Sample policy · Reg 12

Lone Working and Personal Safety Policy

Statutory anchor: Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999 (the employer's duty to assess and control risks to lone workers). This policy also engages Regulation 12 (safe care and treatment), Regulation 17 (good governance) and Regulation 18 (staffing) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). · primary source

Download the PDF

The PDF version of this template is the same content, formatted for adaptation in your document control system. The disclaimer above is repeated on the PDF cover.

Download PDFTalk to a consultant

Verivius pack version v1.1, 2026-07-21

1. What the regulation says

The primary legal duty for lone working sits in the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999, which require employers to assess and control the risks to staff who work alone. Within CQC-regulated activity, the same lone-working risks are captured by Regulation 12 (safe care and treatment), which is reproduced verbatim below:

Care and treatment must be provided in a safe way for service users. (Reg 12(1) (the headline duty))

assessing the risks to the health and safety of service users of receiving the care or treatment, (Reg 12(2)(a) (risk assessment))

doing all that is reasonably practicable to mitigate any such risks, (Reg 12(2)(b) (risk mitigation))

ensuring that persons providing care or treatment to service users have the qualifications, competence, skills and experience to do so safely, (Reg 12(2)(c) (staff competence))

ensuring that the premises used by the service provider are safe to use for their intended purpose and are used in a safe way, (Reg 12(2)(d) (premises safety))

The full text of the regulation is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/12. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

Care and treatment must be provided in a safe way. The regulation lists the areas a provider must address, including risk assessment, risk mitigation, staff competence, safe premises, safe equipment, sufficient equipment and medicines, medicines safety, infection prevention and shared-care planning. For lone working, the underlying duty comes from the Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999: the employer must assess the risks faced by people who work alone or without close supervision and put proportionate controls in place before the work happens.

3. Purpose

The purpose of this policy is to make sure that [Service Name] identifies, assesses and manages risks to staff and others who work alone or without close or direct supervision.

Lone working is not limited to domiciliary care. It may occur in clinics, reception areas, treatment rooms, diagnostic services, private consulting rooms, patient transport, mobile services, out-of-hours work, home visits, remote administration, premises opening and closing, and situations where a staff member is physically present but cannot easily get help.

This policy supports safe care and treatment, good governance, staff safety, safeguarding, health and safety duties and effective service continuity.

4. Policy warning

No person must be expected to work alone in a situation where the risk has not been assessed and controlled.

Where lone working creates a foreseeable risk of violence, abuse, medical emergency, unsafe premises, distress, lone clinical decision-making, manual handling, driving, community visit risk or inability to summon help, the manager must put proportionate controls in place before the work happens.

Some tasks may be unsuitable for lone working. If a task cannot be made safe, it must not be carried out by a lone worker.

5. Scope

This policy applies to lone working in:

It applies whether the person is employed, self-employed, contracted, agency, volunteer or working on behalf of the provider.

6. Definition

A lone worker is someone who works by themselves without close or direct supervision, or who may not be seen or heard by another person for a period of time while carrying out work for the service.

A person may be a lone worker even inside a building where other people are present if they cannot easily call for help or are working in isolation.

7. Principles

The service will:

8. Responsibilities

The provider is responsible for ensuring that safe lone-working arrangements and resources are in place.

The Registered Manager is responsible for implementing this policy, ensuring risk assessments are completed, and reviewing incidents, missed contacts and concerns.

Managers and supervisors are responsible for agreeing lone-working arrangements, monitoring staff and escalating risks.

Staff are responsible for following lone-working procedures, using agreed check-in systems, reporting concerns and refusing unsafe lone-working tasks where immediate risk cannot be controlled.

8.1 Local adoption decisions

Before lone working is authorised, the provider records:

9. Lone-working risk assessment

The manager must assess lone-working risk before lone working starts and whenever circumstances change.

The assessment must consider:

The risk assessment must record controls, named owner and review date.

10. When lone working may not be suitable

The service must consider whether lone working should be prohibited or restricted where:

If controls cannot reduce risk to an acceptable level, the task must not proceed as lone work.

11. Controls

Controls may include:

Controls must be practical and understood by the worker.

12. Check-in and monitoring

The service must maintain contact with lone workers at intervals proportionate to risk.

The procedure must state:

A check-in system is only safe if someone is responsible for responding when contact is missed.

