The policy everyone followed: what a coroner's report says about policies and the concerns we don't count - CW for Suicide.

We talk a lot about "write-only" policies. You know the type: drafted carefully, approved at committee, uploaded to the shared drive and never opened again. Staff couldn't tell you what's in them, and nobody can remember the last time one changed anything.

A Prevention of Future Deaths report published by the Chief Coroner's office in September shows the other side of the same coin. In this case staff knew the policy. They followed it closely. That was part of the problem.

What the coroner found

Robert Day was 60 and under the care of community mental health services in Kent for severe depression. He died in January 2025, and the inquest concluded that he had taken his own life. In March 2026 Ian Potter, Area Coroner for Kent and Medway, wrote to the trust's chief executive setting out concerns he believed could lead to future deaths if nothing changed.

Most of them sat under one heading: professional curiosity. The coroner heard that:

•      "home visits" had been held in public places, so clinicians never saw how he was actually living

•      the trust's Did Not Attend policy had been applied very strictly, with little real thought about why appointments were being missed, and one witness felt the policy itself was the issue

•      his sister contacted the trust with concerns at the start of January; two nurses visited that same day, but the plan they recorded was described in evidence as not reasonable, and a referral to the rapid response team would have been expected

•      some staff judged him on how he presented on a single day, without looking back at his history

A separate concern covered record keeping. On 14 January a paramedic sought advice from the trust's phone line, and there was no record of that call or the advice in his notes.

It matters to be precise here. The coroner did not find that these failings caused Robert's death. His concern was about what happens next, and he said he was not reassured when a manager explained they didn't want to roll changes out across every team in case it looked like a knee-jerk reaction.

Write-only, read-only: the same problem

A write-only policy fails because nobody uses it. A read-only policy fails because people use it instead of thinking.

Non-attendance policies are the classic case. Their job is to stop people falling through the gaps when they don't turn up. Applied without curiosity, they become the gap. Missed appointment, letter, second missed appointment, discharge. Every step compliant, and nobody asking why someone who is depressed and isolated has stopped engaging.

The answer isn't another policy. It's building the question into the one you already have. A good missed-appointment policy doesn't just say what to do after two DNAs. It asks the clinician to record what they think is going on, and who they've checked with, before they act.

The sister's phone call is data

Then there's the call from his sister. It almost certainly wasn't logged as a complaint, and most organisations wouldn't count it as one. But a worried relative picking up the phone is exactly the kind of signal a concerns system exists to catch. It's also the cheapest intelligence a provider will ever get.

This is why we keep coming back to complaints data as a gift rather than a nuisance. The formal complaint about a billing error or a curt receptionist matters. The informal ones matter more: the worried sister, the "he doesn't seem himself" at reception, the carer who mentions something in passing. That's where risk shows up first. A complaints log that only holds what arrived in writing is missing most of the story, and with it your early warnings.

Why this matters in the independent sector

Private and independent providers run on the same kinds of documents: cancellation and missed-appointment policies, discharge-after-non-attendance rules, sometimes fees. Because they're often written with admin and commercial reasons in mind, they're more likely to be applied mechanically, not less. And families of private patients often have fewer obvious routes to raise a worry, so what they say on the phone or at the front desk carries even more weight.

Five questions to ask this month

1.     When did a policy last change because of something that happened on the floor, rather than because its review date came round?

2.     Does your missed-appointment or non-attendance policy require someone to ask why before they act?

3.     Where does a worried relative's phone call go? Is it logged anywhere a manager, or the board, would ever see it?

4.     When you audit policy compliance, do you ever ask whether following the policy was the right call?

5.     If a fix is needed in one team, what stops you making it in all of them?

That last one is really the coroner's point. Making a change everywhere isn't a knee-jerk reaction. It's governance.

If this post has raised anything difficult for you, Samaritans are available day or night, free, on 116 123.

Source: Regulation 28 Report to Prevent Future Deaths, Robert Day (ref. 2026-0372), Courts and Tribunals Judiciary: https://www.judiciary.uk/wp-content/uploads/2026/09/Robert-Day-Prevention-of-future-deaths-report-2026-0372_Published.pdf

The Silence Before the Harm: When Staff Don't Feel Safe to Report Near Misses

A near miss is the cheapest lesson a healthcare organisation will ever get, pretty much free feedback data. Nobody was harmed, nothing needs putting right, and the system has just shown you exactly where it's weak.

All it costs is someone being willing to say so.

When staff don't feel safe to report, that lesson is lost. And the organisation usually doesn't notice, because the most visible sign of a silent culture is a reassuringly short incident log.

What the numbers say

The 2025 NHS Staff Survey, published in March 2026, gives a clear picture of how staff feel about reporting:

•      59.3% said their organisation treats staff involved in an error, near miss or incident fairly. Put another way, around four in ten didn't.

•      71.1% said they would feel secure raising concerns about unsafe clinical practice.

•      55.5% were confident their organisation would address their concern.

•      33.7% had seen an error, near miss or incident in the last month that could have hurt staff or patients.

All three confidence measures fell slightly on the year before. The survey covers NHS staff, not the independent sector, but there's no reason to assume private providers are doing better. In some ways it's harder.

