Sample policy · Reg 12

Regulation 12 safe care and treatment policy template

Statutory anchor: Regulation 12 (safe care and treatment), Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (SI 2014/2936). · primary source

Download the PDF

The PDF version of this template is the same content, formatted for adaptation in your document control system. The disclaimer above is repeated on the PDF cover.

Download PDFTalk to a consultant

Verivius pack version v1, 2026-06-10

1. What the regulation says

Care and treatment must be provided in a safe way for service users. (Reg 12(1) (the headline duty))

assessing the risks to the health and safety of service users of receiving the care or treatment, (Reg 12(2)(a) (risk assessment))

doing all that is reasonably practicable to mitigate any such risks, (Reg 12(2)(b) (risk mitigation))

ensuring that persons providing care or treatment to service users have the qualifications, competence, skills and experience to do so safely, (Reg 12(2)(c) (staff competence))

ensuring that the premises used by the service provider are safe to use for their intended purpose and are used in a safe way, (Reg 12(2)(d) (premises safety))

ensuring that the equipment used by the service provider for providing care or treatment to a service user is safe for such use and is used in a safe way, (Reg 12(2)(e) (equipment safety))

where equipment or medicines are supplied by the service provider, ensuring that there are sufficient quantities of these to ensure the safety of service users and to meet their needs, (Reg 12(2)(f) (sufficient equipment + medicines supply))

the proper and safe management of medicines, (Reg 12(2)(g) (medicines management))

assessing the risk of, and preventing, detecting and controlling the spread of, infections, including those that are health care associated, (Reg 12(2)(h) (infection control))

where responsibility for the care and treatment of service users is shared with, or transferred to, other persons, working with such other persons, service users and other appropriate persons to ensure that timely care planning takes place to ensure the health, safety and welfare of the service users. (Reg 12(2)(i) (shared / transferred responsibility))

The full text of the regulation is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/12. Where this policy and the regulation diverge, the regulation wins.

2. Plain-English summary

Care and treatment must be provided in a safe way. The regulation lists the areas a provider must address, including risk assessment, risk mitigation, staff competence, safe premises, safe equipment, sufficient equipment and medicines, medicines safety, infection prevention and shared-care planning. Regulation 12 is central to CQC's safety expectations.

3. Scope

This policy applies to all employees, contractors, and external parties who deliver, support, or oversee regulated care or treatment at any location operated by . It covers every regulated activity the provider is registered for, every patient pathway from first contact to discharge, and every clinical and clinical-adjacent environment (consulting rooms, theatres, wards, recovery, mobile and home-based delivery, telephone and video consultations).

(Tenant updates the angle-bracket placeholder and confirms the location and activity coverage.)

4. Roles and responsibilities

(Tenant updates the named role-holders to fit their organisation.)

5. Procedure

The Reg 12 procedure operationalises the nine elements of Reg 12(2) across the patient pathway.

  1. Per-patient risk assessment. At first contact, the clinician completes a risk assessment proportionate to the service. The assessment records foreseeable risks (clinical, equipment, medicines, infection, environment), the mitigation in place, and any handover points where additional risk may arise.
  2. Mitigation in the care plan. The mitigations identified at assessment are recorded in the care plan and shared with every team member involved in the patient's care.
  3. Equipment safety. Every piece of clinical equipment used in regulated activity is on the equipment register, has a current service or calibration record, and a daily or per-use check is logged where required (resuscitation equipment, anaesthetic machines, point-of-care testing devices, sterilisation equipment, controlled-drugs cabinets).
  4. Medicines management. Medicines are obtained, stored, prepared, administered, recorded, and disposed of per the medicines policy. Controlled drugs follow the additional governance routine (named accountable officer, two-signature handling, register reconciliation, expiry checks). Medicines-related incidents are logged the same day.
  5. Infection prevention. Hand hygiene, PPE, decontamination, environmental cleaning, sharps handling, and waste segregation operate per the IPC policy. The IPC Lead surfaces any breach pattern at the monthly governance meeting.
  6. Incident recording. Every patient-safety event (incident, near miss, no-harm event) is logged the same working day. The lifecycle then runs through investigation to closure with action, per the incident reporting policy.
  7. Shared-care handover. Where care is shared with another provider (a GP, a community team, a private referrer, an NHS trust), handover communication is documented and the receiving party's acceptance is recorded.
  8. Duty of candour trigger. Any patient-safety incident that meets the notifiable-safety-incident threshold opens a duty-of-candour record per the Reg 20 policy. A notifiable safety incident is a specific legal term and the threshold differs by provider type, so the service applies the correct Regulation 20 definition for its provider type. The verbal-then-written notification trail is preserved on the source incident.
  9. Statutory notification trigger. Any patient-safety event meeting a notification trigger under the Care Quality Commission (Registration) Regulations 2009 spawns a notification record per the CQC statutory notifications policy. The notification is filed within the operational SLA.
  10. Periodic learning review. Aggregate patterns across incidents and near misses are reviewed quarterly at the clinical governance meeting. Learning that warrants a change to practice produces improvement actions; the actions are tracked to completion with evidence.

6. Training requirement

All clinical staff in scope complete the following at induction and on the cadence noted:

Non-clinical staff complete the basic Reg 12 awareness module at induction.

Training records are held in the tenant's training matrix register and surfaced on the assurance calendar as renewals fall due. (Tenant adjusts the topic list to match the service shape.)

7. Audit

Compliance with this policy is monitored by the Registered Manager and the Clinical Lead jointly, on the following cadence:

Audit findings are recorded in the tenant's audit register, presented at the monthly clinical governance meeting, and any actions are logged in the improvement-actions register.

8. Record-keeping

Records this policy generates (per-patient risk assessments, equipment service records, medicines audits, infection-prevention audits, incident records, duty-of-candour records, statutory notifications, improvement actions) are held in the tenant's clinical and governance systems for a minimum of 8 years from the date of the last entry in the record (per the NHS Code of Practice on Records Management for adult records; longer for children's records, mental health records, and certain other categories per the same Code).

For controlled-drugs registers, the statutory minimum retention is 2 years from the date of the last entry per the Misuse of Drugs (Safe Custody) Regulations; most providers retain for 7 years aligned with clinical-record retention.

The Verivius platform records the per-record audit trail indefinitely while the workspace is active; on cancellation, the export pathway preserves the record set.

9. Related policies in this pack

10. Sources and further reading

This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.

11. When to seek further advice

Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.

12. Document control

Version Date Author Changes
v1 2026-05-19 Verivius (sample) Initial sample template.
v1.1 2026-06-01 Verivius (sample) Filled out Sections 3 to 8 with concrete content. Section 5 procedure expanded from a placeholder to a 10-step Reg 12(2) flow tied to the incident, duty-of-candour, and statutory-notification lifecycles. Section 6 names the typical training topics and cadences. Section 7 names the audit cadence and methods. Section 8 references the NHS Code of Practice retention guidance and the Misuse of Drugs (Safe Custody) Regulations CD-register minimum.
v1 (pack) 2026-06-10 Verivius (sample) Re-conformed to the current Verivius policy standard, preserving the original content. Restored the full verbatim Reg 12(2)(a) to (i) blockquotes with cite labels, added the current disclaimer, header block, owner/applies-to line, Sources and further reading, and When to seek further advice sections. Corrected the duty-of-candour step to apply the correct Regulation 20 notifiable-safety-incident definition for the provider type, and named the Care Quality Commission (Registration) Regulations 2009 as the statutory-notification anchor.

This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the tenant's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.

What good looks like here

Written from an ex-CQC inspector's chair, but the point is safe, well-led care your team can stand behind. Each row shows what strong evidence looks like, what thin evidence looks like, and where the expectation comes from.

Regulation 12 is the one where the person feels the failure directly, and sometimes irreversibly. Harm here rarely starts with a single bad decision. It starts with a mitigation that existed somewhere in the service but never reached the point of care: the allergy noted at triage and absent from the drug chart, the medicines fridge that drifted overnight and was logged as fine, the resuscitation trolley signed off on paper and missing a laryngoscope when someone reached for it. A service delivering safe care can walk any single risk from the moment it was spotted, into that person's care plan, and out to the medicines, equipment and infection controls around them. Where that chain breaks quietly, the first anyone hears of it is usually the incident itself, which is why a gap between two documents here is really a gap in someone's care.

  1. A live risk register fed by real events, with each significant risk owned, controlled, scored and reviewed.

    Strong evidence: The register showing risks identified from incidents, complaints, safeguarding and audits, each with an owner, controls, a score and a review date.

