Sample policy · Domiciliary care

Entry to the home, keys and access policy (domiciliary care)

Statutory anchor: Regulation 12 (safe care and treatment), Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). This policy also engages Regulation 10 (dignity and respect). · primary source

1. What the regulation says

Care and treatment must be provided in a safe way for service users. (Reg 12(1) (the headline duty))

assessing the risks to the health and safety of service users of receiving the care or treatment, (Reg 12(2)(a) (risk assessment))

doing all that is reasonably practicable to mitigate any such risks, (Reg 12(2)(b) (risk mitigation))

Regulation 10 adds the dignity duty that this policy operationalises when a worker enters someone's home:

Service users must be treated with dignity and respect. (Reg 10(1): the headline duty)

The full text is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/12 and https://www.legislation.gov.uk/uksi/2014/2936/regulation/10. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

Care and treatment must be provided in a safe way. The regulation lists the areas a provider must address, including risk assessment, risk mitigation, staff competence, safe premises, safe equipment, sufficient equipment and medicines, medicines safety, infection prevention and shared-care planning. Regulation 12 is central to CQC's safety expectations. Alongside this, service users must be treated with dignity and respect: in particular, you have to protect their privacy, support their autonomy, independence and involvement in the community, and have due regard to any relevant protected characteristics under the Equality Act 2010.

3. Purpose

A care worker enters someone's home, often when the person cannot get to the door. How the Service gets in, holds keys and protects access codes matters for the person's safety, their security and their dignity. This policy sets out how the Service agrees access, keeps keys and codes safe, and behaves as a guest in the person's home.

The Service must verify this policy against data protection law and its own insurance arrangements before adoption.

4. Scope

This policy applies to:

5. Roles and responsibilities

6. Access and key-control procedure

The Service follows this procedure for every person:

  1. Agree access before care starts. Record how workers enter, who agreed it, any capacity or representative involvement, and the backup route if access fails.
  2. Check the arrangement is safe. Confirm whether the person answers the door, a keyholder attends, a key safe is used, or the Service holds a key.
  3. Record only what staff need. Store access details securely and share them only with workers attending that person.
  4. Issue and return keys safely. Sign held keys in and out, using a reference that does not reveal the person's address or name.
  5. Check access at each visit. Workers follow the care plan, enter only for agreed care, and leave the home secure.
  6. Escalate no access. Workers follow the no-access route, contact the office or on-call, and stay involved until the person's safety is confirmed.
  7. Respond to lost keys or exposed codes. Secure the person, consider lock or code change, assess data-breach risk, and open an incident or action where needed.
  8. Review after change. Review access details when a person moves, care ends, a worker leaves, a family arrangement changes, or a security concern is raised.

7. Consent to enter

The Service enters a home with the person's agreement. The access arrangement is agreed with the person, or their representative where the person cannot agree it themselves, and recorded in the care plan. A worker enters only to provide the agreed care, and only the parts of the home needed to provide it.

8. Agreed access arrangements

For each person, the Service records how workers get in. Common arrangements are:

The care plan names the arrangement, any backup, and who to contact if access fails.

9. Key-safe codes and access details are personal information

A key-safe code or a held key is, in effect, the key to someone's home. The Service treats access details as personal information and protects them:

10. Holding and recording keys

Where the Service holds a key to a property, it keeps a key record:

11. When a worker cannot get in

If a worker cannot get in or gets no reply, they follow the no-access procedure in the visit scheduling, missed and late visits policy: try to reach the person, use the agreed backup access, contact the office or on-call, and where there is reason to fear for the person's safety, call the emergency services and stay until help arrives. A worker does not force entry themselves.

12. Respecting the person's home

A worker is a guest in the person's home. The Service expects workers to:

13. Lost keys or a code that may be known to others

If a key is lost, or a worker believes a code may have become known to someone who should not have it, they report it to the office straight away. The Service acts to keep the person secure, which may include changing a lock or a code, and records what happened and what was done. Access codes are also reviewed when a worker who knew them leaves the Service.

14. Records and register links

The Service records, for each person, the agreed access arrangement and any backup, and keeps the key record up to date. The record should include:

No-access events and lost-key events are reviewed through the incident register where safety was affected. Repeated access failures are reviewed through the risk register or improvement-actions register.

15. Training and supervision

Staff who enter people's homes must be trained on access arrangements, confidentiality of key-safe codes, key handling, no-access escalation, personal safety and respectful conduct in the person's home. Supervisors check during spot checks and care reviews that workers follow the recorded access arrangement and leave the home secure.

16. Audit cadence

The Service checks, on a stated cadence, that:

The Registered Manager reviews the results and records the improvement actions that follow.

17. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

18. Related reading

19. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

20. Document control

Version Date Author Changes
v1.1 2026-07-12 Verivius (sample) Added role ownership, access and key-control procedure, record fields, register links, training and supervision controls.
v1 2026-06-10 Verivius (sample) Initial sample template, conformed to the Verivius policy standard.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the tenant's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

What a CQC inspector checks

The same requirement seen through an ex-CQC-inspector's eyes: what they actually ask to see, and the gap they are testing for.

  1. Whether the key record matches the keys the Service physically holds, reconciled by sign-out and return, not a register that has drifted from reality.

    Evidence: Keys given a reference that does not reveal the address or name, signed in and out so the Service knows who holds each key, stored securely at the office and not left in vehicles, and the audit confirming the key record matches the keys actually held (sections 6, 10 and 16).

  2. Whether key-safe codes are handled as personal information: stored securely, given only to the workers attending that person, and never written on the safe or anywhere that links them to the address.

    Evidence: Codes stored securely and shared only with the workers who need them, never written on the key safe, left on display in the home or written where they can be linked to the address, and the audit confirming codes and held keys are stored securely and not labelled with addresses (sections 9 and 16).

  3. Whether access codes and keys are actually reviewed and, where needed, changed when a worker who knew them leaves the Service, not left live after a leaver.

    Evidence: Access codes reviewed when a worker who knew them leaves the Service, and the audit confirming access codes are reviewed when workers leave (sections 13 and 16).

  4. Whether a lost key or a code that may be known to others triggers securing the person, a lock or code change and a data-breach review, not an informal note. The inspector tests one real lost-key event through to its outcome.

    Evidence: Lost keys or exposed codes reported straight away, action to keep the person secure including changing a lock or code, review by the data protection lead as a possible personal data breach, and the record field for whether the event opened an incident, safeguarding concern, data-breach record, risk entry or improvement action (sections 5, 13 and 14).

  5. Whether the agreed access arrangement and its backup are recorded with the person's consent, including the representative or best-interests basis where the person could not agree it themselves.

    Evidence: The access arrangement agreed with the person, or their representative where the person cannot agree it, and recorded in the care plan, and the record fields for who agreed the access arrangement and when and any representative or best-interests decision relied on (sections 7, 8 and 14).

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 10 June 2026