A Plain Guide to CQC Regulations 9 to 20 Under the Health and Social Care Act 2008

CQC Regulations 9 to 20 are the fundamental standards healthcare providers must meet under the Health and Social Care Act 2008. They cover person-centred care, dignity, consent, safe care, safeguarding, premises, complaints, governance, staffing, recruitment and duty of candour. Providers must show these standards through clear policies, trained staff, safe systems, accurate records and evidence of ongoing review.

If you are setting up or running a healthcare service in England, you need to understand how CQC Regulations 9 to 20 apply to your day-to-day work. These regulations sit under the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 and are often referred to as the CQC fundamental standards.

At DKJ Support Services, our goal is to make CQC compliance easier to understand for providers, private clinics, GP practices and new healthcare services. We help you translate regulatory requirements into practical policies, systems and evidence, so you can focus on setting up and running safe, well-led services.

If you are preparing for CQC registration as a new provider, it is useful to understand these standards before you submit your application. (You may also want to read our related blog, Stricter CQC Validation From February 2026: What New Providers Must Submit, as validation requirements can affect how your application is reviewed before it moves forward.)

This guide explains Regulations 9 to 20 in plain English. It is designed to help you understand what each regulation means, what CQC may expect to see, and how you can start building practical evidence of compliance.

What are CQC Regulations 9 to 20?

CQC Regulations 9 to 20 are part of the legal framework that applies to providers carrying on regulated activities in England. They set out the minimum standards that health and social care providers must meet.

In practical terms, they cover how you:

• Assess and meet people’s needs
• Treat people with dignity and respect
• Obtain consent
• Deliver safe care and treatment
• Safeguard people from abuse
• Manage premises and equipment
• Respond to complaints
• Govern your service
• Recruit and train staff
• Act openly when something goes wrong

These regulations are relevant during CQC registration, inspections, ongoing monitoring and internal governance reviews. They are not just a legal checklist. They should shape how your service operates every day.

Quick summary of CQC Regulations 9 to 20

Regulation	Plain-English meaning	What providers need to show
Regulation 9	Person-centred care	Care and treatment are based on each person’s needs and preferences
Regulation 10	Dignity and respect	People are treated respectfully, privately and without discrimination
Regulation 11	Need for consent	Valid consent is obtained before care or treatment
Regulation 12	Safe care and treatment	Risks are assessed and managed to prevent avoidable harm
Regulation 13	Safeguarding	People are protected from abuse, neglect and improper treatment
Regulation 14	Nutrition and hydration	People’s food and drink needs are met where this applies
Regulation 15	Premises and equipment	Premises and equipment are safe, clean and suitable
Regulation 16	Complaints	Complaints are received, investigated and acted on properly
Regulation 17	Good governance	Systems are in place to monitor quality, safety and risk
Regulation 18	Staffing	There are enough suitably qualified, competent and trained staff
Regulation 19	Fit and proper staff	Staff are safely recruited and suitable for their roles
Regulation 20	Duty of candour	Providers are open and honest when certain safety incidents occur

Regulation 9: Person-centred care

Regulation 9 means that care and treatment must be designed around the person receiving it. Providers must assess each person’s needs and preferences, then plan care that reflects those needs.

For a private clinic, this means you should not rely on a generic approach. Your consultations, treatment plans, aftercare arrangements and records should show that you have considered the individual patient.

CQC may expect to see evidence such as:

• Needs assessments
• Consultation notes
• Treatment plans
• Care plans, where relevant
• Patient preferences
• Records of risks and decisions
• Evidence that patients were involved in decisions
• Review notes for ongoing care

For example, a private GP clinic may need to document a patient’s medical history, preferences and follow-up plan. An aesthetics clinic may need to show that it has assessed suitability for treatment, explained realistic outcomes and recorded any relevant contraindications. A diagnostic provider may need to show how results and follow-up arrangements are communicated clearly.

The key point is that care should be planned around the person, not around a standard template.

Regulation 10: Dignity and respect

Regulation 10 requires providers to treat people with dignity and respect. This includes privacy, confidentiality, equality and the way staff communicate with patients or service users.

