CQC statutory notifications: when, how, and what providers most often miss

The legal source is the Care Quality Commission (Registration) Regulations 2009, Part 4. Regulation 18 lists the events that registered providers must notify to CQC, alongside companion regulations 12, 13, 14, 15, 16 and 17 of the same instrument that each carry their own narrower notification triggers (death of a service user, death or unauthorised absence of a service user detained under the Mental Health Act, serious injury, abuse or allegation of abuse, incidents reported to or investigated by the police, applications for and outcomes of Deprivation of Liberty Safeguards applications, events that stop or threaten to stop the service running safely and properly, and changes affecting the provider as a corporate body).

The duty applies to the registered provider and, where registered separately, the registered manager. Notifications are submitted through CQC's online notification system. The events the regulation lists are technical; some are unambiguous (death of a service user) and some carry edge cases that experienced regulatory leads still occasionally get wrong (when does a fall become a serious injury for Reg 18 purposes; when does a safeguarding referral cross into the abuse-allegation trigger; when does a police investigation count for notification).

For NHS-funded episodes, Regulation 18 sits alongside the Learn From Patient Safety Events (LFPSE) reporting obligation and the Patient Safety Incident Response Framework (PSIRF) where the provider is in scope. Private episodes at the same provider remain subject to Regulation 18 only. Verivius distinguishes funding source at record level so the right notification rules apply per episode rather than per tenant.

Across the inspection portfolio Klaudiusz worked over thirteen years inside CQC, the same three notification gaps surfaced again and again.

One: the change of registered manager. Providers tell CQC verbally during a visit or in passing on a call. The formal notification of cessation of a registered manager and the matching application for the new appointment never get submitted. A small dental practice or a single-location surgical clinic that loses its RM under stress is the typical pattern. By the time CQC notices, the provider has been operating without a registered manager for months, which itself becomes a compliance breach distinct from the original notification gap.

Two: the serious-injury threshold. Providers under-report. A fracture that needs theatre, a head injury requiring hospital observation, a pressure ulcer that develops to category 3 or 4: the team logs the clinical incident, opens a duty of candour conversation, books a debrief. The Reg 18 question (does this meet the notification threshold under Reg 18(2)(a) or the related triggers) does not get asked. Inspectors find the gap by cross-referencing the provider's own incident log against the CQC notifications portal and asking why entries appear in one and not the other.

Three: the police-investigation trigger. A patient or service user is the subject of a police investigation. The provider takes it as a safeguarding issue and refers to the local authority but does not also notify CQC. Reg 18 includes the trigger for incidents reported to or investigated by the police; the referral to local-authority safeguarding and the notification to CQC are separate duties that often need to fire from the same event.

None of these gaps comes from intent. They come from no single person holding the regulatory-trigger map in their head at the moment the event surfaces. The platform's job is to be that map.

On a Reg 18 sample, an inspector typically asks for the CQC notifications submitted over the last twelve months and reads them alongside the provider's own incident and safeguarding logs from the same window. The expected ratio is not one notification per incident. Most incidents do not meet the notification threshold. The expected shape is that every incident over the threshold has a matching notification, and every notification cites a specific incident the provider can produce on request.

Sampling is usually five to ten records, chosen non-randomly: the incidents the inspector noticed during the site visit, the safeguarding referrals that read as borderline, and a stratified scan of severity grades. The inspector reads the notification text against the underlying incident record; significant divergence between the two (the incident says one thing in the team's internal record and another in the regulator-facing notification) is a Reg 17 well-led finding as well as a Reg 18 concern.

The other shape inspectors look for is the closure loop. A notification opened on day one needs follow-up evidence: the investigation, the action plan, the learning shared with the team, the change to practice. Notifications without that follow-up read as procedural compliance without learning, which is the well-led pattern inspectors most often write up as “the systems exist but the culture has not adopted them”.

Verivius runs the notification lifecycle inside the platform: every incident, safeguarding concern, and relevant operational event is checked against the regulatory-trigger map at log-time, with the Reg 18 triggers applied to private episodes and the broader NHS patient-safety reporting obligations applied to NHS-funded episodes. A notification record is opened automatically when a trigger fires. The deadline clock starts at the event-detected moment. The audit trail records who assessed the trigger, who filed, when the regulator confirmation arrived, and what closure evidence got attached. For the full feature walk-through see what Verivius actually does.

Short answer: “How does Verivius handle statutory notifications?” on the FAQ.