Sample policy · Diagnostic imaging

Incidental findings disclosure and follow-up policy (diagnostic imaging)

Statutory anchor: Regulation 20 (duty of candour) and Regulation 12 (safe care and treatment), Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). The professional primary sources for incidental-findings practice are the RCR reporting and alerts standards, the Society of Radiographers and BMUS ultrasound guidelines, and GMC Good Medical Practice; these are named in the sources section below. · primary source

1. What the regulation says

Disclosure of a clinically important incidental finding engages the duty of candour where a notifiable safety incident occurs.

Registered persons must act in an open and transparent way with relevant persons in relation to care and treatment provided to service users in carrying on a regulated activity. (Reg 20(1) (the headline duty))

As soon as reasonably practicable after becoming aware that a notifiable safety incident has occurred a registered person must (a) notify the relevant person that the incident has occurred in accordance with paragraph (3), and (b) provide reasonable support to the relevant person in relation to the incident, including when giving such notification. (Reg 20(2) (the notification trigger))

The notification to be given under paragraph (2)(a) must (a) be given in person by one or more representatives of the registered person, (b) provide an account, which to the best of the registered person's knowledge is true, of all the facts the registered person knows about the incident as at the date of the notification, (c) advise the relevant person what further enquiries into the incident the registered person believes are appropriate, (d) include an apology, and (e) be recorded in a written record which is kept securely by the registered person. (Reg 20(3) (the notification content))

The notification given under paragraph (2)(a) must be followed by a written notification given or sent to the relevant person containing (a) the information provided under paragraph (3)(b), (b) details of any enquiries to be undertaken in accordance with paragraph (3)(c), (c) the results of any further enquiries into the incident, and (d) an apology. (Reg 20(4) (the written notification))

Regulation 12 adds the safe-care duties that this policy operationalises:

Care and treatment must be provided in a safe way for service users. (Reg 12(1) (the headline duty))

assessing the risks to the health and safety of service users of receiving the care or treatment, (Reg 12(2)(a) (risk assessment))

doing all that is reasonably practicable to mitigate any such risks, (Reg 12(2)(b) (risk mitigation))

where responsibility for the care and treatment of service users is shared with, or transferred to, other persons, working with such other persons, service users and other appropriate persons to ensure that timely care planning takes place to ensure the health, safety and welfare of the service users. (Reg 12(2)(i) (shared / transferred responsibility))

The full text is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/20 and https://www.legislation.gov.uk/uksi/2014/2936/regulation/12. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

When a notifiable safety incident happens, you must tell the affected person (or the person acting on their behalf) in person as soon as reasonably practicable, give a truthful account, offer support, apologise, and follow up in writing. A notifiable safety incident is a specific legal term: the service must apply the correct Regulation 20 definition for its provider type, and independent providers should not use the NHS trust "moderate harm or worse" wording as a shortcut. The regulation does not set a number-of-days deadline for the written stage; any specific deadline you see in Verivius is an operational default, not a legal duty. Regulation 12 also requires care and treatment to be provided in a safe way. The regulation lists the areas a provider must address, including risk assessment, risk mitigation, staff competence, safe premises, safe equipment, sufficient equipment and medicines, medicines safety, infection prevention and shared-care planning. A clinically important incidental finding that is not communicated or followed up is a safe-care failure, and may also trigger the duty of candour.

3. Purpose

This policy sets out how the Service records, escalates, communicates and follows up incidental findings identified during imaging.

It aims to make sure that clinically important findings do not depend on informal memory, individual goodwill or a single untracked message.

4. Sources to verify before adoption

5. Scope

This policy applies to:

The policy applies to self-pay, private, insured and NHS-contracted patients.

6. Incidental finding process

The Service records every clinically relevant incidental finding and follows it through to documented communication or documented transfer of responsibility.

6.1 Identifying an incidental finding

An incidental finding is a finding outside the clinical question or purpose of the scan.

Examples include:

Staff do not dismiss a finding because it is outside the booked scan package.

6.2 Urgency category

The reporter or senior clinician assigns an urgency category according to local protocol.

The local category set covers:

The Service defines these categories locally against current RCR, SCoR and specialty guidance. This template does not invent response deadlines.

6.3 Referrer communication

The Service communicates urgent or significant findings to the referring clinician or agreed responsible clinician.

The communication record includes:

Where the patient self-referred and no referrer exists, the Service follows its direct-to-patient and onward-referral pathway.

6.4 Patient communication

The Service tells the patient only within the role, competence and local protocol that applies to the examination.

Patient communication may include:

Staff do not give false reassurance where a finding needs follow-up.

6.5 Obstetric and direct-to-consumer scans

For obstetric scans, the Sonographer follows the local fetal-anomaly escalation pathway.

The pathway records:

The Service checks current professional guidance before adoption because direct-to-consumer obstetric scanning carries specific communication risk.

7. Follow-up confirmation

The Service keeps a follow-up tracker for urgent and significant incidental findings.

The tracker records:

The Service closes the tracker only when communication has been documented or the Registered Manager has recorded a decision that responsibility has been transferred.

8. Incident response

The Service treats a missed, delayed or uncommunicated incidental finding as an incident.

The incident review considers:

The Service records the incident under the relevant category, including incidental_finding_not_actioned where the taxonomy is available.

9. Responsibilities

9.1 Training and competence

Staff must be trained and assessed as competent for the part of the incidental-findings pathway they perform. Reporting and acquiring practitioners work within their professional registration, credentialing and locally approved scope. Administration staff must not make clinical judgements, but must be able to recognise an urgent communication instruction and follow the approved contact and escalation sequence.

Competence records must show:

The Service reassesses competence after a missed or delayed finding, an identified recording gap or a concern about role boundaries. Staff remain supervised or restricted from the affected task until the Lead Clinician records that competence has been restored.

10. Recording requirements

The Service keeps the following records:

Records are kept in the Service governance records and linked to the patient record where relevant.

11. Audit cadence

The Service uses the following Verivius default audit rhythm unless current RCR, SCoR, GMC, CQC or local source material requires a different rhythm:

Audit findings are recorded as improvement actions with an owner and review date.

12. Version control and review date

The Service keeps a controlled copy of this policy. The footer or document-control table records:

13. Related policies and records

Review cadence: annual or on regulatory change, whichever sooner. Owner: Registered Manager.

14. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

15. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

16. Document control

Version Date Author Changes
v1 2026-06-10 Verivius (sample) Conformed to the Verivius policy standard; original sections preserved and renumbered, statutory anchor and verbatim regulation text added.
v1.1 2026-07-21 Verivius (sample) Added role-based competence controls and linked companion policies for the incidental-findings pathway.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the tenant's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

Awaiting final verification

The urgent-findings pathway, fetal-anomaly escalation and professional-source currency (Royal College of Radiologists and SoR/BMUS) must be confirmed by an imaging specialist for your service.

What good looks like here

Written from an ex-CQC inspector's chair, but the point is safe, well-led care your team can stand behind. Each row shows what strong evidence looks like, what thin evidence looks like, and where the expectation comes from.

The finding this policy is built around is the one nobody went looking for: an abnormality outside the reason the scan was booked, spotted in passing on an examination requested for something else. Because it sits outside the clinical question, it is the easiest thing in imaging to lose. The person came in about a knee and leaves without knowing the same images raised a question about something more serious, or attends a private reassurance obstetric scan and goes home reassured while a suspected fetal anomaly sits unactioned. There is often no referrer expecting a result, no automatic recall and no one downstream watching for it, so a clinically important finding can rest entirely on one person remembering to pass it on. The follow-up tracker and the confirmation-of-receipt record are what turn that memory into a system: they are the evidence that a finding reached the person or the clinician who could act on it, and the reason a delayed or uncommunicated finding is caught before it becomes harm the service must later be candid about.

  1. Every clinically important incidental finding is tracked through to documented communication or a documented transfer of responsibility, so a finding outside the reason for the scan does not depend on one person remembering to pass it on. What good looks like is a live follow-up entry that stays open until receipt is confirmed, not a report filed on the assumption that someone downstream will read it.

    Strong evidence: The incidental-findings follow-up tracker showing, for each urgent or significant finding, the report sent date and time, the direct communication, the confirmation received, any failed contact attempts, and closure only on documented communication or a Registered Manager's recorded decision that responsibility has transferred.

    Weak evidence: A finding recorded in the report but with no tracker entry, so nothing shows anyone told the patient or the responsible clinician. A tracker closed while the confirmation-received field is still blank. Or a run where every urgent finding is marked communicated on the same day the report was typed, with no acknowledgement from the person who was supposed to act on it.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 12(2)(b) and (i)

  2. Where a delayed or uncommunicated incidental finding causes or could cause harm, it is tested against the Regulation 20 notifiable-safety-incident threshold that applies to your own provider type, finding by finding, with the reasoning recorded for the ones ruled out as well as the ones taken forward. An independent provider applies its own statutory definition, not the NHS trust "moderate harm or worse" wording as a shortcut.

    Strong evidence: The duty-of-candour assessment recorded on the incident, naming the provider-type definition and the legal source checked, with the person told what happened as soon as reasonably practicable, a genuine apology captured in the record, and the written follow-up sent and evidenced.

    Weak evidence: The candour field on a missed-finding incident left blank rather than opened or explicitly ruled out with reasoning. A provider that is not a health service body applying the health-service-body wording and treating "moderate harm" as its trigger. A note reading "patient informed" with no date, no record of what was said and no apology, or a written stage ticked as sent with nothing attached to prove it reached the person.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 20, with the notifiable-safety-incident thresholds at reg 20(8) (health service bodies) and reg 20(9) (any other registered person), notification as soon as reasonably practicable and a truthful account at reg 20(2)(a) and reg 20(3), the apology at reg 20(3)(d) (apology defined at reg 20(7)), and the written follow-up at reg 20(4)

  3. Everyone communicates within the role, competence and scope they are credentialed for, and no one gives false reassurance or a diagnosis beyond the reporter's scope. A sonographer on a direct-to-consumer reassurance scan who suspects a fetal anomaly follows the local escalation pathway rather than either over-reading the image or sending the person home reassured.

    Strong evidence: Competence records mapping each person to the modality, role and part of the pathway they perform, including the limit of their patient-communication authority, with reassessment recorded after a missed or delayed finding, and administration staff evidenced as able to recognise an urgent communication instruction and follow the contact sequence without making a clinical judgement.

    Weak evidence: A competence file that certifies "imaging" generically with no note of who may say what to a patient. Administration staff left to decide whether a finding is urgent. Or a direct-to-consumer obstetric service with no written fetal-anomaly escalation pathway, so a suspected anomaly rests on the individual sonographer's judgement in the room.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 12(2)(c)

  4. Each finding is given an urgency category against a local scheme built from current professional standards, so how promptly a finding is acted on follows a named source rather than the habit of whoever is on that day. What good looks like is a category set the service can point to its source for, not a response window invented in-house and applied inconsistently.

    Strong evidence: The local urgency-category set with the RCR alerts and notification standard and specialty ultrasound guidance it was built from named and dated, and reporting practitioners recording the assigned category on each finding.

    Weak evidence: A category set with no cited source, or one that quietly hard-codes a response deadline the service cannot trace to any standard. Findings with no urgency category assigned at all, or the same finding categorised differently by different reporters with nothing to reconcile them.

    The recognised standard from a professional or clinical body, such as NICE or a royal college. Not a legal duty, but the accepted mark of safe practice, and a departure needs a documented reason.

  5. Urgent and significant findings reach the referring or responsible clinician and the service confirms they landed, with failed attempts escalated rather than left as a sent report nobody acknowledged. The safe position is a finding whose receipt is confirmed, not a portal message or fax assumed to have arrived.

    Strong evidence: The referrer communication record showing the finding summary, urgency category, the named person contacted, the contact route, date and time, the follow-up action requested, confirmation the report was sent, and any failed contact attempts, with escalation recorded where no acknowledgement is received.

    Weak evidence: A report-transmission log with no acknowledgement field, so "sent" is treated as "received". Failed contact attempts recorded nowhere, so a self-referred patient with no registered GP falls out of the pathway unnoticed. Escalation that fires only when a complaint arrives months later.

    The recognised standard from a professional or clinical body, such as NICE or a royal college. Not a legal duty, but the accepted mark of safe practice, and a departure needs a documented reason.

  6. A missed, delayed or uncommunicated finding is treated as an incident and drives a fail-safe change to the pathway, so the system is strengthened rather than the individual simply reminded to be careful. Themes across failed contacts, complaints and incidents are reviewed by a named senior clinician, and the pathway is audited against current source material.

    Strong evidence: The incident record for a missed or delayed finding, categorised, reviewed for whether harm occurred or could have occurred and whether duty of candour applies, with a tracked improvement action that changes the process, held alongside the periodic review of incidental-finding themes and report-transmission exceptions.

    Weak evidence: A missed finding logged as a one-off with an action reading "staff reminded" and no change to the fail-safe. Audit reports scored highly with no actions and no re-audit. Or a themes review that never happens in the busy quarters, so a recurring failed-contact pattern is never seen. The audit cadence itself is a Verivius default, not a fixed statutory interval.

    What the regulator expects to see. Not a law in itself, but CQC judges you against it, so an inspector will look for it and expect a reason where you depart from it.

Related

Last verified 20 July 2026

Spotted something to improve?

These are sample templates, not the last word. If you would change a wording, or want to help us confirm a detail, tell us and we will look at it.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 21 July 2026