Regulation 20: A Guide to the Duty of Candour

Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 places a statutory duty of candour on every CQC-registered provider. This article explains what the duty requires, how to identify when it is triggered, and how GP practices and private clinics can build the systems and culture needed to meet it consistently. It covers the harm threshold, the notification steps, the apology process, near-miss reporting, and how to carry out a meaningful root cause analysis.

Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires every provider registered with the Care Quality Commission (CQC) to be open and honest with people who use services, or their representatives, when things go wrong. This obligation is not discretionary. It is not optional or a matter of goodwill. It is a specific legal duty on providers themselves.

There are two types of duty of candour: statutory and professional. Both have similar aims, to make sure that those providing care are open and transparent with the people using their services, whether or not something has gone wrong. The CQC regulates the statutory duty, while the professional duty is overseen by regulators of specific healthcare professions such as the General Medical Council (GMC), Nursing and Midwifery Council (NMC) and the General Dental Council (GDC).

If you are in the middle of registering a new practice or clinic, or working through your compliance framework as part of the CQC new registration process, our team at DKJ Support Services can help. We have also put together a collection of helpful pages to help you understand your obligations from the outset: CQC Registration Resources and Guides: Where to Start.

This guide focuses on the statutory duty, since that is what the CQC will assess your organisation against.

The Two Layers of the Statutory Duty

Regulation 20 operates on two distinct levels: a general duty and a specific duty.

The general duty requires providers to act in an open and transparent way with people using the service and their families at all times.

The specific duty sets out exact steps that must be followed when a notifiable safety incident occurs.

Registered managers need both to be working, because it is entirely possible to be broadly open and transparent as an organisation while still failing the specific, procedural requirements of Regulation 20 when an incident happens. The statutory duty also includes specific requirements for certain situations known as “notifiable safety incidents.” If something qualifies as a notifiable safety incident, carrying out the professional duty alone will not be enough to meet the requirements of the statutory duty.

A practice that is generally open in its culture but has no documented process for notifiable incidents will still fail a CQC inspection on this regulation.

The Harm Threshold: When Is the Duty Triggered?

The duty of candour does not apply to every incident.

It is triggered specifically by a notifiable safety incident: any unintended or unexpected incident that occurred in respect of a service user during the provision of a regulated activity that, in the reasonable opinion of a health care professional, could result in, or appears to have resulted in, the death of the service user where the death relates directly to the incident rather than to the natural course of the service user’s illness or underlying condition, or severe harm, moderate harm or prolonged psychological harm to the service user.

Regulation 20 places a statutory duty of candour on every CQC-registered provider, requiring them to notify, apologise and support people when a notifiable safety incident causes moderate harm, severe harm or death. In practice, the definitions that matter most for GP practices and private clinics are moderate harm, severe harm, and prolonged psychological harm:

Harm Level	Definition	Example
Moderate harm	Significant but not permanent harm requiring a moderate increase in treatment	A medication error that causes harm and requires intervention; a missed diagnosis that results in further treatment being needed
Severe harm	Permanent and significant harm	An incident causing permanent and significant harm, for example a grade 4 pressure ulcer, or inpatient self-harm resulting in anoxic brain damage
Prolonged psychological harm	Psychological harm experienced or likely to be experienced for a continuous period of at least 28 days	A traumatic procedure resulting in a subsequent acute episode of severe anxiety and depression
Death	Where death relates directly to the incident, not the patient’s underlying condition	Death resulting from a procedural error rather than natural disease progression

What does the threshold look like in clinical practice?

For most GP practices and private clinics, the moderate harm threshold is the one that requires the clearest thinking. Clinicians recognise the scenario quickly when it is put plainly: a missed diagnosis that ends up requiring further treatment, a medication error that causes harm and needs intervention, or a delay in care that leaves the patient measurably worse off than they would otherwise have been. That is meaningfully different from a near-miss or significant event that was caught before any harm occurred.

The duty is triggered by unintended or unexpected harm meeting that threshold. Clinical error on its own does not trigger it if no harm at that level resulted. Patient dissatisfaction on its own does not trigger it either.

Incidents that relate to a near miss or result in low harm are not relevant to the duty of candour, but should be covered in an organisation’s internal reporting culture.

Whether or not the threshold is met is to be judged “in the reasonable opinion of a health care professional.” Where there is genuine uncertainty, we advise managers to err on the side of applying the duty. The risk of under-applying it far outweighs the risk of over-applying it.

