Sample policy · Reg 12

Health and Safety and COSHH Policy

Statutory anchor: Health and Safety at Work etc. Act 1974, the Management of Health and Safety at Work Regulations 1999, and the Control of Substances Hazardous to Health Regulations 2002 (COSHH). For CQC-registered providers this policy also engages Regulation 12 (safe care and treatment) and Regulation 15 (premises and equipment) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). · primary source

Download the PDF

The PDF version of this template is the same content, formatted for adaptation in your document control system. The disclaimer above is repeated on the PDF cover.

Download PDFTalk to a consultant

Verivius pack version v1.1, 2026-07-19

1. What the regulation says

The primary legal duties for this policy sit in the Health and Safety at Work etc. Act 1974, the Management of Health and Safety at Work Regulations 1999 and the Control of Substances Hazardous to Health Regulations 2002. For CQC-registered providers, the same arrangements are also tested through Regulation 12 (safe care and treatment) and Regulation 15 (premises and equipment), quoted verbatim below.

Care and treatment must be provided in a safe way for service users. (Reg 12(1) (the headline duty))

assessing the risks to the health and safety of service users of receiving the care or treatment, (Reg 12(2)(a) (risk assessment))

doing all that is reasonably practicable to mitigate any such risks, (Reg 12(2)(b) (risk mitigation))

ensuring that the premises used by the service provider are safe to use for their intended purpose and are used in a safe way, (Reg 12(2)(d) (premises safety))

ensuring that the equipment used by the service provider for providing care or treatment to a service user is safe for such use and is used in a safe way, (Reg 12(2)(e) (equipment safety))

Regulation 15 adds the premises and equipment duty this policy operationalises:

All premises and equipment used by the service provider must be ... clean, secure, suitable for the purpose for which they are being used, properly used, properly maintained, and appropriately located for the purpose for which they are being used. (Reg 15(1): the six criteria)

The full text is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/12 and https://www.legislation.gov.uk/uksi/2014/2936/regulation/15. The Health and Safety at Work etc. Act 1974 is at https://www.legislation.gov.uk/ukpga/1974/37 and the COSHH Regulations 2002 are at https://www.legislation.gov.uk/uksi/2002/2677. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

Care and treatment must be provided in a safe way. Regulation 12 lists the areas a provider must address, including risk assessment, risk mitigation, staff competence, safe premises, safe equipment, sufficient equipment and medicines, medicines safety, infection prevention and shared-care planning. Regulation 15 requires premises and equipment to be clean, secure, suitable for purpose, properly used, properly maintained and appropriately located. Alongside these, health and safety law and the COSHH Regulations require the service to assess and control workplace risks and hazardous substances, train staff, and report certain accidents and dangerous occurrences.

3. Purpose

The purpose of this policy is to make sure that [Service Name] manages health, safety and hazardous substances in a safe, lawful and proportionate way.

Health and safety is not separate from care quality. Unsafe premises, unsafe equipment, poor chemical control, poor maintenance, poor training or poor incident response can place people using the service, staff and visitors at risk.

This policy supports safe care and treatment, good governance, infection prevention and control, staff safety and compliance with health and safety law.

4. Policy warning

The service must not carry out work that exposes people to avoidable risk where the risk has not been assessed and controlled.

Hazardous substances must not be used, stored, mixed, decanted or disposed of unless staff have been trained and the COSHH assessment and safety data information are available.

If a hazard presents immediate risk, staff must stop the activity where safe to do so, make the area safe, escalate to the person in charge and record the concern.

5. Scope

This policy applies to:

5.1 Local arrangements before adoption

Before adoption, [Service Name] records:

The provider must walk through the arrangements at every location and confirm that staff can find the assessment, controls, emergency equipment, safety data information and escalation contacts at the point of work.

6. Principles

The service will:

7. Responsibilities

The provider is responsible for ensuring that suitable health and safety arrangements, resources and competent advice are in place.

The Registered Manager is responsible for day-to-day implementation, risk assessment, escalation, audit and action tracking.

Managers and senior staff are responsible for ensuring that safe systems are followed.

All staff are responsible for following procedures, using equipment safely, reporting hazards and not taking unsafe shortcuts.

Contractors are responsible for working safely and following the service's site rules.

8. Operational risk-control procedure

Staff and managers use this sequence for a new task, substance, hazard, change or reported concern:

  1. Protect people now: stop or isolate unsafe work where it is safe to do so, provide first aid or emergency support and prevent further exposure.
  2. Identify the hazard: define the task, substance, process, premises or equipment involved. For substances, check labels and current safety data sheets and include harmful dusts, fumes, biological agents or by-products created by the work.
  3. Assess exposure and risk: identify who may be harmed, how exposure could occur, likely consequences, existing controls, vulnerable groups and contractor or visitor exposure.
  4. Select controls: eliminate the hazard where reasonably practicable, substitute a safer option or apply engineering, procedural and access controls before relying on personal protective equipment.
  5. Implement and communicate: assign actions, provide equipment, information, instruction and training, and confirm that workers and contractors understand the controls and emergency response.
  6. Verify effectiveness: inspect practice, maintain equipment, check exposure controls and arrange monitoring or health surveillance where the assessment and current legal guidance require it.
  7. Record and review: document the assessment, owner, actions and review triggers. Review after change, concern, failed control, accident or near miss, and update the risk register where the risk needs governance oversight.
  8. Report and learn: record accidents, exposures and near misses, investigate causes, decide RIDDOR and other reporting routes separately, and track remedial action to verified closure.

