Duty of Candour for Home Care Agencies

The duty of candour is the legal requirement to be open with a person about their care. When a defined incident happens, it also tells the agency who to speak to, what the conversation has to cover, and what to write down.

Each nation writes it separately. A home care agency in England follows Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, which the Care Quality Commission regulates. A care service in Scotland follows the organisational duty in the Health (Tobacco, Nicotine etc. and Care) (Scotland) Act 2016. A regulated service in Wales has a duty under regulation 13 of the Regulated Services (Service Providers and Responsible Individuals) (Wales) Regulations 2017. How the four regulators differ more broadly is in home care compliance in the four UK nations.

The summary below follows those published rules and the guidance the regulators have put next to them. Apply it to a live incident with your own advice.

England: an everyday duty, and a procedure for serious incidents

CQC's guidance on Regulation 20 says the duty applies to every health and social care provider that CQC regulates. Registered providers and registered managers, called registered persons in the regulation, must act in an open and transparent way with people receiving care.

That general duty sits in regulation 20(1). It applies to the care the agency provides. It does not wait for a threshold.

A second, more specific duty starts when a notifiable safety incident has occurred. Regulation 20(2) says that as soon as reasonably practicable after becoming aware of one, the registered person must notify the relevant person and provide reasonable support, including when giving that notification.

CQC distinguishes a statutory duty from a professional one. The statutory duty is the one CQC regulates. A professional duty sits with a regulator of a profession, such as the Nursing and Midwifery Council. CQC says that if an incident qualifies as a notifiable safety incident, carrying out the professional duty alone will not meet the statutory one.

What makes an incident notifiable in England

CQC's page on notifiable safety incidents says the phrase is a defined term and should not be confused with other safety incidents or notifications. All three of the following have to be met:

1. It was unintended or unexpected.
2. It occurred during the provision of a regulated activity.
3. In the reasonable opinion of a healthcare professional, it already has, or might, result in death, or severe or moderate harm. CQC says this third element varies with the type of provider.

CQC says "unexpected or unintended" is read against the incident that arose during the regulated activity, rather than against the outcome. If the care went as intended and as expected, an incident may not qualify even where harm occurred. CQC also says known complications are not automatically out of scope, and that the healthcare professionals involved use their judgement on whether anything unexpected or unintended occurred during the care.

CQC says the presence or absence of fault does not decide whether something is a notifiable safety incident. Where the three criteria are not met, it is not a notifiable safety incident, and the general duty to be open and transparent still applies.

The harm test itself splits. CQC says that, for this duty, a health service body means an NHS trust or an NHS foundation trust, and paragraph 8 of Regulation 20 sets their threshold. Paragraph 9 sets the threshold for any other registered person. An independent home care agency registered with CQC is in that second group. An incident can meet one threshold and not the other. CQC says you follow the definition for the type of provider you are.

Under paragraph 9, a notifiable safety incident is an unintended or unexpected incident that occurred in respect of a service user during a regulated activity and, in the reasonable opinion of a health care professional, either appears to have resulted in one of the outcomes below, or requires treatment by a health care professional to prevent the death of the service user or an injury which, if left untreated, would lead to one of those outcomes:

• death, where the death relates directly to the incident rather than to the natural course of the person's illness or underlying condition
• an impairment of sensory, motor or intellectual functions which has lasted, or is likely to last, for a continuous period of at least 28 days
• changes to the structure of the person's body
• prolonged pain, or prolonged psychological harm, each defined as pain or psychological harm experienced, or likely to be experienced, for a continuous period of at least 28 days
• the shortening of the person's life expectancy

CQC gives one illustration of an incident where no staff were actively providing hands-on care: an unwitnessed fall in a care home. In that example the regulated activity includes accommodation, and CQC says that if the harm thresholds are met the fall could qualify because it happened during that activity. The same page tells a provider to test the incident against the regulated activity it was carrying on. It does not work an example for a domiciliary call.

Three further points from that guidance matter in home care, where several organisations can be involved with one person:

• If you discover a notifiable safety incident that occurred in a different provider, CQC says you inform that provider and you are open with the person about what you have discovered. The specific procedure sits with the provider where the incident happened.
• If more than one provider contributed to the harm, each still has its own duty.
• If the incident is only recognised later, through a retrospective review, CQC says the duty still applies.

Who you tell, and what the conversation has to cover

Regulation 20 defines the relevant person as the service user or, in set circumstances, a person lawfully acting on their behalf. Those circumstances are the death of the service user, a service user under 16 who is not competent to decide about their care or treatment, or a service user aged 16 or over who lacks capacity in relation to the matter. CQC's procedure page says this is in accordance with the Mental Capacity Act 2005, and that the registered person, meaning the registered manager or the registered provider, is responsible for carrying the duty out or for delegating it.