Why staff stay quiet

The reasons are rarely dramatic. They tend to be ordinary, and they add up.

Fear of blame. If the last person who reported something ended up in a disciplinary meeting, everyone noticed.

Nothing happens. If reports disappear into a system and nobody hears back, people stop bothering.

"It was fine in the end." A near miss feels like a non-event. Staff don't see why they should fill in a form about something that didn't happen.

It takes too long. A busy shift and a clunky reporting system is a reliable way to lose near-miss data.

Hierarchy. Raising a concern about a senior colleague's practice feels risky, especially for junior, bank or agency staff.

The independent sector twist

Private and independent providers face some extra pressures. Teams are often small, so a report can be hard to make anonymously. Many consultants work under practising privileges, and they may also bring commercial value to the hospital. A nurse questioning a consultant's practice may wonder, privately, whether the organisation will back her or the person who brings in the work. It may have seemed that in harmful events, the last person to touch the patient was blamed.

None of that is unique to private healthcare. But a board that hasn't asked the question directly can't know how its staff would answer it.

What silence costs

Unreported near misses don't disappear. They repeat, until one of them doesn't stay a near miss.

There's a governance cost too. A low incident rate is easy to read as good news. Often it's the opposite: a sign that people have stopped reporting. Under the Patient Safety Incident Response Framework (PSIRF), organisations are expected to learn from patient safety events rather than focus on blame. And CQC's "Learning culture" quality statement looks for openness and honesty, concerns that are listened to, and lessons that are learned and shared. An organisation that hears very little from its staff will struggle to show any of that.

What good looks like

Make it fair, make it visible. A just culture approach separates honest mistakes and system problems from reckless behaviour. Staff need to see that in practice, not just read it in a policy.

Close the loop. Tell people what happened to their report. A short "you told us, we changed this" note does more for reporting than any campaign.

Make it quick. If it takes more than a few minutes, near misses won't get reported. Offer more than one route, including anonymous and verbal.

Thank people for near misses. Treat a near-miss report as good practice, because it is. Some organisations share a "good catch" each month.

Protect the person, not just the process. Make sure staff know they won't be treated badly for raising a concern in good faith, including about a senior colleague or a consultant with practising privileges.

Questions for your board

•      Is our reporting rate rising, falling or flat, and do we know why?

•      Which teams report the fewest incidents, and have we asked them why?

•      What share of our reports are near misses or no harm? A healthy reporting culture usually has plenty.

•      When did someone last tell us something about a senior clinician, and what happened to them afterwards?

The Harbour Governance team believes the best measure of a safety culture isn't how few incidents you report. It's how much you hear before anyone gets hurt.

Chapter 8: Culture — The Board as Guardian of "How We Do Things Here"

What Good Looks Like — a board-level guide to governance done well

Culture is usually described as "how we do things around here". It's the honest answer to what actually happens when nobody senior is watching. Which is exactly why it's so hard for a board to see.

Most boards treat culture as an HR topic. It turns up once a year with the staff survey, gets a twenty-minute slot, and goes back to the people team. But culture decides whether a policy is followed or quietly worked around, whether a concern is raised or swallowed, and whether bad news travels up or stops at the first manager. That makes it a governance question, and one only the board can own.

Chapter 5 looked at the information a board sees. Culture is where that problem is sharpest, because the signals are soft, scattered and easy to explain away.

Why culture belongs to the board

Every other part of the governance framework depends on it. A risk register only works if people feel safe to name the risk. Incident reporting only works if staff believe reporting leads to learning, not blame. A Freedom to Speak Up Guardian only works if speaking up doesn't cost people anything.

The board sets the tone, whether it means to or not. What it asks about, what it praises, what it lets pass, and how it treats the person who brings bad news are all signals that travel down the organisation faster than any values poster. (Also, posters never, ever work!!)

Hearing about culture versus seeing it

Most boards hear about culture. A survey summary, an engagement score, a slide of staff quotes chosen by the people presenting them. All useful, but all filtered, and all reported by those with an interest in the answer.

Seeing culture is different. It means looking for the evidence that people can't easily polish:

•      Patterns, not averages. Which teams report fewer incidents than you'd expect? Where are sickness, turnover or agency use higher? A quiet team isn't always a safe one.

•      What staff do, not what they say. Who raises concerns, through which route, and what happens to them afterwards?

•      What patients and families tell you. Complaints read in full, not counted. Themes that repeat across months.

•      What the board sees for itself. Visits to services, unannounced where possible, at night and at weekends, talking to the people doing the work rather than the people managing it.

The question isn't "is our culture good?" It's "what would we expect to see if it wasn't, and are we looking?"

What it looks like when it fails

The independent investigation into maternity and neonatal services in East Kent, published in October 2022, was titled Reading the signals. The title was the point. The investigation found "gross failures of teamworking across the Trust's maternity services", and that the Trust "too often treated the concerns expressed by families as 'noise'".

It also found that "the Trust Board itself missed several opportunities" to identify the scale of the problems. The signals were there, in families' accounts, in staff behaviour and in outcomes. The culture had made them easy to dismiss.

Where to start

None of this needs a culture programme. It needs a board that decides to look.