The service must maintain health and safety risk assessments proportionate to the service type.

Risk assessments must consider:

Risk assessments must be reviewed after incidents, near misses, service changes, premises changes, new equipment, new substances, new procedures or changes in law or guidance.

9. Premises and equipment

The service must ensure that premises and equipment are clean, suitable, maintained, secure and used correctly.

This includes:

Faulty or unsafe equipment must be removed from use, labelled clearly and escalated.

10. COSHH: hazardous substances

The service must identify substances hazardous to health and complete COSHH assessments where required.

This may include:

The service must not assume that a household or commonly used product is safe in a care or clinical environment.

11. COSHH assessment

A COSHH assessment must consider:

Safety data sheets must be available where relevant, but a safety data sheet alone is not a COSHH assessment.

12. Control measures

The service must prevent exposure where possible.

Where exposure cannot be prevented, the service must reduce it using suitable controls, such as:

PPE must not be the only control where safer controls are reasonably available.

13. Storage and labelling

Hazardous substances must be stored safely and securely.

The service must ensure:

Unlabelled substances must not be used.

14. Staff training

Staff must receive training appropriate to their role.

Training must cover:

Staff must not use hazardous substances or equipment unless trained and authorised.

15. Contractors

Contractors must be managed safely.

The service must consider:

The provider remains responsible for ensuring that contracted work does not place people at risk.

16. Accidents, near misses and unsafe conditions

Accidents, near misses and unsafe conditions must be reported immediately.

The Registered Manager must consider:

Repeated health and safety concerns must be reviewed through governance.

17. RIDDOR

The Registered Manager must consider whether an accident, dangerous occurrence or work-related illness is reportable under RIDDOR.

The decision to report or not report must be recorded.

RIDDOR reporting does not replace CQC notification, safeguarding referral, incident review, duty of candour or internal learning processes where these also apply.

18. Monitoring and audit

The Registered Manager must audit health and safety and COSHH arrangements at least quarterly.

The audit must check:

Findings must be added to the action plan or risk register where required.

19. Related records

The service must keep:

20. Related policies

This policy should be read with:

21. Review

This policy will be reviewed annually, or sooner following an incident, RIDDOR report, CQC finding, health and safety audit failure, new hazardous substance, premises change, equipment change or change in legal or regulatory guidance.

22. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

23. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

24. Document control

Version Date Author Changes
v1 2026-06-10 Verivius (sample) Initial sample template, conformed to the Verivius policy standard.
v1.1 2026-07-19 Verivius (sample) Added local responsibilities and emergency routes plus an end-to-end hazard, COSHH control, verification and reporting procedure.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the provider's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

What good looks like here

Written from an ex-CQC inspector's chair, but the point is safe, well-led care your team can stand behind. Each row shows what strong evidence looks like, what thin evidence looks like, and where the expectation comes from.

Hazardous substances in a care setting are not held behind a factory line. They sit in the cupboard off the corridor people walk down, and whoever finds an unlabelled decanted bottle may be a person who is confused or distressed, a child, or someone living with dementia. That is why the labelling and storage trail carries more weight here than in most workplaces: concentrate poured into an unmarked drinks bottle is how ingestion happens, and a descaler used beside a chlorine-releasing agent in a small unventilated sluice is how staff and the people they support end up breathing chlorine gas. The hierarchy of control has a quality dimension too, because moving from a concentrate to a pre-diluted or wipe format usually removes the decanting step altogether and takes the risk out of the routine, rather than asking a care worker mid-shift to remember gloves. Contractors are the other live edge, since the building stays occupied while the work happens, and dust, isolated water, propped fire doors or hot work land on people who cannot easily move away from them. Kept properly, the run of assessments, labels, investigated causes and closed permits is what lets a manager see a hazard repeating before somebody is hurt by it.

  1. Every hazardous substance in use has a genuine Control of Substances Hazardous to Health (COSHH) assessment, not a folder of safety data sheets standing in for one. A supplier safety data sheet describes the product, not how your own staff use it, so filing it as though it were the assessment leaves the real exposure unassessed.

    Strong evidence: The COSHH assessment covering route of exposure, who may be exposed, existing controls, personal protective equipment (PPE), storage, spill and first-aid response and disposal (section 11), read against the policy's own statement that a safety data sheet alone is not a COSHH assessment.

    Weak evidence: A ring binder of supplier safety data sheets downloaded from the manufacturer's website, standing in for the assessment itself, with nothing recorded about how your staff actually use the product: no route of exposure, no named group who could be exposed, no spill or first-aid response and no disposal route. The other tell is arithmetic. The hazardous-substance inventory lists a dozen products and there are four assessments, or every assessment is worded identically because one was copied across the lot, including for substances nobody in the building handles the same way.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Control of Substances Hazardous to Health Regulations 2002, reg 6(1) (and reg 6(4) for recording)

  2. Controls follow the hierarchy, eliminating or substituting before engineering and procedural controls, with personal protective equipment (PPE) last, not PPE simply issued and relied on as the only control.

    Strong evidence: Risk-control step 4, which requires elimination, substitution then engineering, procedural and access controls before relying on PPE (section 8), and section 12's rule that PPE must not be the only control where safer controls are reasonably available.

    Weak evidence: The control column reads "wear gloves and apron" and stops there, with no ventilation, no closed dosing or dilution system, no limit on the quantity held, and nothing showing anyone asked whether a pre-diluted sachet or a wipe format could do the same job as the concentrate. Personal protective equipment issue records and glove sizes are often the fullest part of the file, which is itself the finding: gloves are being used as the control rather than as the last layer on top of one, and no assessment shows why the safer option was not reasonably practicable.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Control of Substances Hazardous to Health Regulations 2002, reg 7(2)-(4) and Schedule 2A; Personal Protective Equipment at Work Regulations 1992, reg 4(1)

  3. In the cleaning cupboard and clinical store, decanted containers are labelled and incompatible substances are kept apart, not just the original stock left labelled: the failure that matters is an unlabelled decanted bottle in use, which whoever picks it up cannot identify.

    Strong evidence: The storage and labelling controls requiring original labels retained, decanted substances labelled, incompatible substances not stored together and flammables controlled, with the rule that unlabelled substances must not be used (section 13).

    Weak evidence: A spray bottle labelled in marker pen as "blue" or "cleaner", a decanted container with no label at all, or a chlorine-releasing agent sitting on the same shelf as an acidic descaler or toilet cleaner. Thin too where the storage map exists on paper but nobody has walked it against the actual cupboard, so the record says secure while the door has been propped open since the lock broke and the key now lives in an office drawer.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  4. The decision on whether an event is reportable under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR) is recorded either way, and one report is not treated as discharging another duty: a RIDDOR report to the Health and Safety Executive does not stand in for a statutory notification to CQC or a safeguarding referral to the local authority, each of which is decided and made separately.

    Strong evidence: The recorded decision to report or not report under RIDDOR (section 17), with the policy's statement that RIDDOR reporting does not replace CQC notification, safeguarding referral, incident review or duty of candour.

    Weak evidence: Nothing on file wherever the answer was no. The record shows a report that was submitted, or it shows silence, with no note of who decided, on what basis, and when. Thin too where one line is treated as covering everything, so a report under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations is assumed to have dealt with the safeguarding referral to the local authority, the separate notification to CQC, and the duty of candour owed to the person where the incident meets the notifiable safety incident definition that applies to your own provider type. Each is a distinct duty with its own threshold and its own recipient. Reporting itself is statutory. Writing down the decision not to report is the Verivius default that keeps the reasoning auditable when the same event is questioned a year later.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  5. Accidents and near misses are investigated to a cause and a control is changed, not just logged: a recurring hazard recorded again and again with no action closed means the next person meets the same hazard the service already knew about.

    Strong evidence: The incident record, investigation, risk-assessment update and risk register entry (section 16), and risk-control step 8, which requires causes investigated and remedial action tracked to verified closure (section 8).

    Weak evidence: An accident and near-miss log with a healthy number of entries and an action column that says "staff reminded" or "discussed at handover". The clearest sign is the same hazard appearing repeatedly across the year, a wet floor at the same doorway, a trip on the same threshold, a splash during the same dilution step, with the risk assessment untouched between the entries. Recurrence is precisely the reason to suspect an assessment is no longer valid, which is what obliges a review, so a log that records the same event again and again while the assessment, the controls, the risk-register entry and the closure evidence all look as they did in January is the finding rather than the evidence.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  6. Contractors on site are actively controlled through competence, method statements, permits and completion records, rather than left to manage their own safety on the assumption that the provider is not responsible: the provider stays responsible for the safety of everyone in a building where contracted work is going on.

    Strong evidence: The contractor records covering competence, insurance and certification, work permits, risk assessments and method statements and completion records (section 15).

    Weak evidence: An invoice and a diary entry, and nothing else. No copy of the contractor's insurance or certification, no method statement for the work, no record of who inducted them or which areas they could access, and no completion sign-off confirming the area was made safe and clean before people used it again. Weak too where a permit was signed at the start of the job and never closed out, or where dust control, water isolation and hot work were left to the contractor to judge in a building that stayed occupied throughout. No statute names those particular documents, but together they are how a provider shows it ran its undertaking so that people not in its employment were not exposed to risk, and that duty stays with the provider whether or not the contractor also carries one.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

Related

Last verified 20 July 2026

Spotted something to improve?

These are sample templates, not the last word. If you would change a wording, or want to help us confirm a detail, tell us and we will look at it.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 19 July 2026