The notification has to be given in person. CQC describes that as face to face. Regulation 20(3) says it must:

• provide an account, true to the best of the registered person's knowledge, of all the facts known about the incident at the date of the notification
• advise what further enquiries the registered person believes are appropriate
• include an apology
• be recorded in a written record kept securely by the registered person

The regulation defines an apology as an expression of sorrow or regret in respect of a notifiable safety incident. CQC says apologising is not an admission of liability, in health or social care and in the public or private sector, and that a simple expression of sorrow can be made while an investigation is still going on.

That in-person notification is followed by a written notification containing the account, details of the enquiries, the results of any further enquiries, and an apology. The registered person must keep a copy of the correspondence.

Throughout, the registered person must give reasonable support. CQC says that will vary, and gives examples: an adjustment for a physical disability, an interpreter, information in an accessible format, signposting to mental health services, an advocate, or pointing someone to independent help such as AvMA or Cruse Bereavement Care. Where the person consents, CQC expects family members and carers to be involved in the discussions.

If the relevant person cannot be contacted in person, or declines to speak to the representative, regulation 20(5) says the notification steps do not apply, and a written record is kept of the attempts. CQC says the agency still reports the incident through the appropriate notifications system and investigates it so that harm to others can be prevented.

A CQC notification is a separate report

Telling the person is the duty of candour. A report to CQC is a separate notification. CQC's incidents page says the two should not be confused. Its procedure page says an incident may also meet the notification thresholds, and if it does it should be reported through the notification system for that care sector.

How CQC assesses a home care agency is a wider question than this regulation. Candour is one of the places an inspector looks. It is not the whole assessment.

What CQC expects to find

CQC's page on how it regulates the duty calls the duty one of the fundamental standards. CQC does not investigate every notifiable safety incident. That responsibility lies with the provider. CQC says it will investigate specific incidents where it has concerns, and that its judgement is on the registered person.

At registration, CQC expects evidence that the registered person understands Regulation 20, understands when and how to carry it out, and has training, policies and systems so that staff can implement it. It also expects the provider to explain how staff will be supported to be open, inside a broader culture of safety.

CQC says a provider can be open and transparent under regulation 20(1) and still fail the specific steps in regulation 20(2): the definition, the meetings and records, what those records cover, timeliness, and support for the person harmed.

On inspection or monitoring, CQC says it may follow up notifications that were marked as triggering the duty, and notifications that were not marked but appear from the description and the harm to have required it. It may ask frontline staff what they understand, ask the registered person about policies, training and recording, and ask people who experienced an incident how the provider responded.

Where CQC believes the duty is not being carried out, it says it can use its enforcement powers and can prosecute breaches. It says Regulation 20 also allows it to move directly to criminal enforcement action, and that the options include warning and requirement notices, conditions, and criminal prosecution. The decision follows CQC's enforcement policy.

Scotland: a procedure, a review, and a report every year

The Scottish duty is organisational. Scottish Government guidance, revised in March 2025, says it applies to organisations that provide a health service, a care service or a social work service. For a care service that includes a person, other than an individual, who provides the service, and an individual who provides a care service and employs, or arranges with, other people to help provide it. Childminders are excepted, as is help that is merely incidental to other activities.

Section 21 says the procedure must be followed as soon as reasonably practicable after the responsible person becomes aware that it applies. It applies where an unintended or unexpected incident occurred in the provision of the care service and, in the reasonable opinion of a registered health professional, the incident appears to have resulted in, or could result in, a listed outcome, and that outcome relates directly to the incident rather than to the natural course of the person's illness or underlying condition.

The Act requires that the registered health professional who gives that opinion is not someone who was involved in the incident.

The outcomes in section 21(4) include death, severe harm (a permanent lessening of bodily, sensory, motor, physiologic or intellectual functions), and other harm which results in an increase in treatment, changes to the structure of the body, shortening of life expectancy, an impairment of sensory, motor or intellectual functions lasting or likely to last at least 28 days, or pain or psychological harm for a continuous period of at least 28 days. They also include the person requiring treatment by a registered health professional to prevent death, or to prevent an injury which would lead to one of those outcomes if untreated.

The steps themselves are in the Duty of Candour Procedure (Scotland) Regulations 2018, in force from 1 April 2018. In short, the responsible person must:

• notify the relevant person with an account of the facts known at the time, and an explanation of the actions it will take
• where the procedure start date is later than one month after the incident, explain why (the start date is the date the health professional's opinion is given to the responsible person)
• offer a written apology, and provide one if the person wishes it, in addition to any apology given at the time
• invite the person to a meeting, give them a chance to ask questions in advance, and afterwards provide a note of the meeting and a staff contact
• review the circumstances it considers led or contributed to the incident, seek the person's views, and produce a written report of that review, including actions to improve the service and to share learning
• where the review is not completed within three months of the procedure start date, explain why
• make sure employees who carry out the procedure on its behalf know the procedure, have had training and guidance, and can tell the person about support that may help
• keep a written record of each incident, including a copy of every document and piece of correspondence

If the responsible person cannot contact the relevant person, or the person declines to communicate, the record has to include the attempts, and the duties to provide information do not apply to that incident. The regulations also say they do not permit or require disclosure that would prejudice a criminal investigation or prosecution, or that would contravene another restriction on disclosure.