Put culture on the agenda as a governance item. Not just once a year with the staff survey. Pick two or three culture indicators and look at them every quarter, alongside quality and finance.

Ask for the outliers. The team with the lowest incident reporting, the highest turnover, the most complaints, the fewest concerns raised. Then ask why.

Go and see. Every board member should visit services regularly, including out of hours, and share what they saw at the next meeting. Not as inspection, but as listening.

Follow one concern through. Once a year, take a concern someone raised and trace what happened to it, and to them. It will tell you more about your speaking-up culture than any survey.

Watch the board's own behaviour. How the board responds to bad news is the strongest culture signal of all. If the messenger is thanked, more messages follow. If not, they stop.

The Law of Conservation of Paperwork.

Every so often, someone in healthcare finds a corner the regulator hasn't reached yet. A service that technically isn't a regulated activity. A process nobody has thought to write a form for. A brief, glorious patch of open ground.

Enjoy it. It won't last.

This week DHSC asked CQC to regulate diagnostic-only ADHD and autism assessments. For years these services sat in a gap in the wording of the regulations: a clinic could diagnose to its heart's content, provided it didn't then treat anyone. That gap is now being filled, as all gaps eventually are, with a registration application, a statement of purpose and a registered manager who is about to find out what a Regulation 18 notification is.

We've come to think of this as a law of nature. Energy can't be created or destroyed…and neither can paperwork.

It simply flows from places that have plenty to places that have none, until the whole system reaches equilibrium. This usually happens the week of your inspection.

A few observations from a career spent on wards, in law and in information systems:

• Any process that "doesn't need a policy" will need one the morning after the incident.

• The form you abolish in a streamlining exercise will be back within 18 months as a template, a checklist and a dashboard.

• "We'll document it later" is the most expensive sentence in healthcare.

• There's no such thing as an unregulated activity. There are only regulated activities that haven't been noticed yet.

• Every framework is eventually replaced by a new framework. That brings guidance, the guidance brings FAQs, and the FAQs bring clarifications. CQC's new frameworks land at the end of the year, and I've cleared some shelf space.

Now the serious bit, because as a governance consultant I'm contractually obliged to include one!

Health and safety professionals have a saying: regulations are written in blood. Behind almost every rule there's someone who got hurt before it existed.

Healthcare is no different. Bureaucracy tends to win because somewhere underneath it there's a patient who was let down while nobody was looking. The ADHD gap was where people could receive a poor service with no one checking, and closing it is the right call.

So if your service is sitting in a gap right now, the cheapest time to build good governance is before anyone tells you to.

You'll have to do it eventually. Better to do it on your own timetable than on CQC's.

The paperwork is coming. You may as well make friends with it.

30 October: Is Your Harassment Policy Ready for "All Reasonable Steps"?

On 30 October, two changes to harassment law take effect under the Employment Rights Act 2025. For healthcare providers, the second one matters most: employers become liable when staff are harassed by patients, relatives and visitors, unless they've taken all reasonable steps to prevent it.

There's not much time. And an Acas survey of senior decision makers, carried out in the spring, found that 41% of employers weren't aware the changes were coming.

What changes on 30 October?

The sexual harassment duty gets tougher. Since October 2024, employers have had to take "reasonable steps" to prevent sexual harassment of their workers. From 30 October, that becomes "all reasonable steps". Acas puts it plainly: employers will be expected to take them all, with no exceptions. What counts as reasonable still depends on your size, sector and the work you do.

Employers become liable for third-party harassment. If a worker is harassed in the course of their work by someone outside the organisation, the employer can be liable, unless it took all reasonable steps to prevent it. This isn't limited to sexual harassment. It covers harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation - all of the protected characteristics.

Two existing rules sit alongside these. Tribunals can already increase compensation by up to 25% where an employer has failed in its duty to prevent sexual harassment. And since April 2026, disclosures about sexual harassment can count as protected whistleblowing disclosures.

Why this lands harder in healthcare

Most employers think of third parties as customers or contractors. In healthcare, they're patients, relatives and visitors, and staff deal with them in some of the most intimate and pressured settings there are. Personal care, home visits, lone working, night shifts, distressed families: each of these is a risk the new law expects you to have thought about.

There's a tension here too. A patient's behaviour may be linked to their condition, and good care means responding with compassion, not just enforcement. The law doesn't ask you to stop caring for people. It asks you to show you've assessed the risk to staff and taken reasonable steps to reduce it.

A practical checklist before 30 October

1.     Update your policy. Make sure it covers third-party harassment as well as harassment between colleagues, names the protected characteristics, and explains how patient and visitor behaviour will be handled.

2.     Do a risk assessment. Identify where staff are most exposed: lone working, community visits, personal care, night shifts, high-acuity settings. Record what you're doing about each one.

3.     Give people more than one way to report. Not everyone will go to their line manager. Include an anonymous route and your Freedom to Speak Up guardian.

4.     Train staff and managers. Staff need to know what to report and how. Managers need to know how to respond, investigate and support the person who raised it.

5.     Tell patients and visitors what you expect. Signage, patient information and admission agreements can set out the standard of behaviour and what happens if it isn't met.