12.1 Missed check-in workflow

When a check-in is overdue, the named monitor:

  1. Checks the rota, itinerary, last confirmed location and whether a system or signal failure explains the missed contact.
  2. Attempts contact through the agreed primary and backup routes at the local escalation intervals.
  3. Alerts the duty manager when the grace period expires and records every attempt, time and response.
  4. Contacts the agreed emergency contact, premises contact or colleague where this is proportionate and does not create additional risk.
  5. Calls emergency services immediately where there is reason to suspect assault, medical emergency, missing-person risk or other imminent danger. Staff do not wait for every routine step where risk is urgent.
  6. Confirms the worker's safety and location before closing the alert. A message or device signal alone is not treated as confirmation where circumstances remain unclear.
  7. Records the cause, outcome, welfare support, risk-assessment change and improvement action before lone working resumes where a control failed.

13. Violence, abuse and harassment

Staff must not be expected to tolerate violence, threats, harassment, sexual comments, discriminatory abuse or intimidation as part of the role.

Where a worker feels unsafe, they may leave the situation if it is safe to do so and must contact the manager or emergency services as required.

The service must review incidents involving:

The manager must consider incident reporting, safeguarding, police contact, staff support, risk assessment update and whether future lone working is safe.

14. Home visits and community working

Where staff visit homes or community locations, the service must assess:

Staff must not enter or remain in an environment they reasonably believe is unsafe.

15. Clinics, treatment rooms and premises

Where staff work alone in premises, the manager must assess:

Staff must know what to do if someone refuses to leave, becomes aggressive or if they become unwell themselves.

16. Remote and home working

For remote or home working, the service must consider:

Remote workers must still have access to supervision, support and emergency escalation.

17. Medical suitability

Managers must consider whether a person is medically suitable to work alone where there is a known health condition that may affect safety.

This must be handled sensitively and lawfully.

Where required, the service may seek occupational health advice and agree reasonable adjustments.

18. Training

Lone workers must receive training appropriate to their role.

Training may include:

Training must be recorded.

19. Incidents and missed contact

The following must be reported and reviewed:

The Registered Manager must review whether controls need to change.

20. Records

The service must keep:

21. Audit

The Registered Manager must audit lone-working arrangements at least annually, or more often where risk is high.

The audit must check:

Findings must be added to the action plan or risk register where required.

22. Related policies

This policy should be read with:

23. Review

This policy will be reviewed annually, or sooner following a lone-working incident, violence or harassment concern, missed check-in, safeguarding concern, CQC finding, change in service model or change in health and safety guidance.

24. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

25. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

26. Document control

Version Date Author Changes
v1.1 2026-07-21 Verivius (sample) Added local check-in decisions, a timed missed-contact workflow and current HSE source links.
v1 2026-06-10 Verivius (sample) Initial sample template, conformed to the Verivius policy standard.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the provider's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

What good looks like here

Written from an ex-CQC inspector's chair, but the point is safe, well-led care your team can stand behind. Each row shows what strong evidence looks like, what thin evidence looks like, and where the expectation comes from.

Lone working is the one risk where the person who would normally raise the alarm is the person in trouble, so a control failure here is silent by design: nobody notices at the time, and you learn about it afterwards from the worker, if they choose to tell you. That silence changes the care as much as it changes the safety. A carer or clinician who feels unsafe in a household shortens the visit, leaves the dressing change or the difficult conversation about a relative's behaviour, and does not come back to the safeguarding concern they half formed on the doorstep, so the person using the service quietly receives a thinner service and never finds out why. It also reaches the person directly: visits moved, cancelled, or suddenly carried out by two people they have never met are usually a lone-working decision nobody explained to them. The evidence trail matters because unanswered check-ins, harassment absorbed as part of the role and addresses that staff privately avoid are the early signal that a rota is being run on hope, and a well-led service wants to catch that long before an incident makes it visible.

  1. A lone-working risk assessment is completed before the person is sent to work alone, and it names the controls, an owner and a review date, not a task carried out alone that was never assessed or a generic assessment that fits no actual visit or premises.

    Strong evidence: The lone-working risk assessment held for the task or setting, recording controls, a named owner and a review date, which the policy requires before lone working starts and whenever circumstances change (Section 9).

