Many care homes and providers view data protection as a secondary concern in relation to care and CQC. We understand that — care comes first. We get that.
Many care homes and providers view data protection as a secondary concern in relation to care and the CQC (Care Quality Commission). We understand that — care comes first. We get that.
However, what you may not know is that your CQC inspector will also be assessing your data protection as part of your inspection.
Several of the regulations are tied to data protection, especially Regulation 17 – Good Governance.
The following is a list of all the regulations that have an aspect of data protection:
Regulation 4: Requirements where the service provider is an individual or partnership
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: Regulation 4
The intention of this regulation is to ensure that people who use services have their needs met because the service is provided by an appropriate person. To meet the requirements of this regulation, providers must register with CQC under Section 10 of the Health and Social Care Act 2008. The registered provider or partners of the registered provider must:- Be of good character.
- Be able to properly perform tasks that are intrinsic to their role.
- Have the necessary qualifications, competence, skills and experience to carry on the regulated activity or supervise its management.
- Be able to supply CQC with documents that confirm their suitability (see the information and documents identified in Schedule 3 of the regulations).
Regulation 5: Fit and proper persons: directors
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: Regulation 5
The intention of this regulation is to ensure that people who have director-level responsibility for the quality and safety of care, and for meeting the fundamental standards are fit and proper to carry out this important role. The CQC cannot prosecute for a breach of this regulation or any of its parts, but it can take regulatory action.Regulation 6: Requirement where the service provider is a body other than a partnership
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: Regulation 6
The intention of this regulation is to ensure that the provider is represented by an appropriate person nominated by the organisation to carry out this role on their behalf (nominated individual). The nominated individual is responsible for supervising the management of the regulated activity provided. This is because providers who comply with this regulation will have appointed as a nominated individual a director, manager or secretary who:- Is of good character.
- Is able to properly perform tasks that are intrinsic to their role.
- Has the necessary qualifications, competence, skills and experience to supervise the management of the regulated activity.
- Has supplied them with documents that confirm their suitability.
Regulation 7: Requirements relating to registered managers
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: Regulation 7
The intention of this regulation is to ensure that people who use services have their needs met because the regulated activity is managed by an appropriate person. This is because providers who comply with the regulations will have a registered manager who:- Is of good character.
- Is able to properly perform tasks that are intrinsic to their role.
- Has the necessary qualifications, competence, skills and experience to manage the regulated activity.
- Has supplied them with documents that confirm their suitability.
Regulation 9: Person-centred care
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: Regulation 9
The intention of this regulation is to make sure that people using a service have care or treatment that is personalised specifically for them. This regulation describes the action that providers must take to make sure that each person receives appropriate person-centred care and treatment that is based on an assessment of their needs and preferences. Providers must work in partnership with the person, make any reasonable adjustments and provide support to help them understand and make informed decisions about their care and treatment options, including the extent to which they may wish to manage these options themselves. Providers must make sure that they take into account people’s capacity and ability to consent, and that either they, or a person lawfully acting on their behalf, must be involved in the planning, management and review of their care and treatment. Providers must make sure that decisions are made by those with the legal authority or responsibility to do so, but they must work within the requirements of the Mental Capacity Act 2005, which includes the duty to consult others such as carers, families and/or advocates where appropriate. The CQC cannot prosecute for a breach of this regulation or any of its parts, but it can take regulatory action. CQC must refuse registration if providers cannot satisfy us that they can and will continue to comply with this regulation.Regulation 11: Need for consent
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: Regulation 11
The intention of this regulation is to make sure that all people using the service, and those lawfully acting on their behalf, have given consent before any care or treatment is provided. Providers must make sure that they obtain the consent lawfully and that the person who obtains the consent has the necessary knowledge and understanding of the care and/or treatment that they are asking consent for. Consent is an important aspect of providing care and treatment, but in some cases, acting strictly in accordance with consent will mean that some of the other regulations cannot be met. For example, this might apply with regard to nutrition and person-centred care. However, providers must not provide unsafe or inappropriate care just because someone has consented to care or treatment that would be unsafe. See the glossary for the definition of ‘relevant person’ in relation to Regulation 11. The CQC can prosecute for a breach of this regulation or a breach of part of the regulation and can move directly to prosecution without first serving a Warning Notice. Additionally, CQC may also take other regulatory action. CQC must refuse registration if providers cannot satisfy them that they can and will continue to comply with this regulation.Regulation 16: Receiving and acting on complaints
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: Regulation 16
The intention of this regulation is to make sure that people can make a complaint about their care and treatment. To meet this regulation providers must have an effective and accessible system for identifying, receiving, handling and responding to complaints from people using the service, people acting on their behalf or other stakeholders. All complaints must be investigated thoroughly and any necessary action taken where failures have been identified. When requested to do so, providers must provide CQC with a summary of complaints, responses and other related correspondence or information. The CQC can prosecute providers for a breach of the part of this regulation that relates to the provision of information to the CQC about a complaint within 28 days when requested to do so. CQC can move directly to prosecution without first serving a Warning Notice. In addition, CQC may take any other regulatory action. The CQC must refuse registration if providers cannot satisfy them that they can and will continue to comply with this regulationRegulation 17: Good governance
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: Regulation 17