6.     Plan your response to incidents. Decide in advance what options you have when a patient or relative harasses staff, from a conversation to changing the care arrangements, so decisions aren't made from scratch under pressure.

7.     Keep records. If you're ever challenged, you'll need to show what steps you took. A log of incidents and actions, and evidence of training and review, is the evidence you'll need.

8.     Give it board-level ownership. Name a board lead, and add staff safety from harassment to the risks your board actually discusses.

The governance angle

This is a good example of a duty that's easy to meet on paper and hard to meet in practice. A refreshed policy and a training module will tick a box. "All reasonable steps" asks something different: whether you know where your staff are at risk, and whether what you've done is actually working.

The Harbour Governance team will be covering what good looks like as guidance develops. In the meantime, if your policy hasn't been reviewed since 2024, this fortnight is the time.

Chapter 7: Strategy — Setting Direction Without Setting the Detail

What Good Looks Like — a board-level guide to governance done well

Ask a board what it does on strategy and most will say it "approves" it. That's the problem. Approval is the last step, and by the time a strategy arrives for sign-off, the thinking that matters has already been done, or skipped.

Chapter 2 drew the line between oversight and management. Strategy is where that line is hardest to hold. Boards are told to shape strategy, not just rubber-stamp it. They're also told not to run the business. Somewhere between those two instructions is the useful part.

What boards are actually for in strategy

The executive team builds the strategy. They know the services, the market, the workforce and the numbers far better than any non-executive can. The board's job is different. It sets the direction the strategy has to serve, and it tests whether the strategy will get there.

In practice that means a handful of things. Agreeing what the organisation is for, and what it won't do. Setting the boundaries: how much risk, how much debt, which lines can't be crossed on quality. Testing the assumptions a plan rests on. And holding the executive to account for delivery, once the plan is agreed.

None of that requires the board to write a single line of the plan.

Drifting too far back

The first failure is a board that leaves strategy entirely to the executive. The plan arrives polished, the presentation is confident, and the board's role shrinks to asking for clarification and saying yes.

HBOS is the classic case. The Parliamentary Commission on Banking Standards concluded that "the strategy set by the Board from the creation of the new Group sowed the seeds of its destruction." More striking still, it found that "the Board, in its own words, had abrogated and remitted to the executive management the formulation of strategy". By its own account, the board had handed strategy away.

Drifting too far forward

The opposite failure looks more energetic, and it's just as damaging. A board that rewrites the executive's plan line by line, debates which site should open first, or reopens a decision every time a director has a new idea isn't challenging. It's second-guessing.

The signs are usually easy to spot. The same decision comes back to the board three times. Board papers grow longer because executives are trying to pre-empt every question. Directors start proposing their own alternatives in the meeting. And the executive team, slowly, stops owning the plan, because the board has made it clear that it's really theirs.

Where challenge tips into second-guessing

The difference isn't how hard the question is. It's what the question is aiming at.

Challenge tests the reasoning. "This plan assumes we can recruit 40 nurses in 12 months. What happens to the plan if we only find 20?"

Second-guessing substitutes the board's judgement for the executive's. "I think we should open in Leeds instead of Manchester."

The first question leaves the executive owning the answer and makes the plan stronger. The second takes ownership away, often on the basis of less information than the executive already has.

A useful rule of thumb: challenge asks "how do you know?" and "what if you're wrong?" Second-guessing says "I'd do it differently." If a director genuinely thinks the executive has made the wrong call, the right response is to say so clearly, once, and to ask what evidence would change their mind. Then the board decides, and lives with the decision.

Where to start

A few habits make the difference.

Get involved early, not late. Hold a strategy session before the plan is drafted, to agree direction, boundaries and the questions the plan must answer. Approval then becomes a check, not a first look.

Write down what the board won't accept. Risk appetite, quality red lines, limits on borrowing. These are the board's real contribution to strategy, and they give the executive freedom inside them.

Test the three assumptions that matter most. Every plan rests on a few. Ask the executive to name them, and to show what happens to the plan if each one is wrong.

Decide once. When the board has agreed a strategy, it shouldn't reopen it without new evidence. Track delivery against agreed milestones instead.

Once a year, ask the executive how the board helped. And how it got in the way. The honest answer tells you which side of the line you've been on.

Q3 2026 in review: the regulatory changes independent providers need to know…

July to September brought a new Prime Minister, a new Health Secretary, a Health Bill through the Commons and a CQC that finally hit its inspection target. What it didn't bring was the new assessment framework. For independent providers, that leaves a clear message for Q4: you are still being judged under the Single Assessment Framework, and the regulator is inspecting at pace.

Here's what happened, what it means for the independent sector, and what's on the horizon.

A new Prime Minister and a third Health Secretary in a year

What happened. Andy Burnham became Prime Minister in July and appointed Yvette Cooper as Secretary of State for Health and Social Care on 20 July. She replaced James Murray, who had held the post for about two months after Wes Streeting resigned in May. Cooper has named her early priorities as maternity services, social care reform and support for the NHS.

What it means for the independent sector. Three Health Secretaries in one year means policy priorities can move quickly. The 10-Year Health Plan is still the backbone, but watch for social care reform to move up the list. If you provide adult social care or community services, expect more political attention on quality, workforce and cost.

One detail worth noting: as Greater Manchester mayor, the new Prime Minister publicly opposed abolishing Healthwatch. That position matters for the Health Bill, below.

The Health Bill clears the Commons, with a Healthwatch rethink

What happened. The Health Bill 2026–27 finished its Commons stages on 8 September after Public Bill Committee (which ended on 16 July) and two days of Report Stage. The core of the Bill is unchanged. It abolishes NHS England, moves the Health Services Safety Investigations Body (HSSIB) into the CQC, and abolishes Healthwatch England and local Healthwatch.

The Healthwatch piece is now in play. On the last day of Report Stage, health minister Karin Smyth committed to review the abolition provisions, and ministers have signalled amendments in the Lords to keep an independent local voice for patients and people using care. The detail hasn't been decided.

What it means for the independent sector. HSSIB moving into the CQC is the change to watch. The government says the "safe space" for safety investigations will be preserved behind an internal wall. Critics, including the CQC itself in May, have warned about a conflict between investigating and regulating in the same body. For independent providers, this sharpens a question you should already be answering: if a safety investigator and your regulator share a building, how confident are you in your own PSIRF learning responses, candour records and board oversight of incidents?

If Healthwatch survives in a new form, Enter and View-style scrutiny of care services may survive with it. Plan as though independent patient-voice scrutiny will continue.

CQC: target beaten, framework delayed

What happened. The CQC set itself a target of 9,000 assessments between April 2025 and the end of September 2026. Its August update reported 9,646, a month early. For context, at the end of March it had completed 6,382, against 3,825 the year before.

The new assessment frameworks are running behind. The CQC's own plan was to publish final sector-specific frameworks in summer 2026 and implement from the end of the year. Instead, the summer pilots (the general practice pilot runs June to October) have been followed by an autumn programme of further sector-specific engagement, with the pilot evaluation due in November. A January 2027 launch now looks optimistic.

The CQC's instruction to providers hasn't changed: until the new approach is implemented, keep working to the current published guidance.

What it means for the independent sector. Two things. First, every one of those 9,646 assessments used the Single Assessment Framework, and that will carry on until the CQC says otherwise. Your evidence still needs to map to the 34 quality statements. Second, the CQC now has capacity. If your rating is more than two years old, the chance of an assessment in the coming months is higher than it has been for years.

The drafts still give you a head start. All four replace quality statements with key lines of enquiry (24 in the adult social care draft) and bring back rating characteristics instead of numerical scoring, with more weight on learning culture and outcomes. Build evidence that works under both.

AI scribes: the regulators draw a line

What happened. On 29 July the MHRA published guidance on ambient voice technology (AVT), better known as AI scribes. NHS England updated its own ambient scribing guidance to version 3 at the same time and withdrew its earlier position that any summarising scribe had to be a registered medical device. The MHRA's view: a tool that only transcribes, summarises, drafts letters or suggests codes for a clinician to check is not a medical device. A tool that supports diagnosis or treatment, or acts without clinician review, is. Clinicians stay responsible for checking what the AI produces. HSSIB has also opened an investigation into AVT.

What it means for the independent sector. Many independent clinics adopted scribes quickly. The new guidance is welcome clarity, but it moves the governance burden onto you. Your board should be able to show what each tool is for, a completed DPIA, how clinicians verify outputs, and how patients are told. Healthwatch England found that 81% of people want explicit consent when AI scribes are used, so consent is a good place to start.

Employment Rights Act: the October wave

What happened. The second big tranche of the Employment Rights Act 2025 lands this month. The main changes:

•      The time limit for most employment tribunal claims doubles from three months to six.

•      Employers must take "all reasonable steps" to prevent sexual harassment of staff, up from "reasonable steps".

•      Employers become liable for harassment of staff by third parties, such as patients, relatives and visitors.

•      Trade unions gain stronger rights of access and recognition.

What it means for the independent sector. Healthcare is a patient-facing sector, so third-party harassment is a live exposure every day. Check that your harassment policy covers patients and visitors, that staff know how to report it, and that your risk register reflects it. Longer tribunal time limits also mean HR records need to be complete and kept for longer. This is a workforce issue, but it is also a well-led issue: boards should see it.

Assisted dying bill falls

What happened. The reintroduced Terminally Ill Adults (End of Life) Bill was defeated at Second Reading on 11 September, by 286 votes to 270. It makes no further progress in its current form.

What it means for the independent sector. Nothing changes in practice for now. Hospices and palliative care providers should still expect the issue to return, whether through another Private Member's Bill or government legislation. The debate kept attention on access to palliative care, which may well shape funding and policy before any law on assisted dying does.

On the horizon

Health Bill Lords stages - Amendments on Healthwatch; scrutiny of the HSSIB safe space inside CQC

CQC sector-specific engagement events - Last chance to shape the frameworks for your sector

CQC pilot evaluation - The clearest signal yet on when new frameworks go live

To be confirmed

New CQC Chair

Sir Mike Richards is stepping down once a successor is in post; a permanent Chief Executive appointment follows

2027

Medical device regulation overhaul

The MHRA published draft amending regulations in May; relevant to any clinic using software or AI tools

January 2027

Unfair dismissal reforms

The next major Employment Rights Act change

What to do this quarter

🌊 Keep evidence mapped to the current 34 quality statements, and start a parallel map to the draft key lines of enquiry for your sector.

🌊 If your rating is over two years old, run a mock assessment now.

🌊 Take your incident, PSIRF and duty of candour records to the board, assuming an investigator could read them.

🌊 List every AI tool in clinical use, its intended purpose, DPIA status and how outputs are verified.

🌊 Update harassment policies to cover patients and visitors before the end of October.

Regulatory updates and horizon scanning to keep you on course as the rules shift: that's what the Harbour Governance team is here for. If any of this lands on your board agenda, we can help you make sense of it.

Sources

•      Digital Health: PM Burnham appoints Yvette Cooper as health secretary

•      House of Commons Library: Health Bill 2026–27 progress

•      UK Parliament: Health Bill publications

•      Patient Safety Learning hub (HSJ): Ministers to unpick Healthwatch abolition

•      Nuffield Trust: What's in the new Health Bill?

•      Healthcare Management: Health Bill risks 'patient safety bonfire'

•      Log my Care: CQC's new assessment framework, what happens by Christmas?

•      CQC Board, 3 June 2026: Q4 performance report

•      Price Bailey: CQC's new primary care framework

•      Safework: CQC's new assessment frameworks

•      Credentially: what changed on 24 March

•      Brodies: MHRA clarifies AI scribes are not automatically medical devices

•      Mills & Reeve: AVT guidance as HSSIB launches investigation

•      NHS Employers: October employment law changes

•      Mills & Reeve: Assisted dying bill falls at second reading

Chapter 6: Risk Oversight — Beyond the Register, Into the Room

What Good Looks Like — a board-level guide to governance done well

Every board has a risk register. Very few boards have a risk conversation. The register is a document. Oversight is what happens when directors sit round a table and decide whether they're comfortable with the risks the organisation is carrying.

Chapter 5 looked at how the information a board sees shapes what it does. The risk register is the clearest example. It arrives every quarter, it looks thorough, and it can quietly replace the thinking it was meant to support.

Why the register gives false comfort

Most risk registers are built in good faith. They still tend to fail in the same few ways.

Scores settle. A risk is rated 16 when it's first added, and two years later it's still 16, because nobody has a reason to change it. The number stops describing the risk and starts describing the habit.

Controls are listed, not tested. "Policy in place", "training delivered", "monitored at committee". Each one sounds like protection. None of them tells the board whether the control actually works.

Mitigations are intentions. "Review of staffing model underway" can sit on a register for a year. It reads as action. Often it's a plan to have a plan.

The register only holds what someone has already thought of. The risks that hurt organisations most are frequently the ones nobody wrote down, or the ones that were written down at the wrong size.

And red, amber and green do a lot of quiet work. A board that sees mostly amber tends to relax. Amber means a risk the organisation hasn't brought under control.

What a good risk conversation sounds like

The difference is easier to hear than to describe. A weak conversation goes something like this.

"Risk 7, agency staffing, remains at 16. Controls are in place and the action plan is on track. Any questions?"

"No, thank you. Next item."

A better one sounds more like this.

"Risk 7 has been at 16 for five quarters. What would have to happen for it to move, up or down?"

"Honestly, the score hasn't been reviewed properly since we set it."

"Then let's not rely on it. Which control would fail first if two senior nurses left in the same month? And how would we know before a patient did?"

The second conversation does three things the first doesn't. It treats the score as a claim to test, not a fact. It asks how controls fail, not whether they exist. And it brings the risk back to the people it would harm.

Good risk questions tend to share that shape. What's changed since we last looked? What are we assuming? What's the worst credible outcome, not the average one? What risk are we carrying that isn't on this list? And are we comfortable, as a board, with where this sits against our appetite?

What it looks like when it fails

Carillion collapsed into liquidation in January 2018. The joint report of the Work and Pensions and BEIS Committees opened with a blunt verdict: "Carillion's rise and spectacular fall was a story of recklessness, hubris and greed."

The committees were clear about the board's part in it. Non-executives, they wrote, "have a particularly vital role in challenging risk management and strategy and should act as a bulwark against reckless executives. Carillion's NEDs were, however, unable to provide any remotely convincing evidence of their effective impact." On the board's awareness of shareholder concerns about debt and the pension deficit, the report found that "the board minutes, however, show little sign of these positions being properly challenged".

When the senior independent director was asked whether the board should have been asking more probing questions, his answer, even with hindsight, was "perhaps". The papers existed. The risks were known. What was missing was the conversation.

Where to start

None of this means throwing the register away. It means using it to start the conversation, not to finish it.

Spend board time on a few risks, properly. Pick the three or four risks that would hurt most, and discuss them in depth each meeting. Let the committee work through the rest.

Ask what's changed. Any score that hasn't moved in a year should be challenged. Either the risk is stable and you can say why, or nobody's looking.

Test one control a quarter. Choose a control the register relies on and ask for evidence it works: an audit, a spot check, a walk-round. "Policy in place" isn't evidence.

Ask for the risk that isn't there. Once a year, ask executives and front-line leaders what keeps them awake that isn't on the register. Add what you hear.

Agree your appetite, then use it. A board that has said how much risk it will accept in safety, finance and reputation can judge each risk against that. Without it, every discussion starts from scratch.

Chapter 5: Information — What the Board Sees Shapes What the Board Does

What Good Looks Like — a board-level guide to governance done well

A board can only govern what it can see. Every judgement it makes about risk, quality or performance rests on the information put in front of it, and almost all of that information arrives through management. So the board pack isn't admin. It's the main way the board finds out what's actually going on.

Chapter 4 looked at the chair and CEO relationship, and the information route that runs between them. This chapter looks at what travels along that route, and how it changes on the way.

The pack that reassures

Most board packs aren't dishonest. They're written by busy people who want the board to feel the organisation is in good hands, and who know the board's time is short. So the pack gets longer, the language gets smoother, and the problems arrive with an action plan already attached.

The result is a familiar kind of document. Two hundred pages, a dashboard with almost everything green, and a covering report that says the amber items are "being actively managed". Directors read it, ask a few questions and move on. Everyone leaves feeling assured. Nobody has actually been told anything new.

How filtering happens

Management filtering is rarely a decision. It happens in small, reasonable steps. A ward manager summarises for the service lead. The service lead summarises for the director. The director summarises for the board. At each stage the detail that seems least important drops out, and the framing gets a little more confident. By the time a concern reaches the boardroom it has been averaged, contextualised and explained.

The usual signs are easy to spot once you look for them. Red ratings that turn amber without anything changing. Trend lines that start conveniently recently. Averages that hide the one service that's struggling. Incidents reported as numbers rather than as what happened to someone. A complaints summary with no complaints in it.

Informed or reassured?

This is the distinction that matters. Reassurance tells the board that things are fine. Information lets the board judge for itself whether things are fine.

A reassuring paper says "mandatory training compliance is 91%, above target". An informing paper says the same, then adds that the overnight team at one site is at 64%, and that's where two of this quarter's three medication incidents happened. The first lets the board relax. The second gives it something to decide.

Good boards learn to ask for the second kind, and to be suspicious of any pack that never makes them uncomfortable. If nothing in the papers has surprised the board for a year, the likeliest explanation isn't that nothing surprising has happened.

What it looks like when it fails

The public inquiry into Mid Staffordshire NHS Foundation Trust, published in February 2013, is still the clearest example in UK healthcare. In his letter to the Secretary of State, Robert Francis QC described "a serious failure on the part of a provider Trust Board. It did not listen sufficiently to its patients and staff or ensure the correction of deficiencies brought to the Trust's attention." He put that failure down in part to "allowing a focus on reaching national access targets, achieving financial balance and seeking foundation trust status to be at the cost of delivering acceptable standards of care."

The warning signs were there, in mortality figures, complaints and concerns raised by staff. The board saw finance and targets in detail and saw patient experience as reassurance. It governed the information it was given, and the information it was given wasn't the information it needed.

Where to start

None of this needs a new reporting system. It needs a board that decides what it wants to know, and a pack built to tell it.

Put a one-page front sheet on every paper. What is this, what does the board need to decide or know, and what's the honest assessment of the level of assurance? "Limited" is a perfectly good answer, and a far more useful one than silence.

Ask for the exceptions, not the averages. Organisation-wide figures are fine as context. The board also needs to see the outliers: the site, the team, the shift that's furthest from where it should be.

Hear from people, not just numbers. A patient story, a complaint read in full, a staff member's account of an incident. These are the things that filtering removes first, and the things that most often change a board's mind.

Go and look. Board visits to services, unannounced where possible, are how directors test whether the pack matches reality. If what you see doesn't match what you read, that tells you something important about the pack.

Once a year, ask what the board wasn't told. Look back at the year's incidents, complaints and inspection findings. How many did issues or problems did the board first hear about through its own papers, and how many from somewhere else?

The second number is the one to work on.

Chapter 4: The Chair–CEO Relationship — The Hinge Governance Swings On

What Good Looks Like — a board-level guide to governance done well

Every board has a hinge. It isn't in the terms of reference or the committee structure, and it rarely comes up in a board evaluation. It's the working relationship between the chair and the chief executive, and almost everything else a board does swings on it.

Chapter 2 drew the line between oversight and management. The Chair–CEO relationship is where that line gets held, or quietly given up, week in, week out. The chair leads the board. The CEO leads the organisation. When those two people work well together, a board functions: it hears bad news early, argues properly, and changes its mind when the evidence says so. When they don't, a board performs. It meets, minutes and approves, and has very little grip on what is actually happening.

Trust: the part nobody writes down

Good trust between a chair and a CEO has a simple test. Can the CEO ring the chair with a problem they haven't solved yet, and expect help rather than a black mark? Can the chair say "I'm not convinced" without the CEO hearing "I'm after your job"?

Where that trust is missing, the CEO starts managing the chair. Papers get polished until they reassure. Problems arrive solved or not at all. The chair senses it, starts going round the CEO to find out what's really happening, and the relationship gets worse from there.