    Weak evidence: One service-wide lone-working risk assessment that covers every visit, every clinic room and every out-of-hours lock-up at once, with control lines such as "be aware of your surroundings" and "use professional judgement", the owner field blank and a review date already in the past. Or an assessment signed off weeks after the first solo home visit had already happened, which shows the visit set the assessment rather than the assessment permitting the visit.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Management of Health and Safety at Work Regulations 1999, reg 3(1)(a) and reg 3(6)

  2. The check-in arrangement has a named person responsible for responding when contact is missed and defined escalation timescales, not a check-in 'system' that logs calls but leaves no one watching or acting, which the policy warns is not safe.

    Strong evidence: The check-in procedure setting out when and how the worker checks in, who monitors it, what happens if a check-in is missed, escalation timescales and when emergency contacts or police are called (Section 12).

    Weak evidence: A lone-worker app or a staff messaging group where people post "in" and "out" but nobody is named as the person watching it, and there is no stated point at which silence becomes a call to the worker, then to their emergency contact, then to the emergency services. Ask who was monitoring last Thursday evening and the honest answer is "whoever was around", which means on a bad night it would have been nobody.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  3. Missed check-ins, lone-worker device failures and inability to reach a worker are followed up and logged, not left unnoticed until the next shift.

    Strong evidence: The missed-contact log and incident records the policy requires, tested against the annual audit check that missed contacts are acted on (Sections 19, 20, 21).

    Weak evidence: The check-in system shows gaps and unacknowledged alerts, but no missed-contact log and no incident record sits behind any of them, because the worker turned up safe the next morning so it was treated as nothing. Flat lone-worker device batteries and known dead-signal addresses are common knowledge in the team and appear in no record at all, and the risk assessment reads exactly as it did before, so the same blind spot is never designed out.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  4. Tasks that cannot be made safe alone, known violence, two-person manual handling, or intimate care carrying a boundary risk, are prohibited or restricted from lone work, not quietly still done by one person under rota pressure.

    Strong evidence: The lone-working risk assessment and the policy's list of situations where lone working must be prohibited or restricted, with the rule that a task must not proceed as lone work if controls cannot reduce risk to an acceptable level (Section 10).

    Weak evidence: A rota showing single-handed calls at an address where the care plan or the incident history already records aggression, or a move that needs two people and equipment, with nothing recorded about who decided one person was enough. Or a policy list of restricted tasks that no manager can match to a single real case, meaning the restrictions live in the document while the scheduling carries on unchanged.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Manual Handling Operations Regulations 1992, reg 4(1)(a); Management of Health and Safety at Work Regulations 1999, reg 4 and Schedule 1

  5. Violence, threats and harassment are reviewed rather than absorbed as 'part of the role', with the manager considering an incident report, a safeguarding referral to the local authority where abuse is alleged, police contact, staff support and a revised risk assessment.

    Strong evidence: The incident records for violence and harassment and the staff-support records the policy requires, showing the manager's consideration of reporting, safeguarding, police contact and risk-assessment review (Sections 13, 20).

    Weak evidence: Staff can readily describe being shouted at, touched, or followed to their car, but the incident system holds none of it, because reports are only raised when there is a physical injury. Where a report does exist it closes with "staff member reassured" and records nothing about whether the same incident also raised a concern about a person using the service or another adult at risk that should reach the local authority, whether the police were contacted, what support the worker was offered, or whether the risk assessment and the future lone-working arrangement were changed.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  6. The lone-working audit is carried out at least annually and feeds the action plan or risk register, and the lone-worker training it checks for is recorded rather than assumed.

    Strong evidence: The completed annual audit covering current risk assessments, check-in use, missed contacts, escalation knowledge and training completeness, with findings carried to the action plan or risk register, alongside the recorded training log (Sections 18, 21).

    Weak evidence: An audit document dated within the year that only confirms risk assessments exist, with no sample of actual check-in use, no count of missed contacts and no test of whether staff can say who they would ring at nine in the evening. Findings that never reach the action plan or the risk register, and a training claim resting on "covered at team meeting" with no dated record naming who was there and what they can now do.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

Related

Last verified 20 July 2026

Spotted something to improve?

These are sample templates, not the last word. If you would change a wording, or want to help us confirm a detail, tell us and we will look at it.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 21 July 2026