By Gemma Nicholas | May 21, 2025
Last Updated on May 22, 2025
Gemma Nicholas, Senior Associate in the Health and Social Care team at RWK Goodman, explores the Care Quality Commission’s (CQC’s) historical and recent approach to prosecutions, emerging themes in enforcement and what providers can do to protect themselves as enforcement activity evolves.
Sir Julian Hartley, Chief Executive at the CQC, has made clear that increasing the number of prosecutions is not his primary goal. Nonetheless, his recent comments suggest that significant changes to the CQC’s legal authority may be on the horizon – most notably the proposed removal of the current three-year limitation period for prosecuting care providers. While this move aims to align the CQC with other regulators such as the police and the Health and Safety Executive (HSE), it also raises concerns about fairness and due process for care providers, many of whom already operate under intense regulatory scrutiny.
Are CQC prosecutions increasing?
Since its establishment in 2009, the CQC has pursued 163 prosecutions. While there has been a general upward trend, growth has not been strictly linear. Notably, 2019 saw a 200% spike in prosecutions, though numbers slightly declined after peaking in 2021. This variability reflects changes in CQC priorities, particularly the overhaul of its regulatory regime. Though Sir Julian Hartley’s vision does not centre on increasing the quantity of prosecutions, the data suggests that enforcement remains a key part of the CQC’s regulatory toolkit, particularly in cases involving serious failures of care or governance.
What types of cases are being prosecuted?
CQC prosecutions are primarily brought under several key legislative frameworks, including:
- Health and Social Care Act 2008.
- Regulated Activities Regulations 2014 and 2015.
- Care Quality Commission (Registration) Regulations 2009.
- Health and Safety at Work Act 1974.
Among these, the most frequent charge is failure to provide safe care and treatment, particularly under Regulation 12 of the 2014 Regulations.
Other common allegations include breaches of:
- Regulation 13 – Safeguarding service users from abuse or improper treatment.
- Regulation 20 – Duty of Candour.
- Regulation 12 – Medication errors.
While many cases involve high-risk incidents like unwitnessed falls or choking, there is a growing number of prosecutions arising from more complex care situations, such as failure to prevent self-harm or address behavioural risks. In a notable example, a provider was charged under Regulation 16 Care Quality Commission (Registration) Regulations 2009 (failure to notify the CQC) after failing to report the deaths of 10 residents and was fined £20,800. This was paired with charges related to unsafe care, which attracted a fine of £60,000, illustrating how administrative and clinical failings are often prosecuted together.
Financial and legal consequences
The financial penalties for CQC prosecutions can be severe. Recent fines have ranged from £25,000 to over £1.5m. In 2023, a mental health service provider was fined £1,530,000, plus £79,000 in legal costs, following the death of a service user. Also, an NHS Trust was recently fined £1.66 million in connection with failures in maternal care.
These fines are calculated using several factors:
- Seriousness of the offence.
- Level of harm caused.
- Provider’s financial position or turnover.
- Culpability.
- Mitigating factors, including early guilty pleas, which may reduce penalties.
The impact of such fines can be devastating – not only financially but also in terms of reputation, staff morale and the ability to invest in service improvement.
CQC enforcement process: From investigation to prosecution
Prosecutions typically begin with a CQC investigation, which may involve:
- Site inspections.
- Review of records.
- Staff and service user interviews.
- Requests for documents under Section 64 of the 2008 Act (non-compliance with, which is a criminal offence).
If the CQC considers prosecution, the provider may receive a PACE (Police and Criminal Evidence Act 1984) notice, which sets out the allegations and offers the opportunity to respond – either via interview or written representations. In our experience, the questions can be lengthy and one-sided.
The CQC will then assess the following before deciding whether to prosecute:
- Seriousness of the breach.
- Persistence or repetition of non-compliance.
- Availability of sufficient evidence.
- Public interest in bringing charges.
Holding individuals accountable
Although most enforcement targets organisations, the CQC can also pursue individual accountability.
This applies to:
- Directors.
- Registered managers.
- Company secretaries.
- Officers of unincorporated associations.
The CQC may prosecute individuals if the offence occurred with their consent or connivance, or due to neglect, and where a clear line of responsibility can be established. The bar for evidence remains high but the message is clear: individuals, not just organisations, can face criminal liability.
Should the three-year limitation be lifted?
Under Section 90(2) of the Health and Social Care Act 2008, prosecutions must be initiated within three years of the alleged offence. Furthermore, legal proceedings must begin within 12 months of the CQC obtaining sufficient evidence to prosecute. Sir Julian Hartley argues that this restriction is outdated, particularly compared to bodies like the HSE, which has no such limitation for most offences. Removing the limitation could expose providers to prolonged legal uncertainty, especially given that many CQC investigations already take over two years. Providers are encouraged to seek early legal advice and formulate a proactive strategy if under investigation.
Avoiding prosecution: What providers should do
The consequences of a prosecution – financial, legal and reputational – can be long lasting.
To mitigate this risk, we suggest:
- Regular internal audits: Identify and resolve compliance gaps early.
- Continuous staff training: Ensure staff understand and apply safeguarding, medicine management and risk protocols.
- Policy reviews: Update procedures for infection control, reporting and care delivery.
- Engagement with regulators: Foster transparent communication with the CQC and act promptly on feedback.
- Robust documentation: Keep clear, accurate records that can demonstrate compliance during investigations.
Providers should also be aware that CQC enforcement may be accompanied by inquests, civil claims, civil enforcement action or parallel investigations by other agencies.
Evolving landscape
While Sir Julian Hartley may not be pushing for more CQC prosecutions, the evolving regulatory landscape – especially potential changes to time limits – suggests that enforcement will remain a central feature of care regulation. For providers, the best defence lies in prevention: understanding regulatory expectations, maintaining rigorous internal controls and preparing early for any investigation. When CQC does investigate, providers should obtain legal support before CQC decides on a course of action, as that can make the difference as to whether or not you face prosecution.
We have successfully represented providers at the investigation stage, persuading CQC that a prosecution is not required in the circumstances. If you are prosecuted, the approach you take throughout can also greatly affect the outcome in terms of the level of fines imposed, so it is best to have support throughout.
Gemma Nicholas is a Senior Associate in the health and social care team at RWK Goodman.