Regulation 12: Safe care and treatment
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936)
Last verified by Verivius on 19 May 2026. Next review due 17 Aug 2026.
Plain British summary
Care and treatment must be provided in a safe way. The regulation lists nine things you have to do: assess risks, mitigate them, ensure staff competence, ensure premises and equipment are safe and used safely, supply equipment and medicines in sufficient quantities, manage medicines safely, control infection, and work with anyone else who shares responsibility for the service user's care. Reg 12 is one of the most-cited regulations in CQC enforcement action.
Full text on legislation.gov.uk. Treat quotes on this page as targeted excerpts, not as a substitute for the regulation.
Targeted verbatim quotes (10)
“Care and treatment must be provided in a safe way for service users.”
Reg 12(1) (the headline duty)
“assessing the risks to the health and safety of service users of receiving the care or treatment,”
Reg 12(2)(a) (risk assessment)
“doing all that is reasonably practicable to mitigate any such risks,”
Reg 12(2)(b) (risk mitigation)
“ensuring that persons providing care or treatment to service users have the qualifications, competence, skills and experience to do so safely,”
Reg 12(2)(c) (staff competence)
“ensuring that the premises used by the service provider are safe to use for their intended purpose and are used in a safe way,”
Reg 12(2)(d) (premises safety)
“ensuring that the equipment used by the service provider for providing care or treatment to a service user is safe for such use and is used in a safe way,”
Reg 12(2)(e) (equipment safety)
“where equipment or medicines are supplied by the service provider, ensuring that there are sufficient quantities of these to ensure the safety of service users and to meet their needs,”
Reg 12(2)(f) (sufficient equipment + medicines supply)
“the proper and safe management of medicines,”
Reg 12(2)(g) (medicines management)
“assessing the risk of, and preventing, detecting and controlling the spread of, infections, including those that are health care associated,”
Reg 12(2)(h) (infection control)
“where responsibility for the care and treatment of service users is shared with, or transferred to, other persons, working with such other persons, service users and other appropriate persons to ensure that timely care planning takes place to ensure the health, safety and welfare of the service users.”
Reg 12(2)(i) (shared / transferred responsibility)
What Verivius does for you
Incident lifecycle
Incidents logged under "Safe care and treatment" subcategories drive investigation, action, and closure with full audit trail. The category taxonomy flags which subcategories carry a Duty of Candour assessment trigger.
What this regulation does NOT say
Industry-folklore claims that are commonly attributed to this regulation but do not appear in the primary source.
Every clinical event must be logged as an incident.
Reg 12 requires risks to be assessed and mitigated, not every event to be logged. Verivius's incident register is one way of evidencing the mitigation of identified risks; what counts as a loggable incident is a matter of your own policy informed by clinical risk standards (NHS PSIRF, NPSA Being Open framework, and the harm-level thresholds in Reg 20 for Duty of Candour purposes).