Healthcare inventory management: A guide for clinics
Par levels, FEFO rotation and lot tracking for practices with no supply chain te...
Last Updated: September 3, 2026
Key takeaways
CQC requirements apply to every provider of regulated health and social care activities in England.
The 13 fundamental standards sit in Regulations 9 to 20A, and care must never fall below them.
Registration comes before your first patient, and carrying on a regulated activity unregistered is a criminal offence.
Inspectors score you on five key questions, using the evidence you can produce on the day.
Consent records, training logs, and governance minutes are the files a private practice should keep ready.
CQC requirements are the legal standards every registered health and social care provider in England must meet, and prove. Proving it is the harder half. The standards sit in the Health and Social Care Act 2008, and there are 13 of them.
An inspector will not take your word for it, so your consent forms, training records, and governance minutes carry the argument. Keep those current and inspection becomes a formality rather than a scramble.
This guide covers registration, the 13 standards, the five key questions, ratings, enforcement, and what to have ready in 2026.
Found our content helpful?
CQC requirements are legal duties, not guidance
CQC requirements are the obligations that every provider of regulated health and social care activities in England has to meet.
They come from the Health and Social Care Act 2008 and the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. Those regulations set out 13 fundamental standards.
These are not aspirational targets. The 13 standards are the floor below which care must never fall. Breach one and the CQC has grounds for enforcement, up to cancelling your registration.
Two structures run alongside each other, and they are easy to confuse. The 13 fundamental standards are the law. The five key questions, covering safe, effective, caring, responsive, and well-led, are how inspectors judge you against it.
CQC registration comes before your first patient
Any organization or individual carrying on a regulated activity in England must register with the CQC first.
Regulated activities include treatment of disease, disorder or injury, diagnostic and screening procedures, and surgical procedures. Schedule 1 of the 2014 Regulations holds the full list.
Registered providers include NHS trusts, independent hospitals, GP practices, care homes, dental practices, ambulance services, and private practices offering regulated treatments.
The route to getting CQC registered runs through an application, a statement of purpose, a nominated individual declaration, and your policies.
Most registered providers also need a registered manager in post. That is the named person who runs the regulated activity day to day, and who must pass the fit and proper persons test.
One exemption exists. An individual sole provider who personally manages the service day to day does not need a separate registered manager. That comes from regulation 5 of the CQC (Registration) Regulations 2009.
The pathway is the same whatever the clinical setting. A physical therapy practice and a cosmetic surgery clinic complete the same application. Only the regulated activity you name changes.
Before you submit your application
Applications stall on detail rather than on principle. Check these before you send it:
- A statement of purpose that names every regulated activity, service user band, and location.
- Policies that describe how this practice works, not a bought pack with another practice’s name in it.
- DBS checks at the level the CQC asks for, in date, for every registered person.
- Evidence for the nominated individual and registered manager: qualifications, references, and fitness declarations.
- Proof you can start safely, including premises, insurance, equipment servicing, and a governance schedule with dates in it.
Keep the statement of purpose and the policies in step. If one names an activity the other ignores, expect follow-up questions and a slower decision.
What the 13 fundamental standards ask of you
The CQC fundamental standards are defined in Regulations 9 through 20A of the Regulated Activities Regulations 2014. Every registered provider must meet all 13. Here is what each one requires in practice.
The three standards a private practice is judged on hardest
Three of those standards carry the most weight in a private practice, and each one has a document behind it:
- Consent (Regulation 11). Informed consent is recorded before every treatment. The form should show what was explained, who explained it, and that the patient had room to ask questions.
- Good governance (Regulation 17). Quality assurance, accurate records, and a habit of learning from incidents. Meeting minutes and audit notes are the proof.
- Duty of candour (Regulation 20). When a notifiable safety incident happens, you tell the patient, apologize, and account for it in writing. Keep the letter you sent.
The five key questions inspectors score you against
Every service is assessed against five key questions. Is it safe, effective, caring, responsive, and well-led? The standards are the law, and these questions are the lens.
- Safe: Are people protected from abuse, avoidable harm, and unsafe practice? Inspectors look at risk assessment, medicines management, incident reporting, and infection control.
- Effective: Does care achieve good outcomes? They check whether treatment follows evidence-based guidance, and whether staff have the skills to deliver it.
- Caring: Are patients treated with compassion, dignity, and respect? This one is judged by observation, patient interviews, and feedback.