Section 24 requires an annual report, prepared as soon as reasonably practicable after the end of the financial year, from a responsible person who provided a care service during that year. The report must cover the number and nature of incidents to which the section 21 duty applied, an assessment of the extent to which the duty was carried out, the policies and procedures (including how incidents are identified and reported, and what support is available to staff and to people affected), and any changes to those policies as a result of incidents. It must not name anyone, or contain information the responsible person thinks is likely to identify anyone. It is published, and on publication a care service notifies Social Care and Social Work Improvement Scotland, which is the Care Inspectorate.

The Care Inspectorate's duty of candour page, updated on 9 October 2026, says care services have had to produce that short report each year since April 2019, that the report is published and shared with the regulator, and that a report is still required in a year with no duty of candour incidents. It says reports may be reviewed as part of inspection, and that when a service notifies a serious incident it is asked whether the duty was triggered.

Wales: be open, under a different regulation

Regulation 13 says the service provider must act in an open and transparent way with individuals who are receiving care and support, any representatives of those individuals, and, where a child is provided with accommodation, the placing authority.

That is a general duty. The regulation does not set out the notifiable-incident procedure in England's Regulation 20, or the review-and-annual-report procedure in the Scottish regulations.

The duty of candour in the Health and Social Care (Quality and Engagement) (Wales) Act 2020 is written differently again. Section 3 brings that duty into effect in relation to an NHS body, where a person to whom the body is providing or has provided health care has suffered an adverse outcome and the health care was or may have been a factor. It is a duty on the NHS body.

Welsh Government statutory guidance for care home and domiciliary service providers, published in March 2024, sits alongside regulation 13. On the duty of candour it says service providers have policies and procedures so that staff and volunteers know them and follow them, and that those policies take account of Social Care Wales guidance on the professional duty for people registered with Social Care Wales. It describes a culture of candour that includes being open and honest with individuals and their representatives when things go wrong, providing information about incidents and the outcome of any investigations, and offering an apology where it is appropriate. It also says providers have a system to identify and deal with possible breaches by professionally registered staff, including where someone has obstructed another person in exercising the duty, and that action can include a referral to the professional regulator where appropriate.

What to have ready before anything goes wrong

The rules above are the test of a policy. A useful policy names which duty applies to each branch, who may speak to the person, and where the account, the apology, the written follow-up and the attempts at contact are stored. In Scotland it also needs a route to an opinion from a registered health professional who was not involved in the incident, and a point in the year when the report is written even if the answer is that there were no incidents.

Staff who might be the first to hear that something has gone wrong need to know that the conversation is part of the job, and who they call before they improvise one. CQC says it may question frontline staff on exactly that.

The record is the part an inspector can still see after the visit. Incident records in homecareOS hold the incident, the follow-up actions and the timeline. That is a description of the product on that page. It does not carry out the conversation, decide whether an incident meets a threshold, or write the apology. Those remain with the registered person.

Sources

• Regulation 20, Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, for the general duty, the notification steps, the definition of an apology and the paragraph 8 and 9 harm tests.
• Regulation 20: duty of candour, Care Quality Commission, for who the statutory duty applies to, and for the statement that an apology is not an admission of liability.
• Notifiable safety incidents, Care Quality Commission, guidance updated 30 June 2022, for the three criteria, the reading of "unexpected or unintended", and the care-home fall example.
• What you must do when you discover a notifiable safety incident, Care Quality Commission, for the in-person steps, reasonable support, and what happens if the person cannot be contacted.
• How we regulate the duty of candour, Care Quality Commission, for registration evidence, inspection checks and enforcement.
• Section 21 and section 24, Health (Tobacco, Nicotine etc. and Care) (Scotland) Act 2016, for the trigger, the independent opinion, and the annual report.
• The Duty of Candour Procedure (Scotland) Regulations 2018, for the notification, apology, meeting, review, training and record.
• Who the organisational duty applies to, Scottish Government, non-statutory guidance revised March 2025.
• Duty of candour guidance for care services, Care Inspectorate, updated 9 October 2026, for the annual report, including a year with no incidents.
• Regulation 13, the Regulated Services (Service Providers and Responsible Individuals) (Wales) Regulations 2017.
• Section 3, Health and Social Care (Quality and Engagement) (Wales) Act 2020, for the duty on an NHS body.
• Statutory guidance for service providers and responsible individuals, Welsh Government, March 2024, for the expectations published alongside the Welsh regulation.
• Incidents, audits and compliance records, for how homecareOS stores an incident and its follow-up. That page describes the product.