Chapter 38. Duty of candour

Statutory duty of candour for organisations

Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (the Regulations) sets out the statutory duty of candour for organisations. It provides that “a health service body must act in an open and transparent way with relevant persons in relation to care and treatment provided to service users in carrying on a regulated activity”.¹ This regulation applied to NHS organisations from November 2014.² From April 2015, it applied to all health and social care providers registered with CQC.³
In her evidence to the Inquiry, Professor Dixon-Woods explained that, prior to the introduction of the Regulations in 2014, an open and well-run hospital would have been expected to be open with people injured by the actions of people working in the hospital. That, however, was not generally the case.⁴
Regulation 20(2)–(4) requires that, as soon as reasonably practicable after becoming aware that a notifiable safety incident has occurred, a health service body must notify the relevant person.⁵ A notifiable safety incident is defined as:
“any unintended or unexpected incident that occurred in respect of a service user during the provision of a regulated activity that, in the reasonable opinion of a health care professional, could result in, or appears to have resulted in–
(a) the death of the service user, where the death relates directly to the incident rather than to the natural course of the service user’s illness or underlying condition, or
(b) severe harm, moderate harm or prolonged psychological harm to the service user.”⁶

A relevant person is the service user, or a person lawfully acting on the service user’s behalf.⁷

The notification must:
“(a) be given in person by one or more representatives of the health service body,
(b) provide an account, which to the best of the health service body’s knowledge is true, of all the facts the health service body knows about the incident as at the date of the notification,
(c) advise the relevant person what further enquiries into the incident the health service body believes are appropriate,
(d) include an apology.”⁸

The notification must also be recorded in a written record which is kept securely by the health service body. The oral notification must be followed by a written notification to the relevant person. This must comply with the same requirements as the oral notification. It should also include the results of any further enquiries into the incident. The health service body must also provide reasonable support to the relevant person in relation to the incident, including when giving such notification.⁹

The statutory duty of candour is also written into the NHS Standard Contract, which is published annually by NHS England for use by NHS commissioners to contract for all healthcare services other than primary care services.¹⁰
The statutory duty of candour does not apply to individuals, but organisations discharge their duty through the actions of their staff. It follows that there is an obligation on those in charge of the organisation to make sure that they and all staff understand the duty and how it is to be discharged.
CQC provides guidance for providers on meeting the statutory duty of candour.¹¹ It has the power to enforce Regulation 20.¹² Its range of enforcement powers include warning and requirement notices, imposition of conditions and criminal prosecution.¹³ Mr Dzikiti, corporate witness for CQC, told the Inquiry that, since 2020, CQC had successfully prosecuted seven organisations in relation to the duty of candour.¹⁴
CQC regulates the organisational duty of candour.¹⁵ It has the task of checking that the hospital or other provider is discharging its responsibility in respect of all aspects of the duty of candour. CQC does not investigate every notifiable safety incident; this is the responsibility of the hospital or other provider.¹⁶
CQC looks at the duty of candour when considering whether the service being inspected is well led; this involves having an open and safe culture, and meeting the regulatory requirements of the duty of candour. When CQC holds monitoring calls, it assesses the data and information it receives. When conducting an inspection, CQC looks for evidence that all three requirements are met.¹⁷

Professional duty of candour

All clinical staff who are registered healthcare professionals have a professional duty of candour. Oversight is by the regulators of each profession, such as the GMC, the NMC and the General Dental Council. The professional duty of candour derives from codes of conduct, not from statute. Non-clinical staff are not usually registered with a statutory body, so are not subject to the same (or any) professional code.¹⁸ See Chapter 37.
The GMC and the NMC published joint guidance: Openness and Honesty When Things Go Wrong: The professional duty of candour. This took effect on 29 June 2015.¹⁹ This joint guidance specifies: “Every health and care professional must be open and honest with patients and people in their care when something that goes wrong with their treatment or care causes, or has the potential to cause, harm or distress.”²⁰
There are two aspects to the professional duty of candour. The first relates to patients. The guidance sets out a number of steps that health and care professionals must follow. They must:
- tell the person (or, where appropriate, their advocate, carer or family) when something has gone wrong^*
- apologise to the person
- offer an appropriate remedy or support to put matters right (if possible)
- explain fully to the person the short and long term effects of what has happened.”²¹
The second part of the professional duty of candour relates to colleagues, employers and other organisations. The guidance states:
“Health and care professionals must also be open and honest with their colleagues, employers and relevant organisations, and take part in reviews and investigations when requested. They must also be open and honest with their regulators, raising concerns where appropriate. They must support and encourage each other to be open and honest, and not stop someone from raising concerns.”²²
The guidance also specifies that, “if you are in a management role, you must make sure that individuals who raise concerns are protected from unfair criticism or action, including any detriment or dismissal”.²³
Breaches of the professional duty of candour can result in investigation and disciplinary action by the GMC or the NMC.
Speaking on the duty of candour, Sir Robert Francis said: “I think that there has … developed a feeling that it’s not working as well as it should do” and “anecdotally, I hear of worrying things”.²⁴ He described a case where a doctor who made a mistake and caused harm to a patient expressed to the hospital that he wished to meet the patient and discuss it with them. However, the doctor was told that he could not do so. Instead, he was presented with a letter to send to the patient. The doctor was given no choice but to send the letter, and the contents upset the patient. The letter was not inaccurate, but it was not what the doctor would have wished to have said. Sir Robert Francis commented: “[T]he whole thing had become: we have a process and we have to follow this, rather than allowing it to be clinically led by a perfectly honest doctor trying to do their best to be candid and to support the patient about something that had happened.”²⁵
Sir Robert Francis told the Inquiry:
“[S]ometimes it is forgotten that the overarching obligation is about openness and transparency of which candour and notification are an important part, but not the only part.
The most important part is looking after your patient and their family, where appropriate the family and their concerns … [T]he process of the duty of candour has been treated as a defensive mechanism rather than an involvement mechanism and a resolution mechanism. The whole point of the duty of candour is to satisfy people who have been harmed or might have been harmed, giving them an opportunity to understand what has happened, and to take part in the process of improvement, to receive redress by way of apology and if necessary some money, but all without having to bother lawyers or the courts or disciplinary processes but to actually do things quickly and resolve them quickly and allow people to feel that they have been [respected,] all those things and it doesn’t happen if … — the instinct is well, I am doing by the duty of candour is producing a defensive position. You have got to start from the position that: I am being candid because it is the right thing to do for my patient.”²⁶
Professor Dixon-Woods told the Inquiry:
“[T]he legal duty of candour has been a very important intervention, but has been variably well implemented by Trusts.
…
The duty is not easy to implement because it requires a set of procedures and not all Trusts are operationally excellent at creating operational change. It also requires a lot of behavioural change on the behalf of the professionals and implementing the disclosures was not easy for professionals.
…
[I]t’s another example of where something that looked like a good idea could have done with a lot more co-design with the families and with the staff before it was implemented. It was one of those things that was left up to NHS Trust[s] to figure out how to do it.”²⁷

She added: “The challenge of implementing something like the duty of candour was significant because it required so much organisational engineering, culture and behaviour change and so on, and again it goes back to what I was saying earlier, I think a lot of that could have been much better supported.”²⁸

Professor Dixon-Woods asserted: “I think there is scope for greater enforcement action … It again signals the seriousness of the requirement.”²⁹ She was asked whether penalties are the driver of change. She replied that they can be. However, she cautioned that the effects of regulatory fines on healthcare organisations had not been evaluated. She also pointed out that fines take more resources out of organisations that are already struggling financially. She considered: “[Y]ou probably need a range of things if you’re going to implement something like this [the duty of candour] effectively.”³⁰ She pointed to openness policies, data, collaborative improvement and feedback. In her view, there is a need to find ways that encourage “authentic and genuine commitment to the interests of patients that isn’t necessarily because it was a big stick going to be waved, but the big stick should be there if there’s still non-compliance, absolutely”.³¹
Speaking generally about the duty of candour, Mr Vineall, on behalf of DHSC, said that, in November 2024, results from a consultation were released which “showed that the duty of candour was working in places but was probably somewhat underwhelming in totality”.³²
Mr Vineall stated that DHSC were aware of the concern that has arisen from some areas of this Inquiry about the challenge of applying the duty of candour to circumstances in which a person suspects deliberate harm. He asserted that, in these circumstances, the “duty of candour does apply”.³³
In oral evidence, Sir Rob Behrens said:
“[T]he duty of candour does not work and needs urgent reviewing and replacement with stronger powers.
…
[I]t doesn’t work because it doesn’t apply to individuals, it applies to persons and that is interpreted as a public body and, secondly, the fines for it are so puny that it doesn’t have any impact on the behaviour of the leaders of the Trust.
And so there is time and again, from cases that I have seen, a failure of staff to disclose what really happened in situations and the way that that happens in my view is wrong.”³⁴
Speaking on the organisational statutory duty of candour, Dr Alan Clamp, Chief Executive of the Professional Standards Authority for Health and Social Care, considered there was scope for CQC to improve how they hold organisations to account, with the sanctions they impose and the guidance they provide.³⁵
Dr Clamp supported the regulation of senior managers. He considered “it would be very useful to pursue the idea of the statutory duty of candour for individual managers”.³⁶ He pointed out that regulated professionals must comply with the professional duty of candour and that, if they do not, there will be repercussions from the regulator.³⁷
In a nutshell, the discharge of the duty of candour, organisational and professional, is patchy. There is no duty of candour for non-clinically qualified managers.

The government’s consultation on the introduction of a professional duty of candour for NHS managers

I have already dealt comprehensively with the parts of the November 2024 government consultation that deal with the regulation of managers (see Chapter 37).³⁸ The consultation also invited views on introducing a professional duty of candour for NHS leaders, similar to that for regulated health and care professions, and views on introducing for managers a duty to record, consider and respond to any concern raised about the healthcare being provided, or the way it is being provided. At present, under Freedom to Speak Up, the person speaking up is protected, but there is no obligation on the organisation to act on the concern.
The response to the consultation revealed strong support for NHS managers to have a professional duty of candour as part of the standards that they are required to meet (96%), and for NHS managers to ensure that the statutory duty of candour is correctly followed in their organisation (95%).³⁹ Respondents explained this would encourage a culture of honesty, openness and transparency within NHS management, and a professional duty of candour should be extended to NHS managers, to standardise professions and to ensure consistency in the guidelines being followed.
The government’s response ignores the question of introducing a professional duty of candour for NHS leaders or managers.⁴⁰ Instead, in the written statement on the consultation response, the government commits to “consider what further sanctions may be required in relation to failing to uphold the principle of candour”.⁴¹ There is no proposal for a duty of candour for non-clinically qualified managers.
This is disappointing and unwise. Since most management and leadership at senior levels, in particular, is done by non-clinically qualified managers, it is important that they, too, are subject to a duty of candour. The arguments in favour of the duty for doctors, nurses, healthcare professionals, and the organisation itself, are just as powerful for the managers, who control all the resources and make decisions which affect all aspects of the running of the hospital and patient care. Managers and leaders should be responsible for discharging the organisation’s duty of candour, but poor compliance with the organisational duty leads to fines for the organisation, and there is no personal accountability. An individual duty imposed on managers, mirroring the duty on nurses, doctors and other healthcare professionals, coupled with clear guidance from CQC, should achieve a better understanding of, and overall compliance with, the duty of candour.
As I have set out in Chapter 37, the NHS Leadership and Management Framework Code was published in July 2026. The code declares at the outset, “for the first time, the principles and characteristics that all leaders and managers are expected to meet in the sector”.⁴² It then refers to several other NHS documents, and to The Seven Principles of Public Life with which it says it aligns.⁴³
Under the heading ‘Be accountable’, the NHS Leadership and Management Framework Code reads:
“As a leader or manager in health and social care, you must:
- take responsibility for your actions and decisions
- hold yourself and others to account for doing the job well, working together fairly and effectively and always looking for ways to improve.
That means:
- following the relevant professional codes of conduct, including duty of candour where appropriate.”⁴⁴
As I have said already, other than the code from which this is an extract, there is no professional code of conduct for non-clinicians. The structure of the ‘Be accountable’ text above suggests that the duty of candour applies only to those who are already subject to it as part of their professional codes of conduct. This immediately differentiates between clinical and non-clinical managers. It undermines the opening statement of the document, which says that the code sets out “the principles and characteristics that all leaders and managers are expected to meet”. The result is that nurses and doctors (and other healthcare professionals) have a duty of candour under their professional codes, but non-clinically qualified managers do not. If that is the intention (and the government response to the consultation suggests it is), it is unacceptable and unjustified. A simple amendment should be made, making it clear that the duty of candour applies to all.
I am in no doubt that there should be no exemption for non-clinical managers from this important duty, which should be clear on the face of the NHS Leadership and Management Framework’s Code (of conduct), and should apply to all managers.