The intention of this regulation is to make sure that providers have systems and processes that ensure that they are able to meet other requirements in this part of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 (Regulations 4 to 20A). To meet this regulation; providers must have effective governance, including assurance and auditing systems or processes. These must assess, monitor and drive improvement in the quality and safety of the services provided, including the quality of the experience for people using the service. The systems and processes must also assess, monitor and mitigate any risks relating the health, safety and welfare of people using services and others. Providers must continually evaluate and seek to improve their governance and auditing practice. In addition, providers must securely maintain accurate, complete and detailed records in respect of each person using the service and records relating the employment of staff and the overall management of the regulated activity. As part of their governance, providers must seek and act on feedback from people using the service, those acting on their behalf, staff and other stakeholders, so that they can continually evaluate the service and drive improvement. When requested, providers must provide a written report to CQC setting out how they assess, monitor, and where required, improve the quality and safety of their services. The CQC can prosecute for a breach of part of this regulation (17(3)) if a provider fails to submit such a report when requested. The CQC may consider that this failure could prevent the provider from taking appropriate, timely action. The CQC could therefore move directly to prosecution for a breach of this part of the regulation without first serving a Warning Notice. Regulatory action can be taken for other parts of the regulation. The CQC must refuse registration if providers cannot satisfy us that they can and will continue to comply with this regulation.Regulation 18: Staffing
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: Regulation 18
The intention of this regulation is to make sure that providers deploy enough suitably qualified, competent and experienced staff to enable them to meet all other regulatory requirements described in this part of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. To meet the regulation, providers must provide sufficient numbers of suitably qualified, competent, skilled and experienced staff to meet the needs of the people using the service at all times and the other regulatory requirements set out in this part of the above regulations. Staff must receive the support, training, professional development, supervision and appraisals that are necessary for them to carry out their role and responsibilities. They should be supported to obtain further qualifications and provide evidence, where required, to the appropriate regulator to show that they meet the professional standards needed to continue to practise. The CQC cannot prosecute for a breach of this regulation or any of its parts, but they can take regulatory action. The CQC must refuse registration if providers cannot satisfy us that they can and will continue to comply with this regulation.Regulation 19: Fit and proper persons employed
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: Regulation 19
The intention of this regulation is to make sure that providers only employ ‘fit and proper’ staff who are able to provide care and treatment appropriate to their role and to enable them to provide the regulated activity. To meet this regulation, providers must operate robust recruitment procedures, including undertaking any relevant checks. They must have a procedure for ongoing monitoring of staff to make sure they remain able to meet the requirements, and they must have appropriate arrangements in place to deal with staff who are no longer fit to carry out the duties required of them. Employing unfit people, or continuing to allow unfit people to stay in a role, may lead CQC to question the fitness of a provider. If CQC considers that a breach of this regulation is also a breach of another regulation(s) that carries offence clauses, then we can move directly to prosecution without serving a Warning Notice. For example, in situations where the care and treatment is provided without the consent of a person using the service or someone lawfully acting on their behalf, and where it is unsafe, does not meet the person’s nutritional needs, results in abuse, or puts the person at risk of abuse. The CQC cannot prosecute for a breach of this regulation or any of its parts, but it can take regulatory action. The CQC must refuse registration if providers cannot satisfy us that they can and will continue to comply with this regulation.Regulation 20: Duty of candour
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: Regulation 20
The intention of this regulation is to ensure that providers are open and transparent with people who use services and other ‘relevant persons’ (people acting lawfully on their behalf) in general in relation to care and treatment. It also sets out some specific requirements that providers must follow when things go wrong with care and treatment, including informing people about the incident, providing reasonable support, providing truthful information and an apology when things go wrong. The regulation applies to registered persons when they are carrying on a regulated activity. The CQC can prosecute for a breach of parts 20(2)(a) and 20(3) of this regulation and can move directly to prosecution without first serving a Warning Notice. Additionally, the CQC may also take other regulatory action.Regulation 12: Statement of purpose
Care Quality Commission (Registration) Regulations 2009: Regulation 12
The intention of this regulation is to make sure that providers have produced and sent to CQC a clear statement of all the information listed under Schedule 3. Providers must notify the CQC of any changes to their statement of purpose and ensure it is kept under review, and notify the CQC when there are any changes to the information listed in Schedule 3. The CQC can prosecute for a breach of this regulation or a breach of part of the regulation. This means that CQC can move directly to prosecution without first serving a warning notice. Additionally, CQC may also take any other regulatory action. See the offences section for more detail. The CQC must refuse registration if providers cannot satisfy them that they can and will continue to comply with this regulation.Regulation 14: Notice of absence
Care Quality Commission (Registration) Regulations 2009: Regulation 14
The intention of this regulation is that the CQC can be assured that the service will continue to be properly managed if the person in charge of their service is absent. To meet the requirements of this regulation, the provider must inform CQC about any planned or unplanned absences from the service that are for a continuous period of 28 days or more, how the service will be run while they are away and when they return from a significant absence. Providers must use forms provided by the CQC to make notifications under this regulation. Further information about how to make any required notification to CQC can be found here. The CQC can prosecute for a breach of this regulation or a breach of part of the regulation. This means that the CQC can move directly to prosecution without first serving a warning notice. Additionally, the CQC may also take any other regulatory action. The CQC must refuse registration if providers cannot satisfy them that they can and will continue to comply with this regulation.Regulation 15: Notice of changes
Care Quality Commission (Registration) Regulations 2009: Regulation 15
The intention of this regulation is to ensure that the CQC is notified of specific changes in the running of the service so that CQC can be assured that the provider has taken appropriate action. The provider must inform the CQC when:- The person who manages or carries on the service changes
- There is a change to the registered details of the service and any individual, partnership or organisation who manage or carry it on
- The registered person becomes financially insolvent
- The service closes.