A carer finishes a lunch call and phones the office. The person was quieter than usual, there is a new bruise, or the weekly shop money is gone again. What happens in the next hour is the safeguarding system. A policy in a folder is not.
This guide is for a registered manager of a home care agency. It sets out the duty in England, then the different duties in Scotland, Wales and Northern Ireland. It is not a substitute for the procedure published by the local safeguarding adults board, the health and social care trust, or the council you actually work with. Those local steps, including any timescale they set, are the ones your staff have to be able to follow.
Two different jobs in England
It helps to separate the agency's duty from the council's.
Regulation 13 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 says service users must be protected from abuse and improper treatment. Systems and processes must be established and operated effectively to prevent abuse, and to investigate, immediately upon becoming aware of it, any allegation or evidence of abuse.
CQC's guidance on Regulation 13, updated on 16 May 2025, says providers must have a zero tolerance approach to abuse, unlawful discrimination and restraint. Where any form of abuse is suspected, occurs, is discovered, or is reported by a third party, the provider must take appropriate action without delay. That action includes investigation, referral to the appropriate body, or both. CQC says it can prosecute for a breach of regulations 13(1) to 13(4) if the failure results in avoidable harm, or exposes a person to a significant risk of harm, and that it does not have to serve a warning notice first. It must refuse registration if a provider cannot satisfy it that they can and will continue to comply.
The council's duty is different. Section 42 of the Care Act 2014 applies where a local authority has reasonable cause to suspect that an adult in its area has needs for care and support, is experiencing or is at risk of abuse or neglect, and as a result of those needs is unable to protect themselves. The Act says this applies whether or not the authority is already meeting those needs. Paragraph 14.5 of the statutory guidance adds that the adult does not need eligible needs, and does not need to be receiving a service from the local authority, so long as those three conditions are met. The authority must then make, or cause to be made, whatever enquiries it thinks necessary to decide whether any action should be taken, and if so what and by whom.
Chapter 14 of the Care and support statutory guidance says safeguarding means protecting an adult's right to live in safety, free from abuse and neglect. It also says safeguarding is not a substitute for a provider's own responsibility to provide safe care, or for CQC's role. Paragraph 14.222 says all service providers should have operational policies and procedures that reflect the local safeguarding adults board's framework, including the circumstances in which staff report outside their own line management and outside the organisation to the local authority. Providers need to share information with relevant partners even when they are taking action themselves.
A coordinator who "waits for social services" has not met Regulation 13. A coordinator who runs a private investigation and never tells the council has not followed the statutory guidance either.
What the law calls abuse
Regulation 13 defines abuse for its own purposes. It means any behaviour towards a service user that is an offence under the Sexual Offences Act 2003, ill-treatment of a physical or psychological nature, theft, misuse or misappropriation of money or property, or neglect.
Improper treatment is wider than that definition. Care must not discriminate on grounds of a protected characteristic under the Equality Act 2010. It must not include control or restraint that is not necessary to prevent a risk of harm, or is not a proportionate response to that risk. It must not be degrading. It must not significantly disregard the person's needs. A person controls or restrains someone if they use or threaten force to make the person do something they resist, or if they restrict liberty of movement, whether or not the person resists, including by physical, mechanical or chemical means.
CQC's guidance on regulation 13(4)(d) says care must be planned so that enough time is allocated for staff to meet assessed needs. That is the regulatory hook for a run that cannot be delivered at the length the plan describes. It does not turn every late call into abuse. Paragraph 14.18 of the statutory guidance says repeated instances of poor care may indicate organisational abuse, and that records are how anyone sees the pattern. Electronic call monitoring is the visit half of that record. The safeguarding record is what you did when the pattern, or a single serious concern, appeared.
The same chapter gives an illustrative list of types of abuse and neglect, and says it is not exhaustive. The headings are physical abuse, domestic violence, sexual abuse, psychological abuse, financial or material abuse, modern slavery, discriminatory abuse, organisational abuse, neglect and acts of omission, and self-neglect. The guidance says organisational abuse includes neglect and poor care practice in relation to care provided in one's own home, from a one-off incident to ongoing ill-treatment. It also says self-neglect may not prompt a section 42 enquiry. That decision is case by case, and turns on whether the adult can protect themselves by controlling their own behaviour.
