
| Physical change | Not named separately | Changes to the structure of the service user's body |
| Pain and life expectancy | Not named separately | Prolonged pain, prolonged psychological harm, or a shortening of life expectancy |
| Treatment to prevent harm | Not named separately | Where treatment by a health care professional is required to prevent death or an untreated injury leading to those outcomes |
Two definitions, and most policies quote the wrong one
Regulation 20(1) requires registered persons to act in an open and transparent way with relevant persons about care and treatment provided in carrying on a regulated activity. That obligation is general. The duty to notify, in paragraph 2, starts when a notifiable safety incident has occurred, and the definition of that term sits in two separate paragraphs.
Paragraph 8 covers health service bodies and uses the harm bands familiar from NHS guidance. Paragraph 9 covers any other registered person, which is what an independent clinic is, and reaches outcomes the NHS test does not name individually. Policies copied from NHS templates therefore set the trigger in the wrong place, usually higher than the regulation does.
Changes to the structure of the body
Of the paragraph 9 triggers, the one with the widest reach in private practice is an incident that appears to have resulted in changes to the structure of the service user's body. In a surgical, dermatological or aesthetic setting that is not an exotic edge case, and it does not require the harm to be severe.
The practical consequence is that a clinic doing procedural work has a lower and more concrete threshold than its NHS equivalent, and the judgement is still a clinical one. Paragraph 9 turns on the reasonable opinion of a health care professional, which means the record needs to show whose opinion it was and what it was based on.
What the regulation asks you to keep
The notification requirements are unusually specific about documents. Paragraph 3 says the notification must be given in person, provide an account of all the facts known at the date of notification, advise what further enquiries the provider believes are appropriate, include an apology, and be recorded in a written record kept securely.
Paragraph 4 requires a written notification to follow, containing the same account, the details of any enquiries, the results of those enquiries and an apology. Paragraph 6 requires a copy of all that correspondence to be kept. Paragraph 5 covers the case where the relevant person cannot be reached or declines to speak, and requires a written record of the attempts. Every one of those is a dated artefact a system either holds or does not.
Apology, which the regulation defines
Paragraph 7 defines an apology as an expression of sorrow or regret in respect of a notifiable safety incident. It is a defined term inside the regulation, required by both paragraph 3 and paragraph 4, and it is not an admission of liability.
This is worth stating plainly because the reluctance to apologise is usually a misunderstanding about what the word is doing. The regulation asks for sorrow or regret, says so in its own definitions, and makes the apology a mandatory element of a compliant notification rather than a matter of style.
The clock, and why the evidence is sequence
Paragraph 2 starts the duty as soon as reasonably practicable after the provider becomes aware that a notifiable safety incident has occurred. Awareness is therefore a dated event, and everything after it is measured from it.
That makes sequence the thing a system has to evidence. When the clinic knew, when the patient was told, what was said, what was sent, and what came back. A clinic holding the incident in one place, the conversation in somebody's memory and the letter in a sent folder has the facts and not the sequence, and the sequence is the part that is asked about. Our page on monitoring an AI scribe once it is live covers the same discipline applied to a system rather than an incident.
What we are not claiming
This page describes what the regulation says and what a system can evidence. It is not legal advice, it is not guidance on whether a particular incident is notifiable, and it does not substitute for your registered manager's judgement, your indemnity provider's advice or the guidance CQC publishes. Whether an incident meets the paragraph 9 test is a clinical judgement, and the legislation linked below governs rather than this summary of it.
wai is not CQC registered and makes no claim to be. CQC registers providers of regulated activities rather than software. The registration and the duty stay with the clinic.
Where wai sits
wai holds the clinical record, the clinic's correspondence and the actions taken on one patient record, so the sequence a candour notification depends on is a single history rather than three systems reconciled after the fact. Every read of a record is logged against a named role.
We are explicit about what the software does not do. It does not decide whether an incident is notifiable, because paragraph 9 turns on the reasonable opinion of a health care professional and that is a person. What it offers is that once somebody has formed that opinion, the record of what followed is complete by default rather than assembled under pressure.
The wider map is in software and CQC, what is actually being assessed. Clinicians still decide what enters the record.
Read paragraph 9 rather than paragraph 8. If your policy quotes moderate harm, it was written for somebody else.
Request a demoFrequently asked questions
Does the duty of candour apply to private clinics?
Yes. Regulation 20 applies to registered persons, which includes independent providers, and has done since the duty was extended beyond health service bodies in 2015. The threshold at which it starts is defined separately for non NHS providers in paragraph 9 of the regulation.
What is a notifiable safety incident for a private provider?
Paragraph 9 defines it as an unintended or unexpected incident during a regulated activity that, in the reasonable opinion of a health care professional, appears to have resulted in death related directly to the incident, impairment of sensory, motor or intellectual functions lasting or likely to last at least 28 days, changes to the structure of the body, prolonged pain or prolonged psychological harm, or a shortening of life expectancy. It also covers an incident requiring treatment to prevent death or an untreated injury leading to those outcomes.
How does the private threshold differ from the NHS one?
Paragraph 8, which applies to health service bodies, uses severe harm, moderate harm and prolonged psychological harm. Paragraph 9, which applies to everybody else, instead names a 28 day impairment, changes to the structure of the body, prolonged pain and a shortening of life expectancy. A policy copied from an NHS template sets the trigger in the wrong place.
What records does Regulation 20 require?
A written record of the in person notification, kept securely, containing the account of the facts, the enquiries the provider believes appropriate and an apology. Then a written notification to the relevant person containing the same account, the enquiries, their results and an apology, with a copy of all that correspondence retained. Where the person cannot be reached, a written record of the attempts.
Is an apology under Regulation 20 an admission of liability?
The regulation defines apology as an expression of sorrow or regret in respect of a notifiable safety incident, and makes it a required element of both the in person and the written notification. It is a defined term inside the regulation rather than a statement about fault.
What should a system hold for duty of candour?
The sequence. When the clinic became aware, when the patient was told, what was said, what was sent and what came back, on one record. The duty starts as soon as reasonably practicable after awareness, so awareness is a dated event and everything after it is measured from it.
Sources
The sequence, not three systems
Fifteen minutes on your workflows. If it is a fit we reply within 24 hours.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits