Statutory duty of candour

Duty of candour describes the obligation placed upon healthcare professionals and organisations to be open and honest when something goes wrong.

Things will inevitably go wrong when providing healthcare and it is vital that any incident is identified, reviewed and explained to the patient (along with an apology), and that lessons are learned. In healthcare, there are systems in place to minimise the risk of errors occurring, but individuals also play a part. It is vital that processes are regularly scrutinised and improved to protect patient safety.

Historically, errors in healthcare may have been hidden from the patient, which is unacceptable in current practice. When something goes wrong, this presents an opportunity to assess what happened and to make improvements to avoid repetition.

Basic considerations

When considering the concept of the duty of candour, healthcare professionals should be aware of the two discrete branches of the duty: professional and statutory.

The professional duty is set out in guidance from the professional regulators. A joint statement on the professional duty of candour was published in 2016 by the GMC and seven other UK healthcare regulators, noting that clinicians “must be open and honest with their patients when something goes wrong with their treatment or care which causes, or has the potential to cause, harm or distress." More information on the professional duty of candour can be found in our advice sheet Duty of candour - professional. This advice sheet concerns the statutory duty of candour, which is set down in law and monitored by systems regulators (such as the Care Quality Commission (CQC) and Health Improvement Scotland (HIS)). The statutory duty applies to organisations rather than individuals. As the position differs between the UK nations, tailored guidance is provided for each country below.

Legal position - England

The requirements for the statutory duty of candour process in England are set out in regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (as amended). Organisations may also incorporate contractual duties into the employment contracts of their staff to reflect the need to comply with the statutory requirements, so it is important to be aware of all relevant contractual terms and to ensure you have reviewed and comply with your organisation’s duty of candour procedure.

The regulations apply to all organisations registered with the CQC and are intended to ensure openness and transparency in relation to the provision of care and treatment.

The Procedure

As soon as is reasonably practicable after becoming aware of a “notifiable safety incident” (see below), the “registered person” (i.e. the service provider or registered manager – usually a senior manager in larger NHS organisations or the practice partners/manager) must tell the patient (or their representative) about it, in person, and provide reasonable support. A written record must be kept and provided to the patient. The detail provided must include:

  • all of the facts which are known at the time
  • detail of any further enquiries, as appropriate
  • an apology

The notification in person must be followed up with written notification including the information outlined above and the results of any further enquiries into the incident. Obviously, a copy of the correspondence must be retained.

What type of incident will trigger the procedure?

As noted above, the statutory duty of candour applies to all “notifiable safety incidents”. What this means varies according to whether the service is provided by a health service body or another provider.

In the case of a health service body (i.e. NHS / foundation trusts and special health authorities), the threshold for a “notifiable safety incident” is met when there is an unintended or unexpected incident that could result in (or appears to have resulted in) death or severe harm, moderate harm or prolonged psychological harm to the patient. “Severe harm”, “moderate harm” and “prolonged psychological harm” are defined terms (as set out below at the foot of this section) and care should be taken to ensure that these are properly understood and applied.

For all other providers (including primary medical and dental care) the threshold for a “notifiable safety incident” will be met where there is an unintended or unexpected incident that appears to have resulted in one of the following factors or where treatment is required to prevent any of these outcomes:

  • Death;
  • Sensory, motor or intellectual impairment for at least 28 days;
  • Changes to the structure of the patient’s body;
  • Prolonged pain / psychological harm;
  • The shortening of life expectancy

In both cases, whether or not the threshold is met is to be judged “in the reasonable opinion of a health care professional” and the regulations are silent on whether that professional requires to be independent or whether they may have been involved in the care provided. The CQC has provided illustrative examples* of incidents that will trigger the thresholds for duty of candour, with reference to different specialities, and these are worth reviewing.

*Appendix C of

Notification to CQC

In addition, organisations subject to the statutory duty of candour are also required to notify the CQC (or, in some cases, the National Reporting and Learning System (NRLS)) without delay about any case in which they have required to notify a patient, as outlined above. The notification requirements are set out in the Care Quality Commission (Registration) Regulations 2009.

Definitions of “harm”:

(as set-out in regulation 20)

Severe harm: 

  • a permanent lessening of bodily, sensory, motor, physiologic or intellectual functions, including removal of the wrong limb or organ or brain damage, that is related directly to the incident and not related to the natural course of the service user’s illness or underlying condition.

Moderate harm

  • harm that requires a moderate increase in treatment,
  • and significant, but not permanent, harm

“moderate increase in treatment” means an unplanned return to surgery, an unplanned re-admission, a prolonged episode of care, extra time in hospital or as an outpatient, cancelling of treatment, or transfer to another treatment area (such as intensive care).

Prolonged psychological harm: psychological harm which a service user has experienced, or is likely to experience, for a continuous period of at least 28 days.

England: legislation and guidance

Legal position – Scotland

In Scotland, the equivalent duty is known as the “organisational duty of candour”, underscoring that the legal responsibility lies with the organisation, rather than individuals. The provisions are set out in the Health (Tobacco, Nicotine etc. and Care) (Scotland) Act 2016 and The Duty of Candour Procedure (Scotland) Regulations 2018.

The organisational duty of candour is a legal duty on health, care and social services organisations to notify an affected person if an unintended or unexpected incident appears to have caused harm. Alongside notification, the provisions require an apology and that organisations must meaningfully involve those affected in a review so they can agree actions for improvement.

Scottish Government guidance states that the purpose of this legislation is to promote openness and honesty when unexpected or unintended incidents occur, to promote a culture of learning and improvement. The organisational duty of candour applies to all health boards and organisations who have entered into a contract with a health board to provide a health service. This includes organisations providing independent health care services, including GP practices, dental practices and private providers.

When to activate

Organisations subject to the duty must activate the duty of candour procedure as soon as reasonably practicable after becoming aware that:

  1. an unintended or unexpected incident occurred in the provision of the health, care or social work service provided by the organisation as the responsible person; and
  2. in the reasonable opinion of a registered health professional not involved in the incident:
    • that incident appears to have resulted in or could result in any of the outcomes mentioned below; and
    • that outcome relates directly to the incident rather than to the natural course of the person's illness or underlying condition.

The relevant outcomes which trigger the duty of candour procedure are as follows:

  1. The death of the person.
  2. Permanent lessening of bodily, sensory, motor, physiologic or intellectual functions (including removal of the wrong limb or organ or brain damage) ("severe harm").
  3. Harm which is not severe harm but which results in:
    • an increase in the person's treatment;
    • changes to the structure of the person's body;
    • the shortening of the life expectancy of the person;
    • an impairment of the sensory, motor or intellectual functions of the person which has lasted, or is likely to last, for a continuous period of at least 28 days;
    • the person experiencing pain or psychological harm which has been, or is likely to be, experienced by the person for a continuous period of at least 28 days.
  4. The person requiring treatment by a registered health professional in order to prevent:
    • the death of the person;
    • any injury to the person which, if left untreated, would lead to one or more of the outcomes mentioned in paragraph (b) or (c).

Accordingly, organisations must appoint a registered health professional (a member of one of the professions listed in the Health Act 1999, including doctors, dentists, opticians, osteopaths, chiropractors, pharmacists, nurses midwives, etc) to give their view on the incident and its relationship to the occurrence of death or harm and pre-existing illnesses or underlying conditions. The final decision on whether to activate the procedure lies with the appointed registered health professional, who may work within the organisation as long as they were not involved in the incident. This person does not need to complete a full and detailed review, but must have sufficient information to assess whether the procedure requires to be activated. If an organisation experiences difficulty identifying a registered health professional to fulfil this role, they can contact Healthcare Improvement Scotland for advice.

The specific legal process of the organisational duty of candour procedure needs only be activated where, in the opinion of the registered health professional, the incident has resulted, or is likely to result, in harm. Remember though that the professional duty of candour (to be open and honest with the patient) would still apply even where this specific legal process is not activated.

Duty of candour | MDDUS









The procedure start date is the date the registered health professional informs the organisation that the procedure is to be activated.


The “relevant person” (i.e. the patient or their representative, if the patient is deceased or lacking capacity) should be notified as soon as reasonably practicable once the procedure is activated (usually within 10 working days). This can be through various methods including telephone, face-to-face or in writing, and should set out the facts, as known at that time, and intended plan for review. It is preferable to communicate via the relevant person’s preferred route.

The notification must include an account of the incident (on the basis of the facts known at the time) and an explanation of the actions that the organisation will take as part of the procedure.

The relevant person must also be informed if there has been a delay of over a month from the incident in starting the procedure and the reasons for this delay.

Procedural requirements

  • The organisation must invite the relevant person to a meeting and provide them opportunity to ask questions in advance. At the meeting, the organisation’s representative should provide an account of the incident and explain any further steps that will be taken in terms of an investigation. The relevant person must have the opportunity to ask questions and express their views. Following the meeting, the relevant person must be provided with a note of the meeting and information on who to contact in the organisation about the procedure.

  • A review must be carried out by the organisation and, whilst this is not specifically defined, it would likely include use of established processes to formally investigate and assess the circumstances which led or contributed to the incident. In carrying out the review, the organisation must seek the views of the relevant person (i.e. the patient or their representative) and take account of any views expressed. The review must result in the preparation of a written report, which should include details of how the review was carried out and a statement of any actions to be taken for the purpose of improving the organisation’s quality of service and sharing learning with other organisations. The report must also set out a list of actions taken in accordance with the duty of candour procedure, including all relevant dates. If the review takes more than three months, the relevant person must be advised the reasons for the delay. The organisation must offer to send a copy of the report to the relevant person, along with details of any services or support which may be of assistance to them, taking account of their needs. The organisation must also offer to provide any further information about the actions taken to improve the quality of service, which suggests that the need to involve the relevant person does not necessarily end at the point at which the report is issued to them.

  • In addition to any apology offered at the time of the incident, a written apology must be offered by the organisation to the relevant person at an appropriate stage of the process. The Scottish Government guidance makes clear that such an apology does not amount to an admission of negligence of a breach of a statutory duty; rather, it is a personal statement of sorrow or regret in respect of the unintended or expected incident.

  • Organisations must keep a written record of each duty of candour incident, including copies of all related documentation and correspondence.

  • The organisation must prepare an annual report (anonymised) to include the number and nature of duty of candour procedures, what they have changed as a result, a summary of their duty of candour policies and procedures and any other relevant information. The report must be published in a way that is publically accessible (e.g. on their website) and upon publication the organisation must notify Healthcare Improvement Scotland, the Scottish Ministers or Social Care and Social Work Improvement Scotland, as appropriate.

  • Unlike in England, a failure to make the necessary notification is not a criminal offence and there are no financial penalties associated with the duty of candour procedure in Scotland. However, HIS, the Scottish Ministers and Social Care and Social Work Improvement Scotland can serve a notice on an organisation requiring them to provide further information relating to the matters on which an organisation must report (as outlined above). It would appear to have been recognised in Scotland that the carrot may be more effective than the stick in ensuring compliance.

  • Organisations are obliged to provide training to their staff and also offer support.


Organisations are not obliged to provide information where the relevant person has advised they do not wish to receive this.

Caution should be exercised where there are concurrent legal processes to ensure that any disclosure of information does not prejudice a criminal process. Organisations must be mindful of other relevant legal requirements, such as data protection responsibilities. The duty of candour procedure should continue even if the relevant person intimates their intention to make a legal claim (to sue), however aspects of the procedure may need to be paused once formal notification of legal proceedings is received. In this situation, an organisation may still be able to progress its own internal review in the meantime.

Where multiple organisations are involved, they are expected to co-ordinate the process. It would usually be the organisation where the incident occurred that is the responsible person.

Scotland: legislation and guidance

Legal position - Wales

On 1 June 2020, the Health and Social Care (Quality and Engagement) (Wales) Act 2020 became law. It is expected to take effect in spring 2023.

Part of this legislation establishes an organisational duty of candour on providers of NHS services, which requires them to be open and honest with patients when things go wrong. The Welsh Government has stated that a culture of openness, transparency and candour is associated with good quality care and that this legal requirement will complement extant professional duties (see above.)

The precise procedural requirements that organisations will have to follow to comply with the organisational duty of candour are yet to be determined, at the time of publication. Regulations are to be drafted setting out the process that will apply when a patient suffers an adverse outcome which has, or could, result in unexpected or unintended harm that is more than minimal and the provision of healthcare was, or may have been, a factor. There is no intention to attribute fault, enabling a focus on learning and improvement, not blame.

They also plan to produce regulations that bring regulated independent healthcare providers in line with the NHS.

At present, individual healthcare professionals must still comply with the professional duty of candour.

Legal position - Northern Ireland

There are no statutory duty of candour provisions in Northern Ireland at the time of publication. The Department of Health has previously commissioned research on the topic and stated an intention to encourage society-wide debate on the issue. Recent high profile inquiries, in particular the inquiry into hyponatraemia-related deaths, have given duty of candour prominence. The aforementioned inquiry recommended the introduction of a statutory duty of candour.

Consideration is being given to whether future legal provisions could go further than in other UK nations by bestowing obligations on individuals as well as organisations, and including criminal sanctions for non-compliance. These suggestions have prompted concerns from organisations such as the GMC, who are unconvinced this will bring about the desired cultural and behavioural change towards openness and honesty.

At present, individual healthcare professionals must still comply with the professional duty of candour.

There has recently been a public consultation on the introduction of a statutory Duty of Candour in Northern Ireland here - which closed in August 2021.

Key points

  • The professional duty of candour bestows obligations on healthcare professionals to be open and honest when things go wrong (arguably re-stating an ethical duty long in existence).
  • The statutory duty of candour applies to organisations, rather than individuals, and the procedural requirements of the duty differ across the UK nations.
  • Ensure familiarity and compliance with your organisation’s duty of candour processes, particularly when commencing work with a new organisation.
  • The aim of the duty of candour legislation is to promote a culture of openness and honesty in healthcare, particularly when something goes wrong, to allow review and improvements.

This page was correct at the time of publication. Any guidance is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.

Download this article as a PDF

Download article

Related Content

Equality Act 2010

Claims for clinical negligence

Equality, diversity and inclusion workshop

For registration, or any login issues, please visit our login page.