This position, and the definitions of each harm level, should be clearly captured in your Duty of Candour policy. A simple decision flowchart built into the policy takes the guesswork out of it, so the threshold is not being assessed differently depending on who is on shift that day.

The Required Steps Once the Duty Is Triggered

Once a notifiable safety incident is identified, there is a defined sequence of actions. As soon as reasonably practicable after becoming aware that a notifiable safety incident has occurred, a registered person must notify the relevant person that the incident has occurred and provide reasonable support to the relevant person in relation to the incident, including when giving such notification. The full process, in order, is:

1. Verbal notification: The notification must be given in person by one or more representatives of the registered person, and must provide an account which, to the best of the registered person’s knowledge, is true of all the facts the registered person knows about the incident as at the date of the notification.
2. Apology: You must apologise for the harm caused, regardless of fault, as well as being open and transparent about what has happened.
3. Information about further enquiries: Advise the relevant person what further enquiries the provider believes are appropriate.
4. Written notification: Follow up by giving the same information in writing, and providing an update on the enquiries.
5. Ongoing support: Provide support to the patient to ensure that the patient understands the discussions, which may include providing emotional support.
6. Record keeping: The registered provider must keep a copy of all correspondence with the relevant person.

Managing the Timeline

Regulation 20 does not set a fixed number of working days for each step; the legal test is “as soon as reasonably practicable,” which is why many providers build tighter internal timescales into their own duty of candour policy to avoid drift.

In our experience, this is where organisations most commonly fall short. There is rarely a problem with intent. The problem is that the timeline has no single owner, and without one, steps slip. One named individual should own that timeline from the moment an incident is flagged. Not the practice manager in general, but a specific, identified person.

We recommend a simple tracker: date of the incident, date of verbal notification, date of written notification, date of any follow-up, reviewed weekly until the case is closed.

Building the duty of candour trigger into the significant event process itself works well in practice, so it is not a separate step someone has to remember to activate on top of everything else. If the person cannot be contacted, or declines to engage, the regulation allows the provider to demonstrate that reasonable attempts were made, with those attempts documented.

The Apology: What It Is and What It Is Not

One of the most consistent concerns we hear from clinicians and clinic owners is the fear that apologising creates legal exposure. This concern is understandable, and it is also not supported by the evidence. A crucial part of the duty of candour is the apology. Apologising is not an admission of liability. This is the case regardless of whether you are in the health or social care, or public or private sectors.

In many cases it is the lack of timely apology that pushes people to take legal action.

The CQC says that the apology that must be given under the duty of candour is “an expression of sorrow or regret in respect of a notifiable safety incident.” It is a statement of openness and regret, not a legal concession.

Both the CQC and NHS Resolution make clear that an apology must be given but it is not an admission of fault or liability, and they reassure healthcare practitioners that their indemnity insurance will not be affected by them apologising to a patient. If a client is genuinely anxious about the specific wording of a notification or apology, we suggest involving their medical defence organisation early. Most have ready-made templates and guidance for precisely this situation.

Near-Misses: Why They Matter as Much as Incidents

Near-misses, incidents that were caught before any harm occurred, sit outside the statutory duty of candour threshold. However, how your practice handles them sends a clear signal to the CQC about the safety culture of your organisation. A strong near-miss log is one of the clearest positive indicators inspectors look for when assessing governance and safety.

Getting Regulation 20 right is rarely about knowing the legal text; it is about culture and process holding up under pressure, soon after something has gone wrong. That is where governance matters: a provider needs a clear route from “an incident has happened” to “has this met the notifiable threshold, and has someone acted on it,” backed by training so staff recognise a notifiable safety incident when they see one.

We encourage practices to log near-misses even when nothing actually went wrong. The volume and quality of near-miss reporting is itself evidence of a team that feels safe speaking up. For each one logged, the record should show the “so what”: what actually changed as a result of the event, whether that is a process adjustment, additional training, or a new system alert. The record of the event is not enough on its own.

The mindset shift that matters here is this: near-misses are evidence that a practice is paying attention. Inspectors understand the difference between a practice that logs near-misses as part of an active learning culture and one that appears to have no incidents at all. The latter rarely reflects reality.

Carrying Out a Meaningful Root Cause Analysis

When an incident does occur, the investigation that follows is as important as the notification process. CQC inspectors look not only at whether the duty of candour steps were completed, but whether learning has taken place and whether changes have been made as a result. A root cause analysis (RCA) is the structured approach used to identify what actually caused an incident.

