Sample policy · Reg 17

Record Keeping and Documentation Standards Policy

Statutory anchor: Regulation 17 (good governance), Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). This policy also engages UK GDPR and the Data Protection Act 2018, and supports Regulation 12 (safe care and treatment). · primary source

Download the PDF

The PDF version of this template is the same content, formatted for adaptation in your document control system. The disclaimer above is repeated on the PDF cover.

Download PDFTalk to a consultant

Verivius pack version v1.1, 2026-07-19

1. What the regulation says

Systems or processes must be established and operated effectively to ensure compliance with the requirements in this Part. (Reg 17(1): the umbrella duty)

assess, monitor and improve the quality and safety of the services provided in the carrying on of the regulated activity (including the quality of the experience of service users in receiving those services) ... assess, monitor and mitigate the risks relating to the health, safety and welfare of service users and others who may be at risk which arise from the carrying on of the regulated activity. (Reg 17(2)(a) and (b): quality and risk)

maintain securely an accurate, complete and contemporaneous record in respect of each service user, including a record of the care and treatment provided to the service user and of decisions taken in relation to the care and treatment provided. (Reg 17(2)(c): accurate service-user record)

The full text of the regulation is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/17. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

You have to run effective systems and processes to comply with everything else in Part 3. The regulation lists six things those systems must enable in particular: quality assessment and improvement, risk management, accurate service-user records, accurate employment and management records, seeking and acting on feedback, and continually evaluating and improving how you process all this. If CQC requests a written report on quality and risk plus your improvement plans, you have 28 days from the day after the request.

3. Purpose

The purpose of this policy is to make sure that records created by [Service Name] are accurate, complete, contemporaneous, secure and useful for safe care, good governance and inspection evidence.

Good records are not an administrative extra. They are part of safe care. They show what was known, what was decided, what was done, who was involved and what changed as a result.

This policy supports Regulation 17 good governance, Regulation 12 safe care and treatment, the Mental Capacity Act, safeguarding duties, data protection law and professional standards.

4. Policy warning

If it is not recorded, the service may not be able to evidence that it happened.

Records must not be falsified, backdated, deleted to conceal information, altered without audit trail, or written in a way that misleads the reader.

Poor record keeping can place people at risk, undermine continuity of care, prevent learning, and create evidence of poor governance.

5. Scope

This policy applies to all records relating to:

Records may be paper-based, electronic, photographic, audio, video or held in another format.

5.1 Local arrangements before adoption

Before adoption, [Service Name] records:

The provider must test one record from creation through correction, sharing, retention and retrieval. Staff must know which system is authoritative and must not keep unapproved shadow notes or duplicate files that bypass access and retention controls.

6. Principles

All records must be:

7. Responsibilities

All staff are responsible for making accurate records within their role.

Managers are responsible for checking record quality, acting on gaps and making sure staff have the training and time needed to keep records properly.

The Registered Manager is responsible for ensuring that record-keeping systems support safe care, confidentiality, audit and inspection readiness.

The provider is responsible for ensuring that records are securely stored, backed up where applicable, and retained lawfully.

8. Operational record workflow and timing

Staff follow this sequence whenever they create or handle a record:

  1. Select the authoritative record: use the approved system and record type for the event, decision or communication. Link supporting evidence rather than creating an uncontrolled duplicate.
  2. Record promptly: enter the date and time of the event, relevant facts, assessment, decision, rationale, action, communication and follow-up as soon as reasonably possible.
  3. Authenticate: identify the author, role and time of entry. Confirm that required fields and attachments are complete before finalising the entry.
  4. Check continuity and safety: make risks, changed needs, escalation, consent decisions and outstanding actions visible to the next authorised person who may provide care or oversight.
  5. Correct transparently: preserve the original entry, identify the correction, author, date, time and reason, and use the system's audit-trail function. Never overwrite or backdate to conceal an error.
  6. Share lawfully: confirm the recipient, lawful purpose and minimum necessary information, use an approved secure route and record what was shared and why.
  7. Retain and protect: apply access controls, the approved retention schedule, legal holds and secure disposal. Reconcile paper or downtime records into the authoritative system without losing the original timing or author.
  8. Audit and improve: sample record quality, address individual gaps promptly and create a training, supervision, risk or improvement action where failures are repeated or affect safety.