In practice, this means that people should feel listened to, respected and protected from avoidable embarrassment or discrimination. Staff should speak professionally, maintain privacy during consultations and handle personal information carefully.

This regulation can be supported by:

• Equality and diversity policies
• Confidentiality policies
• Chaperone policies, where relevant
• Staff training records
• Patient communication standards
• Complaints and feedback records
• Clear arrangements for private consultations

Dignity and respect also apply to small details. These include how reception staff speak to patients, how test results are discussed, how treatment rooms are arranged, and whether patients are given time to ask questions.

For new providers, it is useful to build dignity and respect into your staff induction, policies and patient journey from the start.

Regulation 11: Need for consent

Regulation 11 covers consent. Providers must obtain valid consent before delivering care or treatment.

Consent should be:

• Informed
• Voluntary
• Given by a person with capacity to make the decision
• Specific to the proposed care or treatment
• Recorded clearly

A basic consent process should include the following steps:

1. Explain the proposed care or treatment.
2. Explain the likely benefits, risks and alternatives.
3. Check that the person understands the information.
4. Give the person time to ask questions.
5. Confirm that the decision is voluntary.
6. Record the consent clearly.
7. Review consent if the situation changes.

For services providing treatments, procedures, diagnostics or aesthetics services, consent records are especially important. A signed form alone may not be enough if there is no evidence of a meaningful discussion.

Providers should also consider whether the Mental Capacity Act applies. If there is any doubt about a person’s ability to make a decision, staff need to know how to assess capacity and what steps to take.

Useful evidence includes:

• Consent policy
• Consent forms
• Mental capacity policy
• Patient information sheets
• Clinical records showing consent discussions
• Staff training records
• Records of best-interest decisions, where relevant

Regulation 12: Safe care and treatment

Regulation 12 is one of the most important regulations for healthcare providers. It requires providers to assess risks and do what is reasonably practicable to reduce the risk of avoidable harm.

This regulation covers a wide range of areas, including:

• Clinical risk
• Infection prevention and control
• Medicines management
• Equipment safety
• Emergency procedures
• Staff competency
• Safe premises
• Safe referrals and escalation
• Incident reporting
• Information sharing where needed for safe care

For private clinics, Regulation 12 should be reflected in both clinical and operational systems. For example, you may need protocols for managing medical emergencies, checking emergency equipment, cleaning treatment rooms, storing medicines, handling sharps and escalating clinical concerns.

Evidence that may support compliance includes:

• Clinical risk assessments
• Premises risk assessments
• Infection prevention and control audits
• Medicines management policy
• Emergency procedure documents
• Equipment maintenance records
• Cleaning schedules
• Staff competency checks
• Incident logs
• Clinical protocols
• Referral pathways

Common gaps include policies that do not match the actual service, missing risk assessments for the premises, no clear emergency procedure, incomplete medicines records, and no evidence that staff understand safety processes.

CQC is likely to look for both written systems and evidence that those systems are used in practice.

Regulation 13: Safeguarding service users from abuse and improper treatment

Regulation 13 requires providers to protect people from abuse, neglect, degrading treatment and improper treatment.

Safeguarding applies across health and social care. Even if your service is a small private clinic, your staff may still encounter safeguarding concerns. They need to know how to recognise concerns, record them and escalate them appropriately.

Your safeguarding arrangements should cover:

• Adults at risk
• Children and young people, where relevant
• Domestic abuse awareness
• Modern slavery awareness
• Staff conduct
• Whistleblowing
• Reporting concerns externally
• Escalation routes for urgent concerns

CQC may expect to see:

• Safeguarding policy
• Named safeguarding lead
• Staff training records
• Safeguarding referral process
• DBS checks, where required
• Records of concerns and actions taken
• Whistleblowing policy
• Clear escalation routes

Safeguarding should not sit only in a policy folder. Staff should understand what to do if they are worried about a patient, colleague or service user.

Regulation 14: Meeting nutritional and hydration needs

Regulation 14 requires providers to meet people’s nutritional and hydration needs where this is part of the care or treatment being provided.

This regulation will not apply in the same way to every service. It is particularly relevant to care homes, inpatient services, some community services and services where patients are under the provider’s care for longer periods.

However, private clinics should still consider whether nutrition or hydration is relevant to their service. For example, this may apply where patients need fasting instructions before a procedure, hydration advice after treatment, or monitoring during recovery.

Private clinics may need to think about:

• Pre-procedure fasting instructions
• Post-procedure hydration advice
• Arrangements for patients who become unwell
• Recovery monitoring
• Written aftercare information
• Escalation if a patient cannot eat or drink safely

The key is to consider whether the regulation applies to your service and document how you manage any related risks.

Regulation 15: Premises and equipment

Regulation 15 requires premises and equipment to be safe, clean, suitable, properly maintained and used correctly.

For healthcare providers, this covers both the physical environment and the equipment used to deliver care or treatment.

Providers should review:

• Treatment rooms
• Waiting areas
• Accessibility
• Cleaning arrangements
• Fire safety
• Waste management
• Medical equipment
• Emergency equipment
• Storage of medicines and clinical supplies
• Maintenance contracts
• Infection prevention arrangements

Evidence may include:

• Premises risk assessment
• Fire risk assessment
• Equipment servicing records
• Calibration records
• Cleaning schedules
• Waste transfer notes
• Infection prevention audits
• Health and safety policy
• Maintenance logs

For a new provider, it is important to assess premises before opening. A room that looks suitable commercially may not be suitable clinically. You need to consider infection control, privacy, accessibility, storage, emergency access and the type of regulated activity being delivered.

Regulation 16: Receiving and acting on complaints

Regulation 16 requires providers to have an effective system for receiving, investigating and responding to complaints.

A complaints process should be easy to find and easy to use. Patients and service users should know how to raise concerns, what will happen next and when they can expect a response.

A simple complaints process should include:

1. Make it easy for people to complain.
2. Acknowledge the complaint.
3. Investigate fairly.
4. Respond clearly.
5. Explain any action taken.
6. Record the outcome.
7. Use complaints to improve the service.

Your complaints policy should include:

• How to complain
• Who manages complaints
• Response timeframes
• How complaints are investigated
• How learning is recorded
• External escalation routes, where relevant
• How complaints are reviewed for patterns or themes

Complaints should not be treated only as isolated problems. They can provide useful evidence about service quality, communication, safety and patient experience.

Regulation 17: Good governance

Regulation 17 requires providers to have effective systems and processes to monitor and improve the quality and safety of their service.

This regulation is central to CQC compliance because it connects many other areas. A provider may have written policies, but Regulation 17 asks whether the provider checks that those policies are working.

Good governance may include:

Governance area	What this may include
Risk management	Risk register, incident reviews, escalation processes
Quality assurance	Audits, patient feedback, action plans
Records	Accurate clinical, staff and governance records
Policies	Version control, review dates and staff sign-off
Leadership oversight	Meetings, reports and named responsibilities
Compliance monitoring	Evidence folders, inspection preparation and training matrix

Good governance means you can answer questions such as:

• What are your main risks?
• How do you know your service is safe?
• How do you monitor quality?
• How do you learn from incidents and complaints?
• Who is responsible for each area of compliance?
• How do you check staff are trained and competent?
• How do you keep records accurate and secure?

Common governance weaknesses include:

• No audit schedule
• Policies without review dates
• No evidence of learning from incidents
• Incomplete staff files
• Poor clinical record keeping
• No clear leadership accountability
• No regular review of complaints or feedback
• No action plan following identified gaps

For new providers, governance systems should be built before the service opens. This helps you show CQC that compliance is part of the way your service will operate, not an afterthought.

Regulation 18: Staffing

Regulation 18 requires providers to have enough suitably qualified, competent and experienced staff to meet people’s needs safely.

This does not only mean having enough people on duty. It also means making sure staff have the right skills, training, supervision and support for their role.