Financial abuse is the type home care staff are often the first to notice, because they see the fridge, the meter and the purse. Section 42 says abuse includes financial abuse: money or property stolen, fraud, pressure in relation to money or property, and misuse. The statutory guidance lists potential indicators, including a change in living conditions, a lack of heating, clothing or food, an unexplained shortage of money, and unexplained withdrawals. It says those signs do not prove abuse. They are a reason to look.
Restraint, and liberty in someone's own home
CQC's guidance says staff must be trained so that control, restraint or restrictive practice is used only when absolutely necessary, in line with current national guidance, and as a last resort. If restraint is used it must be proportionate to the risk and the seriousness of the harm, take account of the person's needs and their capacity to consent, and follow current legislation and guidance.
On deprivation of liberty, the same guidance draws a line that matters for domiciliary care. Hospitals and care homes must follow the Deprivation of Liberty Safeguards. Other types of services must ensure that any deprivation of liberty of a person who lacks mental capacity is authorised by the Court of Protection. This article does not try to decide whether a particular door, lock or visit pattern meets that test. If you think it might, take advice before you treat it as an ordinary risk assessment. Providers must also work within the Mental Capacity Act 2005 when the person may lack capacity to make a decision. The plan for that decision sits in the care plan, not in a side conversation.
The six principles, applied to a visit
Paragraph 14.13 of the statutory guidance says six principles apply to all sectors and settings, including care and support services, and should inform the way staff work with adults.
- Empowerment. People are supported to make their own decisions, and to give informed consent.
- Prevention. It is better to act before harm occurs.
- Proportionality. The response is the least intrusive one that meets the risk.
- Protection. People in greatest need get support and representation.
- Partnership. Local services and communities work together to prevent, detect and report abuse. Information is shared when it helps, and it is not shared for its own sake.
- Accountability. Everyone involved can explain their role.
Making safeguarding personal, in paragraph 14.15, is the practical version of the first principle: a conversation about how to respond that supports the person's choice and control, rather than a process that happens to them. In a home care agency that conversation is usually with the person, on the phone or at the next visit, and then written down. It is not a reason to skip the referral where the local procedure, or the risk to other people, says the council has to be told.
What to put in the policy
CQC's note on the safeguarding policy and procedures it asks every new provider to send, updated on 9 February 2026, is a useful contents list for an agency that is already registered. The policy has to show how you will meet Regulation 13, and how people can raise a concern. CQC asks to see:
- the types of abuse, what constitutes abuse, and signs to look for
- the process for reporting a concern, and your approach to restraint
- the steps you take to prevent abuse
- the name and role of the safeguarding lead, with emergency and out-of-hours contacts
- a route that staff at every level can follow, including how an allegation against management is investigated impartially, and who else is involved
- what happens after a concern is reported, and how you consider the person's consent
- how to contact the local authority safeguarding team for the area where you provide the service
Paragraph 14.200 of the statutory guidance says concerns about abuse or neglect must be reported whatever the source of the harm. Where the source is a member of staff, it is for the employer to take immediate action and to record what they did and why. The same paragraph covers volunteers and students.
Asking the person what they want is part of the duty, not a courtesy added at the end. Paragraph 14.15 describes making safeguarding personal as a conversation about how best to respond, in a way that supports involvement, choice and control. Paragraph 14.188 says that if an adult refuses consent to share information, practitioners must still consider whether there is an overriding public interest, for example because other people are at risk of serious harm. A wish to keep the matter quiet does not close Regulation 13.
When a carer phones the office
Local procedures set the exact route and the clock. The duties above still produce a sequence a coordinator can rehearse.
- Make the person safe now. Wales states this as its own rule, below. In England, CQC's guidance is to take action as soon as you are alerted, and Regulation 13 requires the investigation systems to operate immediately on becoming aware of an allegation.