- Responsive: Is the service organized around individual needs? Access, complaint handling, and adjustments for different groups all count here.
- Well-led: Is the service governed well? This covers governance structures, leadership culture, staff engagement, and how you improve.
How the five questions turn into a rating
Under each key question sits a set of quality statements. They are written as “we statements” that describe what good care looks like, and each one points back to the regulations behind it. So a judgment about being well-led traces to Regulation 17, not to an inspector’s mood.
The CQC then gathers evidence in six categories: people’s experience of care, feedback from staff and leaders, feedback from partners, observation, processes, and outcomes.
Which categories carry the most weight varies by the type of service. For a small private practice, patient feedback and your own processes usually do the heavy lifting.
A weak score in safe or well-led weighs heavily on the overall rating. Those two questions cover risk and leadership, so a problem there tends to show up in the other three as well.
CQC requirements for private practices and aesthetic clinics
Published guidance leans heavily on care homes and NHS trusts, which leaves independent providers reading around their own situation. Private practices carry the same legal obligations. The regulated activity changes, the regulations do not.
Three questions come up more than any others.
1. Does my practice need to register?
If you carry on an activity listed in Schedule 1, yes. Surgical procedures, treatment of disease, disorder or injury, and diagnostic or screening procedures all sit on that list. Cosmetic surgery, private GP services, and prescription-only treatments given under a registered prescriber generally fall inside it.
2. We only offer non-surgical aesthetics. Are we exempt?
Sometimes. Treatments outside the regulated activities list, delivered without prescription medicines, may not need registration. One prescribing consultation on site can change that answer, so check the list rather than assume the exemption.
Will the CQC assess our qualifications?
Not directly. It assesses whether you have systems that keep staff trained, supervised, and competent for the treatments they deliver. Governance documentation is where independent providers most often lose marks, because the work happened and the record did not.
Pro Tip
Check Schedule 1 of the Regulated Activities Regulations 2014 before you assume your practice does or doesn’t need to register. It lists every regulated activity. Registration depends on what you do, not on what you call the service.
CQC mandatory training: what Regulation 18 requires
There is no fixed CQC list of mandatory training subjects. Regulation 18 requires staff with the right skills, qualifications, competence, and experience for the care they deliver. What that means in practice depends on your service type and the roles in it.
Skills for Care’s statutory and mandatory training guidance is the reference point most care providers work from. Inspectors expect to see training in the areas it covers, even though it is guidance rather than a statutory list. The subjects that come up most often are:
- Safeguarding adults and children
- Infection prevention and control
- Manual handling, where relevant
- Mental Capacity Act and Deprivation of Liberty Safeguards
- Basic life support and first aid
- Medicines management, for services handling prescription medicines
- Equality and diversity
Records decide this section. Training that happened but was never logged is not evidence, however good the session was. Keep signed records, certificates, and renewal dates together, and give one person the job of chasing what expires next quarter.
How a CQC inspection works on the day
Inspections are announced or unannounced. Routine assessments usually come with notice, while a visit prompted by a concern or a complaint may not. The team can include specialist clinical advisors and inspectors with a background in your type of service.
On the day, the team observes care, talks to staff and patients, and reads records. Expect them to ask for a specific document and then follow the thread through it.
A consent form leads to the treatment note, and the treatment note leads to the training file of whoever delivered the treatment.
Inspection is only one part of the Care Quality Commission’s role. It also monitors providers between visits, using the notifications you send, feedback it receives, and the information you submit.
Afterwards you get a draft report to check for factual accuracy. You can challenge facts, not judgments, so keep your correction letter narrow and evidenced.
Once published, the rating goes on the CQC website and must be displayed at your practice and on your own site.
What each CQC rating means
Each of the five key questions gets its own rating, and so does the service overall. There are four to choose from.
Most compliant providers running steady systems land on Good. Outstanding asks for something extra, and the evidence for it has to exist before the inspector arrives.
What happens if you breach CQC requirements
The CQC’s powers run from a written warning to criminal prosecution. In rough order of severity, they are a warning notice, a fixed penalty notice, conditions on registration, suspension, then cancellation.
Which one it uses depends on the risk to people, and on whether earlier action worked.
Providers placed in special measures get closer monitoring and a fixed period to improve. Miss that window and cancellation usually follows. Enforcement decisions are published too, so they follow the practice’s name around for years.
