1. What the regulation says
Care and treatment must be provided in a safe way for service users. (Reg 12(1))
assessing the risks to the health and safety of service users of receiving the care or treatment, (Reg 12(2)(a))
doing all that is reasonably practicable to mitigate any such risks, (Reg 12(2)(b))
ensuring that persons providing care or treatment to service users have the qualifications, competence, skills and experience to do so safely, (Reg 12(2)(c))
the proper and safe management of medicines, (Reg 12(2)(g))
The full text of the regulation is at https://www.legislation.gov.uk/uksi/2014/2936/regulation/12. Where this policy and the regulation diverge, the regulation wins.
2. Plain-English summary
Care and treatment must be provided in a safe way. The regulation lists the areas a provider must address, including risk assessment, risk mitigation, staff competence, safe premises, safe equipment, sufficient equipment and medicines, medicines safety, infection prevention and shared-care planning. Regulation 12 is central to CQC's safety expectations. For a sexual health service, the biggest safety risk is a test result that is not acted on, above all a reactive HIV or syphilis result that is missed or delayed, so this policy builds a fail-safe around every result and around PrEP monitoring.
3. Purpose
A sexual health service tests for infection, gives results, treats, and offers HIV prevention. The biggest safety risk is a result that is not acted on, above all a reactive HIV or syphilis result that is missed or delayed. This policy sets out how the Service tests appropriately, makes sure every result is seen and acted on, treats and refers correctly, and runs PrEP safely.
The Service must verify this policy against current BASHH testing guidance and the BHIVA/BASHH PrEP guidelines before adoption.
4. Scope
This policy applies to:
- STI and blood-borne virus testing, results, treatment and PrEP
- the clinicians who test, treat and prescribe, and the staff who manage results
- patients tested or on PrEP at the Service
Where a patient is under 18, or where capacity to consent is in question, the Service applies Fraser guidelines and Gillick competence, the Mental Capacity Act 2005 where relevant, and the local safeguarding children procedures under Working Together to Safeguard Children 2026 (see the under-18s and consent provisions of the relevant policies).
5. Testing
- the tests offered are based on the patient's risk and the current guidance, covering the relevant infections including HIV and syphilis where indicated
- the patient is told what they are being tested for, what the tests can and cannot detect, and that some infections have a window period during which a recent exposure may not yet show, so a repeat test may be needed
- consent to testing, including HIV testing, is taken and recorded
6. Results: the fail-safe
Every test result is seen and acted on. The Service:
- logs every test sent and tracks it until the result is back and actioned
- has a fail-safe so a result that does not arrive is chased, not assumed negative
- gives results in the way the patient agreed, protecting confidentiality (see the confidentiality policy)
- treats a reactive or positive result, especially HIV or syphilis, as needing prompt, sensitive action: the patient is contacted, supported, treated or referred without delay, and the contact is handled so it does not reveal the diagnosis to others
- records the result, the action taken and the communication with the patient
7. Treatment and onward referral
- infections are treated per current guidance, with the right drug, dose and follow-up, and a test of cure where indicated
- infections needing specialist care (for example a new HIV diagnosis) are referred promptly to the appropriate service, with the patient supported through the handover
- partner notification is offered for relevant diagnoses (see the partner notification policy)
- notifiable infections are reported as the law requires
8. PrEP
Where the Service provides HIV pre-exposure prophylaxis:
- eligibility and suitability are assessed against current guidance, and the patient is counselled on how PrEP works, that it does not protect against other STIs, and the importance of adherence
- baseline tests (including an HIV test to confirm the person is HIV negative, and renal function) are done before starting, and PrEP is not started on an unconfirmed HIV status
- monitoring, including regular HIV testing and renal monitoring at the intervals the guidance sets, is arranged and tracked, with the same fail-safe as other results
- PrEP is reviewed and continued only while monitoring is current
9. Recording
The Service records the tests done, the results, the treatment given, referrals made, PrEP assessments and monitoring, and the communication with the patient, all in line with the confidentiality policy.
Operational controls to adapt
Roles and responsibilities
- Registered Manager: owns the results fail-safe, makes sure there is named cover for absences, and reviews incidents, overdue results and PrEP-monitoring exceptions.
- Testing clinician: confirms indication, consent, window period, sample set, follow-up plan and patient contact preference before testing.
- Results owner and deputy: review incoming results every working day, chase missing results, action reactive or positive results, and keep the outstanding-results list current.
- PrEP prescriber or clinical lead: confirms eligibility, baseline checks, prescribing decision, monitoring cadence and stop or hold decisions.
- Administration staff: support booking, contact and recall using agreed confidentiality scripts and escalate failed contacts promptly.
Testing, results and PrEP procedure
- Record the testing indication. The clinician records symptoms, exposure, risk, screening reason, window-period advice and tests requested.