Evidence may include:

• Staffing structure
• Job descriptions
• Training matrix
• Induction records
• Supervision records
• Appraisal records
• Competency assessments
• Rota or cover arrangements
• Clinical supervision, where relevant
• Evidence of role-specific training

For small clinics, staffing arrangements may look different from larger services. A small provider may have fewer staff, but it still needs to show that responsibilities are clear, staff are competent, and there is a plan for absence, escalation and emergencies.

Staffing should be linked to the service you provide. For example, a clinic offering regulated treatments must be able to show that clinical staff are appropriately qualified and competent for those treatments.

Regulation 19: Fit and proper persons employed

Regulation 19 requires providers to make sure that the people they employ are suitable for their roles.

This includes checking identity, qualifications, employment history, professional registration and background information where relevant. It also includes assessing whether a person has the competence and character needed for the role.

Recruitment checks may include:

• Identity checks
• Right to work checks
• References
• Employment history
• Qualifications
• Professional registration, where relevant
• DBS checks, where required
• Fitness to work
• Role-specific competency

A staff file may include:

• Application form or CV
• Interview notes
• References
• DBS evidence
• Qualification certificates
• Professional registration checks
• Contract or role description
• Induction record
• Training records
• Competency sign-off

For CQC compliance, it is not enough to say that staff are suitable. You need evidence that appropriate checks were completed before they started work, or as part of a clear recruitment process.

Regulation 20: Duty of candour

Regulation 20 requires providers to act in an open and transparent way when certain safety incidents occur.

In plain English, duty of candour means being honest with people when something has gone wrong with their care or treatment and has caused, or could cause, significant harm.

When duty of candour applies, providers must:

1. Tell the person affected as soon as reasonably practicable.
2. Provide a truthful account of what is known at the time.
3. Apologise.
4. Explain what further enquiries will take place.
5. Keep a written record.
6. Provide follow-up information where appropriate.
7. Take action to reduce the risk of the same issue happening again.

Evidence may include:

• Duty of candour policy
• Incident reporting process
• Staff training records
• Incident investigation records
• Communication records
• Apology letters, where relevant
• Learning and improvement actions

Duty of candour should be part of your wider safety culture. Staff need to understand when it may apply and who they should escalate concerns to.

How Regulations 9 to 20 connect to CQC registration

CQC registration is not just about completing an application form. New providers need to show that they are likely to meet the relevant regulations once they start operating.

Regulations 9 to 20 should shape your registration documents, policies, procedures, staff planning, governance framework and premises arrangements.

Documents that should reflect these regulations include:

• Statement of Purpose
• Safeguarding policy
• Consent policy
• Infection prevention and control policy
• Medicines management policy
• Complaints policy
• Governance framework
• Recruitment policy
• Training matrix
• Risk assessments
• Incident reporting policy
• Duty of candour policy

Generic templates can help with structure, but they should not be used without adaptation. Your documents need to reflect your actual regulated activities, premises, staffing model, patient group and clinical risks.

For example, a private GP clinic, an aesthetics provider and a diagnostic service may all need CQC registration in certain circumstances, but their risks, procedures and evidence will not be identical.

How Regulations 9 to 20 relate to CQC inspections

During inspections or assessments, CQC may look at whether your service is meeting the fundamental standards in practice.

Inspectors may review:

• Policies and procedures
• Clinical records
• Staff files
• Training records
• Risk assessments
• Incident reports
• Complaints records
• Audit results
• Governance meeting notes
• Patient feedback
• Staff understanding of procedures

They may also speak with staff and patients to understand how the service works day to day.

A common mistake is assuming that a policy is enough. CQC will usually want to see whether the policy is understood, followed, reviewed and supported by evidence.

For example, a safeguarding policy is useful, but staff should also know how to raise a safeguarding concern. A complaints policy is important, but the service should also show how complaints are recorded, investigated and used for learning.

Common mistakes providers make with CQC Regulations 9 to 20

Providers often struggle with these regulations when compliance is treated as a paperwork exercise rather than an operating system.