How to prepare for a CQC inspection
Preparation is not a sprint before the inspector arrives. It is a set of habits that leave a trail behind them. Work through this list once a quarter instead of once a year.
- Review your policies. Each one should be current, signed off by a named person, and easy for staff to find. Out-of-date policies are a common finding.
- Audit training records. Confirm that every member of staff has done the training their role needs, and that renewal dates are tracked somewhere visible.
- Check consent documentation. Every patient record needs a signed form that matches the treatment delivered and the information given. A medical treatment consent form gives you a structure to audit against.
- Read your own governance file. Meeting notes, complaint logs, and incident reports should show a pattern of noticing problems and doing something about them.
- Open two staff files at random. Each needs references, a DBS disclosure, proof of right to work, and evidence of qualifications.
- Walk the service as an inspector would. Start at the front door, follow one patient’s journey, and write down what you would rather an inspector did not see.
Where preparation usually slips
- Policies signed off by someone who left the practice two years ago.
- Training logged in a spreadsheet, with the certificates saved somewhere else entirely.
- Incident reports that record what happened, but never what changed afterwards.
All three are record-keeping problems rather than care problems. They are also the cheapest findings to prevent.
How Pabau keeps your CQC evidence audit-ready
Ask a private practice for last April’s consent form and the answer is usually “give me an afternoon”. The record exists. It is split across a filing cabinet, a shared drive, and a practitioner’s phone, which is what makes inspections feel like an event.
Practice management software like Pabau keeps that evidence attached to the patient instead. Our compliance management software captures consent digitally, timestamps it, and files it against the patient record alongside the treatment note and the before-and-after photos. Custom forms cover the rest of the paper trail, from medical questionnaires to incident logs.
The benefit is narrow and useful. When an inspector asks for a document, you search for a patient rather than a cabinet. The record itself shows whether the form was ever signed. Data protection duties overlap heavily with this, and the UK GDPR compliance checklist covers the same records from the other direction.
No system makes a practice compliant, and none can promise you a rating. What changes is how long it takes to prove what you already do well.
Keep your CQC evidence ready to hand
Pabau files digital consent, treatment notes, and photos against the patient record, each one timestamped. The evidence an inspector asks for takes seconds to find.
Conclusion
CQC requirements reward habit over heroics. Document consent the same way every time. Log training the week it happens. Write down what changed after an incident. Do those three and you will pass inspections you never really prepared for.
So pick the weakest of those three and fix it this month. Registration duties and the 13 standards are fixed, and you cannot negotiate them. How quickly you can prove them is the part you control.
Book a demo to see how Pabau keeps consent, treatment notes, and patient records inspection-ready for private practices in England.
Continue your research
Ready to start your application? How to get CQC registered walks through the form, the statement of purpose, and the registered manager requirements for independent providers.
New to the regulator? The Care Quality Commission’s role explains what the CQC does between inspections, and how it monitors registered providers.
Need a consent form to audit against? Consent for medical treatment template gives you the fields a Regulation 11 record should carry, ready to adapt.
Want to test your own records first? How to run a medical chart audit sets out a sampling method you can use before an inspector picks the files.
Handling patient data as well as care quality? UK GDPR compliance checklist covers retention, access requests, and the records that both regimes expect you to keep.
Frequently asked questions
What is the difference between a nominated individual and a registered manager?
The nominated individual represents an organization to the CQC and supervises how the regulated activity is carried on. The registered manager runs the service day to day and is registered in their own right. An organization needs both roles filled. An individual sole provider who personally manages the service does not have to appoint a separate manager.
What do I have to notify the CQC about?
Certain events, in writing, without waiting for an inspection. The CQC (Registration) Regulations 2009 set the list. It covers deaths, serious injuries, allegations of abuse, police involvement, and events that stop the service running safely. Failing to notify is itself a breach, so make one named person responsible for sending them.
Does CQC registration transfer if I sell the practice?
No. Registration belongs to the provider, not to the business. The buyer registers, or applies to add the location to an existing registration, while the seller applies to remove it. Plan the overlap early, because the new provider cannot carry on the regulated activity until its own registration is in place.
How do quality statements relate to the fundamental standards?
The standards are the law, and quality statements describe what good practice looks like under each key question. Each statement points back to the regulations behind it. Evidence is gathered in six categories, weighted differently by service type, so patient feedback, staff feedback, and your own processes all count.
Found our content helpful?