- Track every sample sent. Each sample has a lab reference, expected result date, responsible owner and chase date if no result arrives.
- Review results daily. The results owner actions normal, positive, reactive, inconclusive and rejected samples, and does not leave results unallocated.
- Escalate urgent results. Reactive HIV, syphilis, hepatitis, high-risk infection, pregnancy-related concern or safeguarding concern is escalated to the clinical lead the same day it is reviewed.
- Contact safely. Patient contact follows the recorded confidentiality preference. Failed contact attempts are logged and escalated according to risk.
- Complete treatment or referral. Positive results are linked to treatment, test of cure, onward referral, partner notification and notifiable-infection reporting where required.
- Control PrEP prescribing. PrEP is not started without a documented negative HIV result and baseline checks. Continuation is held or reviewed where required monitoring is overdue.
- Close the loop. A case is not closed until the result, action, patient communication, treatment or referral, and follow-up plan are all recorded.
Records and register links
The testing and PrEP record should include:
- indication, consent, sample type, lab reference, window-period advice and expected result date
- result date, result category, reviewer, action taken and patient contact route
- failed contact attempts, escalation and risk-based follow-up decision
- treatment, prescription, test of cure, referral, notifiable-infection report and partner-notification trigger
- PrEP baseline HIV status, renal checks, hepatitis checks where relevant, eligibility decision, prescription decision and next monitoring date
- PrEP hold, stop, restart or specialist-advice decision where monitoring or safety concerns arise
- linked incident, safeguarding, risk, complaint or improvement-action reference
Missing results, delayed reactive-result action, incorrect patient contact, PrEP monitoring gaps and repeated lab or booking failures are opened on the relevant register.
10. Training
Clinicians who test, treat and prescribe PrEP keep current with the guidance and are competent for what they do; staff who manage results are trained in the fail-safe and confidentiality. The Service records who is competent and the next refresher date.
11. Audit cadence
The Service checks, on a stated cadence, that:
- testing matches risk and the patient was told about window periods and consented (including to HIV testing)
- every result was tracked, seen and acted on, with reactive results handled promptly and sensitively, and none outstanding unnoticed
- treatment, referral and notifiable-infection reporting followed guidance
- PrEP had baseline testing and tracked monitoring, with no PrEP continued on overdue monitoring
The Registered Manager and the clinical lead review the results and record the improvement actions that follow.
12. Sources and further reading
This template is based on CQC's guidance for providers and managers, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other topic-specific legislation and guidance listed below. It is a starting point for adaptation, not a substitute for legal, clinical, HR, safeguarding or specialist professional advice.
Original sources carried forward from this policy:
- British Association for Sexual Health and HIV (BASHH), testing and management guidelines: https://www.bashh.org/
- BHIVA/BASHH guidelines on the use of HIV pre-exposure prophylaxis (PrEP): https://www.bhiva.org/
- UK Health Security Agency, STI testing and surveillance guidance: https://www.gov.uk/government/organisations/uk-health-security-agency
- Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Regulation 12 (safe care and treatment): https://www.legislation.gov.uk/uksi/2014/2936/regulation/12
Source-pack stack for STI testing / PrEP (sexual health):
- CQC Regulation 12: Safe care and treatment
- BASHH testing and management guidelines
- BHIVA / BASHH PrEP guidelines
- UKHSA STI testing and surveillance guidance
- relevant NICE guidance
- CQC Fundamental Standards
- Fraser guidelines / Gillick competence, and Working Together to Safeguard Children 2026, where the patient is under 18 (see the under-18s / Fraser policy)
- sexual-health confidentiality law and practice; UK GDPR; GMC confidentiality guidance (see the confidentiality policy)
Related reading
- Related policy: Partner notification policy
- Related policy: Confidentiality in sexual health policy
- Related policy: Medicines management policy
- Related policy: Incident reporting, investigation and learning policy
- Related policy: Under-18s and safeguarding policy
13. When to seek further advice
Seek specialist advice where the issue involves serious harm, safeguarding, deprivation of liberty, restraint, children, professional misconduct, controlled drugs, radiation, termination of pregnancy, infection outbreak, water safety, employment dismissal, DBS barring referral, or regulatory enforcement.
14. Document control
| Version | Date | Author | Changes |
|---|---|---|---|
| v1.1 | 2026-07-14 | Verivius (sample) | Added role ownership, results fail-safe controls, PrEP monitoring records, register links and related reading. |
| v1 | 2026-06-10 | Verivius (sample) | Conformed to the Verivius policy standard, additively: added statutory anchor, verbatim Regulation 12 quotes, plain-English summary, under-18s/Fraser scope note, and the source-pack stack. All original sections and source URLs preserved. |
This sample policy template was issued by Verivius. It is a template, not a substitute for legal advice or the tenant's own policy-development process. Where this template and live law or regulator guidance diverge, the live source wins.