    Weak evidence: A spreadsheet last edited at the annual policy review, listing generic risks copied from a template with no named owner, no score and no review date. The giveaway is that a recent incident, complaint or safeguarding concern appears nowhere as an entry, so the register is a document to be shown rather than a live control that changes what the service does. The duty to assess and mitigate risk is statutory; the register format, the scoring scale and the review cadence are Verivius defaults, not a prescribed statutory form.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  2. Patient records walk from the risk assessment to the care plan, so the mitigation that keeps a person safe actually reaches the plan.

    Strong evidence: A random sample of patient records where a per-patient risk assessment exists and its mitigations appear in that patient's care plan.

    Weak evidence: A per-patient risk assessment that flags a specific risk sitting beside a care plan that is a generic template making no mention of the matching mitigation, so the two documents never speak to each other. Or the assessment marked 'no risks identified' for a person whose notes plainly show a foreseeable risk that was never carried forward to the plan. Also weak: a mitigation recorded in the plan but never shared with the staff who deliver that person's care, so it exists only on the page.

    A legal duty. This comes from legislation that applies to your service, so meeting it is not optional. The exact provision is cited beneath the badge.

    Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, reg 12(2)(a)-(b), read with reg 9(3)(b)

  3. The medicines safety trail is complete and contemporaneous, written at the point of administration rather than reconstructed afterwards.

    Strong evidence: Medicines administration records completed at the time, a controlled-drugs register reconciled to the physical balance, a medicines-fridge temperature log with escalation for out-of-range readings, and the expiry and stock audit.

    Weak evidence: Medicines administration records with unexplained gaps, or ticks back-filled in a single pen at audit time rather than at the point of administration, and a controlled-drugs running balance that has never been counted against the physical stock. A fridge log of suspiciously identical daily readings with no record of what was done when one fell out of range, and an 'all in date' claim with no dated stock and expiry check behind it. Proper and safe management of medicines is the statutory duty; the running-balance stock check follows professional guidance and the fridge temperature range and daily logging follow the manufacturer's storage instructions.

    The recognised standard from a professional or clinical body, such as NICE or a royal college. Not a legal duty, but the accepted mark of safe practice, and a departure needs a documented reason.

  4. Infection-prevention evidence matches the risks this service actually runs, and it is audited.

    Strong evidence: A current infection-prevention risk assessment, cleaning and decontamination records, and the completed annual infection-prevention audit against the Code of Practice with actions tracked.

    Weak evidence: An off-the-shelf infection-prevention risk assessment that names risks the service does not run and misses the ones it does, such as the decontamination of reusable instruments. Cleaning and decontamination records signed in a suspiciously even rhythm, and an audit that is a downloaded checklist scored highly with no actions, no re-audit and nothing to show the findings changed practice. Assessing and controlling infection risk is the statutory duty; the annual audit cadence is a Verivius default, and the Code of Practice is issued under section 21 of the Health and Social Care Act 2008 rather than setting a statutory audit interval.

    Our recommended baseline. Not a legal or regulatory requirement, but a sensible standard we suggest where the rules leave the detail to you. Adapt it to your service.

  5. The loop closes on equipment and incidents: critical kit is safe to reach for at the moment someone needs it, and what the service learns becomes a completed action.

    Strong evidence: The equipment register with in-date service or calibration and daily checks for critical kit, and a sampled incident graded, with duty of candour opened or ruled out with reasoning and an improvement action tracked to completion.

    Weak evidence: An equipment register that lists assets but shows service or calibration dates already lapsed with no next-due date, and resuscitation-trolley checks signed off a week in advance. An incident that was graded but where the duty-of-candour decision is left blank rather than opened or explicitly ruled out with reasoning, so the person it happened to has no record of having been told anything. Improvement actions sitting at 'ongoing' for months with no evidence of completion. Equipment safety, the candour duty and acting on what the service learns are statutory; the service interval comes from the manufacturer's instructions and the daily resuscitation check follows Resuscitation Council UK guidance.

    The recognised standard from a professional or clinical body, such as NICE or a royal college. Not a legal duty, but the accepted mark of safe practice, and a departure needs a documented reason.

Related

Last verified 20 July 2026

Spotted something to improve?

These are sample templates, not the last word. If you would change a wording, or want to help us confirm a detail, tell us and we will look at it.

Related Verivius content

Want help adapting this to your service?

A Verivius consultant can read your adapted policy against the live regulation and your service shape. The work fits inside a Mock Inspection engagement or a shorter consulting brief. A 20-minute conversation is the fastest way to find out whether the fit is right.

Get started free

Free to start, no card. A 14-day trial when you subscribe.

Last reviewed 10 June 2026