Regulation 20: Duty of candour

Reg 20(1) sets the principle: providers must act in an open and transparent way with service users in relation to care and treatment. Reg 20(2) sets the operational duty: as soon as reasonably practicable after the provider becomes aware that a notifiable safety incident has occurred, the provider must notify the relevant person (the patient, or where the patient cannot consent or has died, the representative defined in Reg 20(6)), include an apology, and follow up the verbal notification with a written notification.

Reg 20(7) sets the harm thresholds: death directly resulting from the incident, severe harm (permanent lessening of bodily, sensory, motor, physiological or intellectual function), moderate harm (harm requiring a moderate increase in treatment and significant but not permanent harm), or prolonged psychological harm. Reg 20(5) defines an apology as “an expression of sorrow or regret in respect of a notifiable safety incident”. The regulation does not set a number-of-days deadline on the written step; “as soon as reasonably practicable” is the standard.

Reg 20 was introduced into the 2014 Regulations after the Francis Report into Mid Staffordshire NHS Foundation Trust, mandatory from November 2014 for NHS bodies and April 2015 for all other registered providers. The duty did not exist during the 2011 dental commencement wave or the 2013 GP commencement wave.

CQC inspects Reg 20 by sampling closed incidents at moderate harm or above and tracing the candour trail on each. The inspector expects to see the verbal notification recorded with the date, the team member who delivered it, who they spoke to, where the conversation happened, and a summary of what was said. The inspector expects to see the written follow-up attached, with the content required by Reg 20(3): a true account of all the facts the provider knows about the incident at the time of the notification, what further enquiries the provider believes are appropriate, an apology in the Reg 20(5) form, the steps the provider is taking. The inspector also expects to see whether any interim updates or outcome correspondence with the relevant person have been recorded.

The single most common Reg 20 gap is the written follow-up. Teams have the conversation, record that the conversation happened, then never send the written letter, or send it months late, or send it but never record the send. Inspectors sample the attachment specifically; an absent or undated written follow-up is a Reg 20 compliance failure even when the verbal step was honoured properly. The second most common gap is the apology wording: “we are sorry that you feel” is an apology to feelings, not to the incident, and is not what Reg 20(5) requires. “We are sorry that this happened” is the form the regulation expects. The third gap is the not-applicable closure on a moderate-harm incident with thin reasoning, which reads to the inspector as the team avoiding the conversation; sound reasoning is fine, thin reasoning is a finding. The fourth gap, frequent in providers who pre-date the 2014 introduction, is treating Reg 20 and Reg 18 (Registration Regulations) as the same duty; they are different (the duty to the patient versus the duty to the regulator), and honouring one does not satisfy the other.

Verivius runs Reg 20 as the duty-of-candour sub-lifecycle attached to the originating incident. When an incident at the moderate-harm threshold or above is logged, the candour panel opens automatically. The verbal step captures the named team member, the relevant person, the conversation summary, and the apology. The written step requires an attached letter copy before closure. The deadline clock is visible from the moment the panel opens. The audit trail at inspection shows the chain end to end.

Sample policy template: Reg 20 Duty of candour. Article worth reading alongside: what does Duty of Candour actually require?