Duty of Candour in Care: What Regulation 20 Asks For
The duty of candour is Regulation 20. This covers what counts as a notifiable safety incident in a care service, the steps you must take in order, and what your policy needs to say.
By HeroDocs Team
The duty of candour is Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. In one line, it says you must be open and honest with people when something goes wrong in their care. The law is short. What trips services up is knowing which incidents trigger it, and proving you did the steps.
Both questions are answered below, ending with what your policy needs to say.
What the duty says
Regulation 20(1) is one sentence. A registered person, which means your provider and your registered manager, must act in an open and transparent way with relevant persons about the care and treatment given to service users in carrying on a regulated activity. A regulated activity is the service CQC registered you to run.
So the duty is yours personally, not only the company's.
That general duty applies all the time. The detailed steps only kick in when a notifiable safety incident happens.
The "relevant person" is normally the service user themselves. It is someone acting lawfully on their behalf in three cases only:
The service user has died.
They are under 16 and not competent to decide about their own care or treatment.
They are 16 or over and lack capacity in relation to the matter.
That last one is decision by decision. Someone can lack capacity about this incident and have capacity about everything else.
What counts as a notifiable safety incident
The threshold for a care provider is not the same as the one for an NHS trust, and that catches services out more than anything else in Regulation 20.
Regulation 20(8) is for health service bodies, meaning NHS trusts, NHS foundation trusts and special health authorities. It triggers on harm that could result, and it uses the terms severe harm and moderate harm.
Everyone else works to Regulation 20(9). That includes your care home, and it includes an independent hospital. It triggers only on harm that appears to have happened, and it lists five specific outcomes instead.
Do not judge your own incident against an NHS threshold.
For a care provider, a notifiable safety incident is any unintended or unexpected incident that happened to a service user during a regulated activity which, in the reasonable opinion of a health care professional:
(a) appears to have resulted in
the death of the service user, where the death relates directly to the incident rather than to the natural course of their illness or underlying condition
an impairment of sensory, motor or intellectual functions which has lasted, or is likely to last, for a continuous period of at least 28 days
changes to the structure of the service user's body
the service user experiencing prolonged pain or prolonged psychological harm
the shortening of the service user's life expectancy
(b) or requires treatment by a health care professional to prevent
the death of the service user, or
any injury which, if left untreated, would lead to one of the outcomes above
Two of those need translating. "Changes to the structure of the body" is the one care services meet most often. Think a fracture, a wound needing stitches, or a lost tooth. "Impairment of sensory, motor or intellectual functions" means a loss of sight, hearing, movement or thinking that is still there after 28 days, or looks likely to be. Those are examples to help you recognise the wording, not a list from the regulation.
"Prolonged" also has a fixed meaning, in both places it appears. Prolonged pain and prolonged psychological harm each mean at least 28 continuous days, whether the person has already had them or is likely to.
Three things follow from the wording. It covers unintended and unexpected events. It needs the reasonable opinion of a health care professional, not a manager's hunch. And limb (b) catches the incident where harm was stopped from getting worse: someone had to be treated to prevent death, or to prevent an injury that would otherwise have led to one of the outcomes above.
Two falls, one night
Mrs A slips in the lounge. Staff check her over, she has a bruised hip, and she needs nothing beyond observation. No lasting harm. That is not a notifiable safety incident, though it still goes in your accident book.
Mr B falls in the bathroom and fractures his wrist. A fracture is a change to the structure of his body, and the paramedic says so. That is a notifiable safety incident, and Regulation 20 starts running from the moment you know.
Mrs A and Mr B are made up. In a real case the judgement belongs to the health care professional.
The steps, in order
Regulation 20 requires all of the following. The order below is a practical one, not the regulation's numbering. Support is the exception: it starts straight away and runs through the conversation, rather than waiting its turn.
Notify in person, as soon as reasonably practicable. One or more of your representatives tells the relevant person face to face.
Give a true account of the facts as you know them. Best knowledge at the time, not a finished investigation.
Say what further enquiries you believe are appropriate.
Apologise. The regulation defines an apology as an expression of sorrow or regret about the incident.
Offer reasonable support, including support during the notification itself.
Keep a secure written record of the meeting.
Follow up in writing. The written notification repeats the account, says what enquiries have been done, gives the results, and repeats the apology.
Keep a copy of all that correspondence.
If the relevant person cannot be contacted in person, or declines to speak to your representative, steps 1 to 7 do not apply. The record still does. Write down every attempt you made to reach them, and when. That record is your only evidence that you tried.
Saying sorry is not admitting liability
This is the fear that stops staff picking up the phone. Section 2 of the Compensation Act 2006 says an apology, an offer of treatment or other redress does not of itself amount to an admission of negligence or breach of statutory duty.
Put that sentence in your policy. It is the single line that gives a nervous manager permission to do the right thing.
Duty of candour is not a CQC notification
They are separate duties with separate audiences. The duty of candour is owed to the person and their family. A statutory notification is owed to CQC. One event can need both, and doing one does not discharge the other.
Our guide to CQC statutory notifications covers which events must go to CQC and on which form.
What your duty of candour policy must say
A policy that just copies Regulation 20 leaves staff no better off. Make yours answer these:
The trigger, in your words. Restate the Regulation 20(9) threshold as your staff would say it, with two or three examples from your own service.
Who decides. Name the role that takes the "reasonable opinion of a health care professional", and who covers nights and weekends.
The clock. "As soon as reasonably practicable" needs a local meaning. Say what you expect, for example the same working day.
Who speaks to the family. Name the role, and name the deputy.
The words. Include a short script for the apology and the account. Staff freeze without one.
The written follow-up. Say who drafts it, who checks it, and the target date.
The record. Say where the record lives, and that correspondence is kept with it.
The learning. What changes after the event, and how staff hear about it.
For the structure that suits your policy set, see our guide to care home policies and procedures.
Where HeroDocs fits
HeroDocs keeps your duty of candour policy in one place, with its owner, version and review date. When guidance changes, you get an alert naming the policies affected. You can send the policy to your team for sign-off, and the timestamped record shows who has read it, which is what an inspector asks for after an incident.
Sources
The Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, regulation 20.
Regulation 20, paragraphs (8) and (9) as amended, which set the separate thresholds for health service bodies and other registered persons.
Compensation Act 2006, section 2.
Last checked: 26 September 2026.
---