8.1 When records must be made

Records must be made as soon as reasonably possible after the event, decision, care episode, contact or review.

Records must be made on the same day unless there is a clear reason why this is not possible.

Where a record is made later, the entry must state:

Late entries must be clearly identifiable as late entries.

9. Content of records

Records must include enough information to explain:

Records must be written so that another competent person could understand the situation and continue care safely.

10. Factual and respectful language

Records must be factual, professional and respectful.

Staff must avoid:

Where professional judgement is recorded, it must be clear what facts or observations support that judgement.

11. Corrections and amendments

Records must not be erased, overwritten or altered in a way that hides the original entry.

Where a correction is needed, the record must show:

For paper records, the original entry must remain readable. For electronic records, the system should retain an audit trail.

12. Care and treatment records

Care and treatment records must include, where relevant:

Records must reflect the person's current needs and must be updated when those needs change.

13. Risk assessments and care plans

Risk assessments and care plans must be reviewed:

Staff must follow the current care plan and risk assessment. If the plan cannot be followed, this must be escalated and recorded.

14. Consent, capacity and best interests

Records relating to consent and capacity must show:

Consent must be reviewed where the decision changes, the person's condition changes, or there is reason to believe consent may no longer be valid.

15. Incident, complaint and safeguarding records

Incident, complaint and safeguarding records must include:

These records must link to action plans, risk register entries or care-plan updates where relevant.

16. Staff records

Staff records must include information relevant to employment, role suitability, training, supervision and ongoing fitness.

This includes, where applicable:

Access to staff records must be restricted to authorised people.

17. Governance records

Governance records must include:

Governance records must show not only that issues were identified, but that the service acted and reviewed whether improvement happened.

18. Confidentiality and access

Records must be kept confidential and accessed only by people who need the information for a lawful and legitimate purpose.

Staff must not access records out of curiosity or because they know the person.

Records must not be left visible or accessible to unauthorised people.

Electronic records must be protected by appropriate access controls, passwords and role-based permissions.

Paper records must be stored securely when not in use.

19. Sharing records

Information may be shared where there is a lawful basis and it is necessary for care, treatment, safeguarding, legal duty, regulatory duty, professional duty or serious risk management.

Where information is shared, the record should show:

Staff must seek advice if they are unsure whether information should be shared.

20. Retention and disposal

Records must be retained and disposed of in line with the service's retention schedule, legal requirements, professional guidance and data protection duties.

Records must be destroyed securely when retention has expired and there is no lawful reason to keep them.

The service must maintain evidence of secure destruction where appropriate.

21. Record audit

The Registered Manager must audit record quality at least quarterly.

The audit must check:

Findings must be recorded and actioned.

22. Staff training

Staff must receive training appropriate to their role on:

Where record keeping is poor, the manager must consider supervision, retraining, competency assessment or formal action.

23. Related policies in this pack

This policy should be read with:

24. Review

This policy will be reviewed annually, or sooner following a CQC finding, serious incident, data breach, record audit failure, safeguarding concern, complaint theme, change in legislation or change in documentation system.

25. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

26. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

27. Document control

Version Date Author Changes
v1 2026-06-10 Verivius (sample) Initial sample template, conformed to the Verivius policy standard.
v1.1 2026-07-19 Verivius (sample) Added local system and authority decisions plus an end-to-end creation, correction, sharing, retention and audit workflow.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the provider's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

What good looks like here

Written from an ex-CQC inspector's chair, but the point is safe, well-led care your team can stand behind. Each row shows what strong evidence looks like, what thin evidence looks like, and where the expectation comes from.