The starting question should always be: what about the system allowed this to happen? Not: who did this? Individual error is rarely the true root cause. It is usually enabled by a gap somewhere in the system, whether that is in labelling, a missed alert, or how a workflow is designed. Two commonly used methods are:

• The fishbone diagram (also called an Ishikawa diagram), which maps contributing factors across categories such as people, processes, equipment, environment, and communication, allowing a team to visualise all the conditions that converged around an incident.
• The “5 Whys” technique, which involves asking “why” repeatedly in response to each answer, pushing past the surface-level explanation until the systemic cause becomes visible. It is worth pushing past the first answer, because that is rarely where the real cause sits.

We recommend documenting contributing factors rather than a single cause. Most clinical incidents involve more than one thing going wrong at the same time. A medication error might involve a prescribing decision, a dispensing process, and a communication gap between clinicians. Identifying only one of those does not protect future patients. Every RCA should close with specific, owned, dated actions. Something concrete, such as “add an allergy alert to the system by [date], owned by [name],” rather than a vague line like “staff to be more careful.”

Inspectors will look for evidence of all three elements working together: that the provider recognises when the duty applies, that it follows the specific procedural steps correctly, and that this sits within a wider culture of openness rather than existing only as a compliance exercise.

How the CQC Assesses Compliance with Regulation 20

The CQC assesses compliance with the duty through a range of methods. It may follow up on:

• Incidents reported through notifications that have been marked as triggering the duty of candour, to ensure the process was followed through appropriately.
• Incidents that were not marked as triggering the duty, but appear from their descriptions and harm levels to have required it.
• Reports of incidents from the public or people using services that appear to have met the threshold of a notifiable safety incident, to ensure the specific requirements of the duty of candour took place.

They may also ask people who have experienced a notifiable safety incident how the provider responded.

The enforcement position is serious. The ultimate responsibility for ensuring the duty of candour is carried out rests with the registered person. Where the CQC finds that a provider has failed to meet the requirements of Regulation 20, it can take regulatory action. This may include issuing a warning notice, imposing conditions on registration, or, in serious cases, taking steps towards cancellation of registration.

Failure to comply with Regulation 20 is also a criminal offence where the breach has involved a notifiable safety incident resulting in severe harm or death and no apology has been made. This is not a regulation that can be treated as a paperwork exercise completed after the fact.

What the CQC Looks For

In practice, what CQC inspectors look for is coherence between three things: the policy that exists on paper, the process that is actually followed when an incident occurs, and the culture of the team that makes both of those work under pressure.

A well-written duty of candour policy that sits in a folder and is not reflected in staff training or incident records will not satisfy an inspector. Neither will a team that is broadly open and honest but cannot point to documented evidence that the specific procedural steps were followed in the cases where they were required.

Building a Practice That Passes Inspection

Meeting Regulation 20 consistently requires a system, not just goodwill. The practices and clinics that perform well against this regulation tend to share a few common characteristics.

1. They have a duty of candour policy that is specific, not generic. It names who is responsible for owning each step, sets internal timescales tighter than the legal minimum, and includes a decision flowchart for identifying whether the threshold has been met. It is reviewed at least annually, and staff can find it.
2. They have integrated the duty of candour trigger into their existing significant event or incident reporting process, so it is not a separate step that has to be remembered in the middle of an already stressful situation.
3. They keep a clear, auditable record for every notifiable incident: the date it occurred, the date of verbal notification, the date of written notification, the content of the apology, the outcome of the investigation, and the actions taken as a result. That record is retained and can be produced at inspection.
4. They train staff regularly, not just at induction. Regulation 20 training should cover how to recognise a notifiable safety incident, how to have a candid conversation with a patient, and how to record what was said and when. Role-playing a difficult conversation is more effective than reading a policy document.
5. They treat near-miss reporting as a positive indicator of safety culture, not a liability, and their records reflect this.

How DKJ Support Services Can Help

If you are unsure whether your current duty of candour process is inspection-ready, or if a recent incident has prompted a review of your governance arrangements, DKJ Support Services works with GP practices and private clinics to assess and strengthen compliance across all fundamental standards — including Regulation 20.

We can review your existing policy and incident records, help you build or update your duty of candour process, support you through a significant event review, and prepare your team for CQC assessment. Whether you are preparing for a first inspection, responding to a warning notice, or simply wanting assurance that your systems are sound, we are here to help.

Get in touch with our team at DKJ Support Services to find out how we can support your practice.