Common mistakes include:

• Using policies that do not match the service
• Copying templates without adapting them
• Failing to train staff on key procedures
• Not keeping evidence of audits and checks
• Missing review dates on policies
• Having unclear safeguarding escalation routes
• Not recording consent properly
• Poor incident learning
• Incomplete staff recruitment files
• No clear governance structure
• Not reviewing complaints for themes
• Failing to document risk assessments
• Having no clear evidence folder for CQC

The strongest approach is to build compliance into routine management. This means assigning responsibilities, setting review dates, keeping evidence and checking whether systems are working.

Practical checklist for CQC Regulations 9 to 20

Use this checklist as a starting point for reviewing your service.

Area	Questions to ask internally
Person-centred care	Do we assess and record people’s needs and preferences?
Dignity and respect	Do staff understand privacy, respect and equality expectations?
Consent	Is consent discussed, obtained and recorded clearly?
Safe care	Are clinical and operational risks assessed and managed?
Safeguarding	Do staff know how to raise concerns?
Nutrition and hydration	Does this apply to our service, and have we addressed it?
Premises and equipment	Are our premises and equipment safe and maintained?
Complaints	Do we record, investigate and learn from complaints?
Governance	Do we audit, monitor and improve the service?
Staffing	Are staffing levels, skills and training suitable?
Recruitment	Are staff checks complete and documented?
Duty of candour	Are we prepared to respond openly when things go wrong?

This checklist should be adapted to your service. The evidence needed for a private GP practice may differ from the evidence needed for a clinic providing cosmetic procedures, diagnostics or community-based care.

How DKJ Support Services can help with CQC compliance

DKJ Support Services supports healthcare providers with CQC registration, compliance preparation, policy review and governance systems.

For new providers, we can help you understand how Regulations 9 to 20 apply to your proposed service. This may include reviewing your Statement of Purpose, checking your policies and procedures, identifying missing evidence and helping you prepare for the registration process.

For existing services, we can support with:

• Policy review
• Governance audits
• CQC inspection preparation
• Staff training planning
• Evidence reviews
• Compliance action plans
• Private clinic setup support
• Bid management support for health and social care organisations

Our role is to help make regulatory requirements clearer and more practical. We help you understand what needs to be in place, why it matters, and how to evidence it in a way that reflects your actual service.

FAQs about CQC Regulations 9 to 20

What are CQC Regulations 9 to 20?

CQC Regulations 9 to 20 are part of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. They cover core areas such as person-centred care, dignity, consent, safety, safeguarding, staffing, governance and duty of candour.

Do CQC Regulations 9 to 20 apply to private clinics?

They apply where a provider carries on CQC-regulated activities in England. Private clinics should check whether their services fall within the scope of CQC registration and what evidence they need to show compliance.

Are CQC Regulations 9 to 20 only relevant during inspection?

No. They are relevant during registration, ongoing service delivery, inspections, governance reviews, complaints handling and enforcement decisions.

What is the most important CQC regulation for new providers?

There is no single regulation that matters in every case more than all others. However, Regulation 17, good governance, is especially important because it shows how the provider monitors quality, safety, risk and compliance across the service.

What documents help show compliance with CQC Regulations 9 to 20?

Useful documents may include policies, procedures, risk assessments, staff files, training records, audits, complaints logs, incident records, governance meeting notes and patient records.

Can CQC refuse registration if a provider does not meet these standards?

CQC assesses whether a provider is likely to meet the relevant legal requirements. Weak, missing or unsuitable evidence can affect the outcome of an application, particularly if it raises concerns about safety, leadership or governance.

Final Thoughts

CQC Regulations 9 to 20 are central to safe, lawful and well-governed care. They should not be treated as abstract legal wording or a one-off registration task. They should shape how your service is planned, staffed, managed and reviewed.

For new providers, the best time to think about these regulations is before you apply for registration. Your policies, premises, staffing model, governance systems and patient processes should all reflect the standards from the start.

DKJ Support Services can help you understand the requirements, prepare your documentation and review your compliance systems in a practical, service-specific way. Whether you are setting up a private clinic, preparing for CQC registration or reviewing an existing service, clear systems and accurate evidence can make the process more manageable.