A care record is the one place the next carer, nurse or duty doctor looks before they act, usually without ever meeting the person who wrote it. When an allergy is missing, a risk assessment was never updated after a fall, or a decision was reached in conversation and never written down, the next person carries on as though nothing had changed, and the person receiving care pays for the gap. The value of a contemporaneous, attributable record is not that it satisfies an audit: it is that a stranger on the next shift can pick up care safely and a deteriorating person is noticed in time. When something does go wrong and the account is tested by a family, a coroner or a safeguarding enquiry, the record made at the time is what shows what was known and what was decided, and a record tidied afterwards to look better protects no one.

  1. Record-keeping quality is audited at the stated cadence, and the most recent completed audit produced dated findings and an action log, not a one-off tick-sheet.

    Strong evidence: The last completed record-quality audit and its schedule, with findings converted into actions carrying owners, due dates and completion evidence.

    Weak evidence: A single tick-sheet marked all green, with no date, no sample size and no named findings, or an audit whose gaps were noted but never turned into actions with owners and due dates. The last one is many months old, or the same recording failures reappear each cycle with nothing done in between.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  2. Entries in live care records are contemporaneous, accurate, attributable and timestamped, so the colleague picking the care up next can see what was done and when.

    Strong evidence: A sample of care records showing entries made at the time or as soon as reasonably possible, with any late entry clearly labelled and its reason recorded.

    Weak evidence: Care notes written up in a block at the end of the shift or the next day, with nothing marking them as late entries and no reason given for the delay. Entries initialled with no key to who the initials belong to, an agency shift recorded under a permanent staff member's login, or a timestamp that captures when the note was typed rather than when the care was actually given.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 17(2)(c)

  3. Corrections preserve the original entry and the system holds a tamper-evident audit trail, so a later reader can still see what the record first said and why it changed.

    Strong evidence: A corrected record opened to show its change history, or the electronic-system audit log.

    Weak evidence: Paper entries overwritten or covered with correction fluid so the original can no longer be read, or an electronic record edited in place with no version history. The system's audit-trail function is switched off, or nobody can open a change history when asked, and corrections carry no author, time or reason.

    The recognised standard from a professional or clinical body, such as NICE or a royal college. Not a legal duty, but the accepted mark of safe practice, and a departure needs a documented reason.

  4. A record shows what was decided and why, and links to the care plan, action or risk it changed, so the trail from event to changed care can be followed.

    Strong evidence: A live example where an incident, safeguarding or risk record links to a care-plan update, an action plan and the learning taken.

    Weak evidence: An incident, safeguarding or risk record that closes without the care plan or risk assessment ever changing, or a decision logged as a bare outcome such as agreed to monitor, with no rationale and no onward action. Learning that sits only in a meeting minute and never reaches the person's live record, so the trail from event to changed care cannot be followed.

    What the regulator expects to see. Not a law in itself, but CQC judges you against it, so an inspector will look for it and expect a reason where you depart from it.

  5. Access to records is role-based and approved, and it is removed promptly when someone leaves or changes role, under a defined retention schedule, so a person's information is seen only by those who need it for their care.

    Strong evidence: The role-based access list with its approval record and a leaver or access review, plus a retention schedule covering care, clinical, staff and governance records.

    Weak evidence: Shared or generic logins on the care system, or a leaver whose account is still live and could still open records weeks after their last shift. No record of who approved each person's access level, every role able to see every record regardless of need, and a retention schedule that is missing, or that covers care records only and says nothing about staff, clinical and governance records.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

Related

Last verified 20 July 2026

Audit this policy

Record keeping and confidentiality procedure checklist

A policy is the intent; the evidence is what a CQC inspector actually asks to see. This matching checklist turns the policy above into the records to keep, the audit to run, and the places small services most often fall short.

Open the Record keeping and confidentiality procedure checklist

Spotted something to improve?

These are sample templates, not the last word. If you would change a wording, or want to help us confirm a detail, tell us and we will look at it.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 19 July 2026