- Write down what was said, who said it, when, and what was seen. Do not replace the visit note with a tidier version later. Paragraph 14.180 of the statutory guidance says that whenever an allegation is made, agencies should keep clear and accurate records, and that managers need to look for past incidents, concerns, risks and patterns.
- Tell the local authority in the way its procedure describes, including when the concern is about your own staff. Paragraph 14.222 is explicit that the policy has to cover reporting outside the organisation.
- In England, decide whether Regulation 18 of the Care Quality Commission (Registration) Regulations 2009 also applies. It requires the registered person to notify CQC without delay of the incidents in that regulation which occur while the regulated activity is being carried on, or as a consequence of it. One of those incidents is any abuse or allegation of abuse in relation to a service user. For this regulation, abuse means sexual abuse, physical or psychological ill-treatment, theft, misuse or misappropriation of money or property, or neglect and acts of omission which cause harm or place a person at risk of harm.
- Keep the duty of candour separate. Regulation 20 is about telling the person, or their representative, that a notifiable safety incident has occurred. Notifying CQC, and referring to the council, do not by themselves meet it. Read Regulation 20 against the facts. Do not assume it applies to every safeguarding concern, and do not assume it never does.
If the injury is a bruise, a skin tear or a mark, the useful record is the one that says where it was, who saw it, and when. On homecareOS the care record includes a body map for that, and a care note cannot be edited or deleted after it is written. A correction is a new entry beside the original. That is a product description, not a regulatory minimum. The minimum is an accurate record that still shows the first account.
Scotland, Wales and Northern Ireland
The same phone call is not the same legal event in every nation. Home care compliance across the four nations sets out the regulators. The safeguarding duties are these.
Scotland. Section 3 of the Adult Support and Protection (Scotland) Act 2007 defines adults at risk as adults who are unable to safeguard their own well-being, property, rights or other interests, are at risk of harm, and, because they are affected by disability, mental disorder, illness or physical or mental infirmity, are more vulnerable to being harmed than adults who are not so affected. An adult is at risk of harm if another person's conduct is causing or is likely to cause harm, or if the adult is engaging or is likely to engage in conduct which causes or is likely to cause self-harm. All three parts of the definition have to be met. Section 4 says the council must make inquiries if it knows or believes the person is an adult at risk and that it might need to intervene to protect their well-being, property or financial affairs.
The Care Inspectorate's notifications page, updated on 21 July 2026, says that by law services must tell it immediately if certain events take place, and the list includes allegations of abuse. Its public protection procedures for adult services say the field confirming whether a protection referral has been made to the lead agency is mandatory. If a referral was made, you give the name and job title of the person who sent it. If it was not, you explain why. Telling the Care Inspectorate is not the referral to the council.
Wales. Regulation 26 of the Regulated Services (Service Providers and Responsible Individuals) (Wales) Regulations 2017 says the service provider must provide the service in a way which ensures that individuals are safe and are protected from abuse, neglect and improper treatment. Regulation 27 requires policies and procedures for preventing abuse, neglect and improper treatment, and for responding to any allegation or evidence of it. Those policies must be operated effectively. Where there is an allegation or evidence, the provider must act in accordance with them, take immediate action to ensure the safety of all individuals for whom care and support is provided, make appropriate referrals to other agencies, and keep a record of any evidence or the substance of any allegation, any action taken, and any referrals made.
Regulation 32 defines abuse for that part of the regulations as physical, sexual, psychological, emotional or financial abuse. Financial abuse includes theft, fraud, pressure in relation to money or property, and misuse. Improper treatment includes discrimination or unlawful restraint, including inappropriate deprivation of liberty under the Mental Capacity Act 2005.
The Welsh Government's statutory guidance for care home and domiciliary service providers (March 2024) says safeguarding policies should align with current legislation, national guidance, local procedures and the Wales Safeguarding Procedures. Staff should be trained at induction, with training ongoing at regular intervals in line with local arrangements and with Social Care Wales' safeguarding training standards. Records of referrals and outcomes are kept so safeguarding can be overseen. Care Inspectorate Wales' inspection framework for domiciliary support services includes a safeguarding line of enquiry against regulations 26, 27 and 29 to 31.
