Regulation 20: Duty of candour

Reg 20(1) sets the principle: providers must act in an open and transparent way with service users in relation to care and treatment. Reg 20(2) sets the operational duty: as soon as reasonably practicable after the provider becomes aware that a notifiable safety incident has occurred, the provider must notify the relevant person (the patient, or where the patient cannot consent or has died, the representative defined in Reg 20(6)), include an apology, and follow up the verbal notification with a written notification.

Reg 20(7) defines the terms and then hands the test over: “notifiable safety incident” has the meaning given in paragraphs (8) and (9). Its definitions are severe harm (permanent lessening of bodily, sensory, motor, physiological or intellectual function), moderate harm (harm requiring a moderate increase in treatment and significant but not permanent harm), and prolonged pain or prolonged psychological harm (each lasting, or likely to last, at least 28 days). Reg 20(8) uses death, severe harm, moderate harm or prolonged psychological harm, and applies to a health service body such as an NHS trust. Reg 20(9) applies to everyone else and uses death, an impairment lasting at least 28 days, changes to the structure of the person’s body, prolonged pain or prolonged psychological harm, a shortened life expectancy, or an incident requiring treatment to prevent death or an injury that would otherwise lead to one of those. Reg 20(5) defines an apology as “an expression of sorrow or regret in respect of a notifiable safety incident”. The regulation does not set a number-of-days deadline on the written step; “as soon as reasonably practicable” is the standard.

Reg 20 was introduced into the 2014 Regulations after the Francis Report into Mid Staffordshire NHS Foundation Trust, mandatory from November 2014 for NHS bodies and April 2015 for all other registered providers. The duty did not exist during the 2011 dental commencement wave or the 2013 GP commencement wave.

CQC inspects Reg 20 by sampling closed incidents and tracing the candour trail on each. An inspector who knows the regulation will also look for incidents recorded below moderate harm where treatment prevented a listed outcome, because those are notifiable under Reg 20(9)(b) and are the ones a harm-level screen misses. The inspector expects to see the verbal notification recorded with the date, the team member who delivered it, who they spoke to, where the conversation happened, and a summary of what was said. The inspector expects to see the written follow-up attached, with the content required by Reg 20(3): a true account of all the facts the provider knows about the incident at the time of the notification, what further enquiries the provider believes are appropriate, an apology in the Reg 20(5) form, the steps the provider is taking. The inspector also expects to see whether any interim updates or outcome correspondence with the relevant person have been recorded.

The single most common Reg 20 gap is the written follow-up. Teams have the conversation, record that the conversation happened, then never send the written letter, or send it months late, or send it but never record the send. Inspectors sample the attachment specifically; an absent or undated written follow-up is a Reg 20 compliance failure even when the verbal step was honoured properly. The second most common gap is the apology wording: “we are sorry that you feel” is an apology to feelings, not to the incident, and is not what Reg 20(5) requires. “We are sorry that this happened” is the form the regulation expects. The third gap is the not-applicable closure on a moderate-harm incident with thin reasoning, which reads to the inspector as the team avoiding the conversation; sound reasoning is fine, thin reasoning is a finding. The fourth gap, frequent in providers who pre-date the 2014 introduction, is treating Reg 20 and Reg 18 (Registration Regulations) as the same duty; they are different (the duty to the patient versus the duty to the regulator), and honouring one does not satisfy the other.

Verivius runs Reg 20 as the duty-of-candour sub-lifecycle attached to the originating incident. Recording moderate harm, severe harm or death opens the candour panel, and the panel can be opened at any harm level, because the harm recorded is a clinical classification and not the legal test. The assessment puts the paragraph that applies to your own provider type and records your decision with your reasoning. The verbal step captures the named team member, the relevant person, the conversation summary, and the apology. The written step requires an attached letter copy before closure. The deadline clock is visible from the moment the panel opens. The audit trail at inspection shows the chain end to end.

Sample policy template: Reg 20 Duty of candour. Article worth reading alongside: what does Duty of Candour actually require?