Sample policy · Diagnostic imaging

Incidental findings disclosure and follow-up policy (diagnostic imaging)

Statutory anchor: Regulation 20 (duty of candour) and Regulation 12 (safe care and treatment), Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). The professional primary sources for incidental-findings practice are the RCR reporting and alerts standards, the Society of Radiographers and BMUS ultrasound guidelines, and GMC Good Medical Practice; these are named in the sources section below. · primary source

1. What the regulation says

Disclosure of a clinically important incidental finding engages the duty of candour where a notifiable safety incident occurs.

Registered persons must act in an open and transparent way with relevant persons in relation to care and treatment provided to service users in carrying on a regulated activity. (Reg 20(1) (the headline duty))

As soon as reasonably practicable after becoming aware that a notifiable safety incident has occurred a registered person must (a) notify the relevant person that the incident has occurred in accordance with paragraph (3), and (b) provide reasonable support to the relevant person in relation to the incident, including when giving such notification. (Reg 20(2) (the notification trigger))

The notification to be given under paragraph (2)(a) must (a) be given in person by one or more representatives of the registered person, (b) provide an account, which to the best of the registered person's knowledge is true, of all the facts the registered person knows about the incident as at the date of the notification, (c) advise the relevant person what further enquiries into the incident the registered person believes are appropriate, (d) include an apology, and (e) be recorded in a written record which is kept securely by the registered person. (Reg 20(3) (the notification content))

The notification given under paragraph (2)(a) must be followed by a written notification given or sent to the relevant person containing (a) the information provided under paragraph (3)(b), (b) details of any enquiries to be undertaken in accordance with paragraph (3)(c), (c) the results of any further enquiries into the incident, and (d) an apology. (Reg 20(4) (the written notification))

Regulation 12 adds the safe-care duties that this policy operationalises:

Care and treatment must be provided in a safe way for service users. (Reg 12(1) (the headline duty))

assessing the risks to the health and safety of service users of receiving the care or treatment, (Reg 12(2)(a) (risk assessment))

doing all that is reasonably practicable to mitigate any such risks, (Reg 12(2)(b) (risk mitigation))

where responsibility for the care and treatment of service users is shared with, or transferred to, other persons, working with such other persons, service users and other appropriate persons to ensure that timely care planning takes place to ensure the health, safety and welfare of the service users. (Reg 12(2)(i) (shared / transferred responsibility))

The full text is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/20 and https://www.legislation.gov.uk/uksi/2014/2936/regulation/12. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

When a notifiable safety incident happens, you must tell the affected person (or the person acting on their behalf) in person as soon as reasonably practicable, give a truthful account, offer support, apologise, and follow up in writing. A notifiable safety incident is a specific legal term: the service must apply the correct Regulation 20 definition for its provider type, and independent providers should not use the NHS trust "moderate harm or worse" wording as a shortcut. The regulation does not set a number-of-days deadline for the written stage; any specific deadline you see in Verivius is an operational default, not a legal duty. Regulation 12 also requires care and treatment to be provided in a safe way. The regulation lists the areas a provider must address, including risk assessment, risk mitigation, staff competence, safe premises, safe equipment, sufficient equipment and medicines, medicines safety, infection prevention and shared-care planning. A clinically important incidental finding that is not communicated or followed up is a safe-care failure, and may also trigger the duty of candour.

3. Purpose

This policy sets out how the Service records, escalates, communicates and follows up incidental findings identified during imaging.

It aims to make sure that clinically important findings do not depend on informal memory, individual goodwill or a single untracked message.

4. Sources to verify before adoption

5. Scope

This policy applies to:

The policy applies to self-pay, private, insured and NHS-contracted patients.

6. Incidental finding process

The Service records every clinically relevant incidental finding and follows it through to documented communication or documented transfer of responsibility.

6.1 Identifying an incidental finding

An incidental finding is a finding outside the clinical question or purpose of the scan.

Examples include:

Staff do not dismiss a finding because it is outside the booked scan package.

6.2 Urgency category

The reporter or senior clinician assigns an urgency category according to local protocol.

The local category set covers:

The Service defines these categories locally against current RCR, SCoR and specialty guidance. This template does not invent response deadlines.

6.3 Referrer communication

The Service communicates urgent or significant findings to the referring clinician or agreed responsible clinician.

The communication record includes:

Where the patient self-referred and no referrer exists, the Service follows its direct-to-patient and onward-referral pathway.

6.4 Patient communication

The Service tells the patient only within the role, competence and local protocol that applies to the examination.

Patient communication may include:

Staff do not give false reassurance where a finding needs follow-up.

6.5 Obstetric and direct-to-consumer scans

For obstetric scans, the Sonographer follows the local fetal-anomaly escalation pathway.

The pathway records:

The Service checks current professional guidance before adoption because direct-to-consumer obstetric scanning carries specific communication risk.

7. Follow-up confirmation

The Service keeps a follow-up tracker for urgent and significant incidental findings.

The tracker records:

The Service closes the tracker only when communication has been documented or the Registered Manager has recorded a decision that responsibility has been transferred.

8. Incident response

The Service treats a missed, delayed or uncommunicated incidental finding as an incident.

The incident review considers:

The Service records the incident under the relevant category, including incidental_finding_not_actioned where the taxonomy is available.

9. Responsibilities

10. Recording requirements

The Service keeps the following records:

Records are kept in the Service governance records and linked to the patient record where relevant.

11. Audit cadence

The Service uses the following Verivius default audit rhythm unless current RCR, SCoR, GMC, CQC or local source material requires a different rhythm:

Audit findings are recorded as improvement actions with an owner and review date.

12. Version control and review date

The Service keeps a controlled copy of this policy. The footer or document-control table records:

13. Related records

Review cadence: annual or on regulatory change, whichever sooner. Owner: Registered Manager.

14. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

15. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

16. Document control

Version Date Author Changes
v1 2026-06-10 Verivius (sample) Conformed to the Verivius policy standard; original sections preserved and renumbered, statutory anchor and verbatim regulation text added.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the tenant's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 10 June 2026