The government’s consultation on the duty to respond to healthcare concerns

In the same consultation issued by the government in respect of regulating managers and the duty of candour, there was a further section on whether or not to introduce a duty to record, consider and respond to any concern raised about the healthcare being provided, or the way it is being provided. A high percentage of respondents (94%) supported the principle of NHS managers having a duty to respond to safety incidents. A similarly high percentage (95%) supported the introduction of a duty on managers to ensure processes are in place for responding to concerns.
Respondents explained that this would mean that managers are held accountable for poor decision-making and that it would encourage transparency. They also expressed the importance of staff and patients being able to raise concerns without fear of managers dismissing them without consideration. Negative experiences of whistleblowers and those speaking up were pointed out by some respondents, suggesting a duty to respond would protect staff and patients, and hold managers accountable.
A duty to respond was explained by respondents as a basic ethical approach within healthcare, with some respondents saying that it is already being followed (or should be). However, some respondents recommended that processes should be in place to deal with concerns on a systemic level, rather than having managers directly respond. For example, they proposed a triage system to address concerns proportionately, with serious forms of misconduct subject to this duty, and less serious concerns dealt with differently.
I heard evidence about this. Given the enormous effort that has gone into setting up Speak Out Safely and then Freedom to Speak Up Guardians, it is puzzling that there is no requirement for hospitals and other providers of healthcare, or for managers at any level, to do anything about the concerns raised with them, although many do. Ms Sybille Raphael, on behalf of Protect, recommended that there should be a legal duty to investigate concerns. She pointed out that this exists in the EU in respect of employers with more than 50 employees.⁴⁵
Professor Bowers KC supports such a duty:
“I think the other thing is that it would be very useful to have a duty on the employer to consider the disclosures because at the moment, there’s no obligation to do that. There’s protection for the whistleblower in whistleblowing, but there’s nothing of a duty on the employer to follow up on the [disclosure] and I think that is an important thing; that actually would give succour to or support to whistleblowers who often feel extremely beleaguered that they have gone out of their way, sometimes lost their careers, to make information available and then nothing is done with it.”⁴⁶
This should be considered as part of the Freedom to Speak Up process (see Chapter 40). The government’s position, as set out in its consultation response, is short. It recommends no action on this issue, on the grounds that it would be “complex to implement and enforce”,⁴⁷ so there are no specific or new actions taken from this feedback. It points to existing whistleblower protections. That is to miss the point; this is not about the whistleblower, but the concern that has been raised.
I don’t doubt that there are concerns raised which require no or little action, and it is the case that many concerns are acted upon. I am also satisfied, on the evidence I have heard, that in many places managers do respond to concerns that are raised, and no properly run hospital would ignore such concerns. Consideration should be given to imposing a duty as set out in paragraph 38.38 above.