Duty of Candour: the Reg 20 documentation requirement

Reg 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 sets the duty: when a notifiable safety incident occurs in relation to a service user, the registered person must notify the relevant person as soon as reasonably practicable after becoming aware that a notifiable safety incident has occurred, provide reasonable support to the relevant person in relation to the incident, and provide a written account following the notification.

Reg 20(7) defines “notifiable safety incident” by reference to the level of harm: moderate harm, severe harm, or death. “Moderate harm” itself is defined in the same paragraph as harm that requires a moderate increase in treatment, and significant but not permanent harm. Below-threshold events (near miss, no harm, low harm) do not trigger Reg 20 even where they are otherwise worth investigating and learning from.

Reg 20(3) prescribes the verbal-notification components: an account of all the facts the registered person knows about the incident as at the date of the notification, advice on what the registered person believes are the further enquiries appropriate to be carried out, an apology, and a written record of the notification given. Reg 20(4) requires the written follow-up letter to contain the same components plus the results of any further enquiries. Reg 20(5) requires the registered person to keep a copy of all correspondence.

The apology under Reg 20(7) is defined as an expression of sorrow or regret. No template wording is prescribed. CQC inspectors look for evidence the apology was genuine and recorded; they do not require a specific form of words.

Across the inspection portfolio Klaudiusz worked over thirteen years inside CQC, three Reg 20 patterns showed up more than any others.

One: the verbal notification happens but is not recorded. The clinician sits with the patient and family in the hour after the event, explains what happened, apologises, answers questions. No record of that conversation is filed. The team treats it as self-evident that the conversation took place. The inspector reads the file and sees only the written follow-up letter; they cannot evidence the verbal notification or its content. Reg 20(3) requires the verbal step explicitly; an unrecorded verbal notification does not satisfy the duty.

Two: the written follow-up is sent but lives in an email outbox.The letter goes from the consultant's personal email or the practice administrator's inbox, not from the patient record system. Six months later the inspector asks for the written notification and the team has to scroll through sent mail to find it. The platform's job is to make the letter sit against the source incident from the moment it is sent.

Three: the “moderate harm” threshold assessment is implicit.The team treats the event as “clearly notifiable” or “clearly not notifiable” without recording the reasoning. When the case sits in the borderline zone (significant but not permanent harm; a moderate increase in treatment that ended without sequelae), the absence of the threshold reasoning makes the inspector ask why the team made the call they made. The decision may be defensible either way. The undefended decision is what gets flagged.

The 10-working-day operational window many providers apply to the written notification is not a statutory requirement; Reg 20(4) does not set a numeric deadline. That figure is widely circulated in UK provider policy documents and training materials but is not codified in Reg 20 itself or in CQC published guidance the founder has been able to locate. Treat the 10 working days as a tenant operational SLA rather than as a statutory clock. Verivius records the statute verbatim alongside the tenant SLA so the legal duty and the operational promise are not confused.

On a Reg 20 sample, an inspector typically reads three things: the source incident with its harm classification, the verbal-notification record, and the written follow-up letter. The expected shape is a continuous evidence chain: harm above threshold, verbal notification recorded, written follow-up sent, final outcome letter at investigation conclusion, all four sitting against the source incident in chronological order.

The reading test is whether the chain is complete and whether the apology component is present at the verbal stage. An apology added later in the written letter but absent from the verbal record reads as performative; an apology recorded at the verbal stage and reiterated in the written letter reads as genuine. Inspectors are specifically attuned to this pattern because the performative-apology shape is what Reg 20 was introduced to address after the Francis Inquiry.

For independent secondary care, Reg 20 is sampled on every inspection; for sectors where the moderate-harm-or-above incident rate is lower (private outpatient-only clinics, dental practices), the sample depth scales with the actual incident profile but the inspector still expects to see the trail working when an event has occurred. A clean inspection report comment on Reg 20 reads as something like “the provider had occasion to apply duty of candour on three occasions in the inspection window; in each case the verbal notification, written follow-up, and final outcome letter were evidenced against the source incident”.

Verivius runs Reg 20 as a sub-lifecycle inside the incident record: assessment (does the harm classification cross the threshold; reasoning recorded either way), verbal notification (recipient, summary, apology checkbox with verbatim Reg 20(3)(b) language, evidence file optional), written follow-up (recipient, send method, letter summary, reference number, evidence file optional), interim updates (one or many, each with summary and evidence), final outcome letter at investigation closure. All five sub-records sit against the source incident; the audit trail captures who assessed, who notified verbally, who sent the written letter, and when. The statutory wording from Reg 20(3), (4), (5) and (7) is reproduced verbatim in the platform UI alongside the tenant SLA layer so the legal duty and the operational promise are visibly separate. For the full feature walk-through see what Verivius actually does.

Short answer: “How does Verivius handle the duty of candour?” on the FAQ.