Northern Ireland. RQIA inspects domiciliary care agencies against the Domiciliary Care Agencies Minimum Standards, version 1.2, May 2026. Standard 14 says service users are protected from abuse. The criteria require procedures for protecting vulnerable adults that accord with legislation, departmental guidance, regional protocols and local processes issued by HSC trusts. Suspected, alleged or actual abuse is reported to the relevant persons and agencies, investigated fully and promptly, and written up with the investigation, the outcome and the action taken. Training on the protection of children and vulnerable adults is updated at least every two years. The version history of that document shows that the May 2026 change was about registered manager qualifications, not a rewrite of Standard 14. The standard's own footnote still points to regional guidance from September 2006.
The Department of Health's current policy, Adult Safeguarding: Prevention and Protection in Partnership, is written for organisations working with adults across the statutory, voluntary, community, independent and faith sectors. Follow the process your HSC trust currently issues. Do not assume the 2006 footnote is the only document they will ask to see.
How often safeguarding training is repeated
There is no single UK rule for how often safeguarding training is repeated.
In England, CQC's guidance on regulation 13(2) says that as part of induction, staff must receive safeguarding training that is relevant and at a suitable level for their role. It should be updated at appropriate intervals and should enable staff to recognise different types of abuse and how to report concerns. Staff must know the local policy, including the timescales for action. Paragraphs 14.226 and 14.227 of the statutory guidance say training should take place at all levels, that no staff group should be excluded, that it should be updated regularly, and that each organisation is responsible for training its own staff.
In Wales, the statutory guidance cited above expects induction training and ongoing training at regular intervals, in line with local arrangements and Social Care Wales' standards. In Northern Ireland, Standard 14.10 sets a minimum: at least every two years. Scotland's Adult Support and Protection Act does not, in the sections above, set a renewal interval for provider staff. Use the interval your own procedure and the local partnership specify, and be able to show who attended.
Where the software fits
None of the duties above is a feature list. They do describe the record an inspector, a contracts officer or a safeguarding chair will ask to see: the first account, the referral, the action, and the earlier incidents that make a pattern.
homecareOS already describes that record on the compliance page: incidents logged, follow-up actions assigned with deadlines, safeguarding referrals tracked, and the timeline kept. The policy library includes safeguarding adults policies for each UK nation. Scotland has an Adult Support and Protection policy, and Wales has its own safeguarding policy. Policies that are shared across nations currently quote CQC regulation numbers, so outside England those references need changing when you adopt them. Adopting a template does not meet Regulation 13, regulation 27, or Standard 14. Operating the procedure, and keeping the record, is what those rules ask for.
Sources
- Regulation 13, Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, for the agency's duty in England and the definition of abuse and restraint.
- CQC guidance on Regulation 13, page last updated 16 May 2025, for action without delay, prosecution, restraint, and Court of Protection authorisation outside care homes and hospitals.
- Safeguarding policy and procedures, CQC, page last updated 9 February 2026, for what a registration application must show.
- Section 42, Care Act 2014, for the local authority enquiry duty.
- Care and support statutory guidance, chapter 14, for the six principles, the types of abuse, making safeguarding personal, provider policies, records and consent.
- Regulation 18, CQC (Registration) Regulations 2009, for the notification of abuse or an allegation of abuse.
- Regulation 20, for the duty of candour, which this article only distinguishes from safeguarding.
- Section 3 and section 4, Adult Support and Protection (Scotland) Act 2007.
- Notifications and record keeping and public protection procedures for adult services, Care Inspectorate.
- Regulation 26, regulation 27 and regulation 32, the Regulated Services (Service Providers and Responsible Individuals) (Wales) Regulations 2017.
- Statutory guidance for care home and domiciliary service providers, Welsh Government, March 2024.
- CIW inspection framework, May 2024, for the safeguarding line of enquiry.
- Domiciliary Care Agencies Minimum Standards, version 1.2, May 2026, for Standard 14.
- Adult Safeguarding: Prevention and Protection in Partnership, Department of Health (Northern Ireland).
- Care records, compliance and policies on this site, for the product behaviour described above.