Too much trust fails differently. The chair becomes the CEO's defender rather than the board's leader, and the two of them turn into a unit the rest of the board can't get past. Decisions get settled in the pre-meeting and ratified in the room.

Challenge: the chair's job is to make it normal

A chair doesn't need to challenge everything personally. The job is to make sure the board challenges well — specifically, proportionately, and at the decision rather than the person — and that the CEO experiences it as part of the role, not an attack.

When challenge is too weak, you get assurance by assertion. "The team are on it" becomes an acceptable answer to a serious question. When it tips into a running campaign against the CEO, executives stop bringing anything uncertain to the board, which is exactly what the board most needs to see.

Boundaries: where the lines sit

Most Chair–CEO breakdowns involve one of them drifting into the other's territory, usually with good intentions. A chair who is in the building three days a week, briefing managers directly, has become a shadow CEO. A CEO who decides what the board gets to see has taken over part of the chair's job.

The simplest protection is to write the split down. The UK Corporate Governance Code expects the responsibilities of the chair, chief executive, senior independent director, board and committees to be set out in writing and agreed by the board. It's also firm that the chair and chief executive roles shouldn't be held by the same person. Plenty of organisations aren't bound by the Code, but it's still the clearest benchmark around.

Wells Fargo is a well-documented case of what happens when all three give way at once. John Stumpf was both chairman and chief executive while the bank's retail sales practices scandal built up, with millions of accounts opened without customers' consent. The board's own independent investigation, published in April 2017, found sales practices weren't identified to the board as a noteworthy risk until 2014, and that management reports didn't accurately convey the scope of the problem. It concluded Stumpf was "too slow to investigate or critically challenge" what was going on. With one person leading both the board and the business, there was no separate chair whose job was to ask. After Stumpf stepped down in October 2016, the board split the two roles, appointed an independent chair, and changed its bylaws so the roles have to stay separate.

Where to start

None of this needs a restructure. It needs a few deliberate habits.

Write the split down, and look at it once a year. One page: what the chair leads, what the CEO leads, and what's shared. Agree it as a board, and revisit it whenever something big changes — a new CEO, new owners, a difficult inspection.

Agree what reaches the chair between meetings. A standing rule on which kinds of news go to the chair, and how quickly, stops the board hearing about a serious problem from someone other than the CEO.

Make sure there's a second route to the board. In a healthcare provider, that means the registered manager and the Freedom to Speak Up guardian can reach the chair without going only through the CEO. It isn't a vote of no confidence. It's how a board knows its main information line is working.

If the roles are combined, say how you compensate. An independent non-executive with a lead role, meetings of the non-executives without the executive present, and a plan for when the roles will split.

Once a year, talk about the relationship itself. Chair and CEO each answer the same questions separately. When did the CEO last bring an unsolved problem to the chair? When did the board last send something back? When was the CEO last properly appraised? Then compare. The gaps between the two sets of answers show you where the hinge is sticking.

Chapter 3: Composition — Building a Board That Thinks, Not Just Attends

What Good Looks Like — a board-level guide to governance done well

Most boards are built the way a dinner party gets built: someone thinks of people they respect, people they trust, people who'd be a pleasure to sit across the table from for three hours a quarter. It produces a good dinner party. It doesn't reliably produce a board that will catch the thing that's about to go wrong.

What a comfortable board looks like

A comfortable board is easy to recognise once you know to look for it. The directors have impressive CVs, often from overlapping worlds — the same industry, the same handful of firms, the same professional networks as the chair or CEO. Meetings run smoothly, because everyone broadly agrees on how things should be done before they've even discussed it. Tenure is long. New appointments tend to come through someone's existing contacts rather than a defined search against what the board is actually missing.

None of this shows up as a problem, because comfort doesn't announce itself as a weakness. It looks like a strong, aligned, high-calibre board. What it usually isn't is a board that will notice a risk nobody in the room has direct experience of, or say the unwelcome thing to a chair or CEO they've known for fifteen years.

What a well-composed board looks like

A well-composed board starts from a different question: not "who do we admire," but "what does this organisation actually need to be watched for, and who around this table can watch for it." That means a skills matrix built against the organisation's real and emerging risks — cyber exposure, treasury and liquidity, clinical or product safety, regulatory change — rather than a generic template of "finance, legal, HR, marketing" ticked off regardless of what the business actually does.

It also means diversity of thought, which is a different thing from diversity of category. A board can be diverse by every demographic measure and still be composed entirely of people who reason the same way, went to the same three business schools, and built careers in the same three sectors. Diversity of thought means someone in the room who's run a very different kind of organisation, who's seen a very different kind of failure, who asks a question nobody else in the room would have thought to ask — not because they're contrarian, but because their reference points are different.

The clearest tell for a well-composed board is whether it contains at least one person who is a little uncomfortable to have there: someone whose expertise means they're going to ask the question everyone else finds it easier not to ask.

Where pedigree without fit leads

Lehman Brothers' board going into 2008 was not short on credentials. It included a Broadway theatre producer, a retired U.S. Navy rear admiral, and directors with long and genuinely distinguished careers in industry and public service. The Corporate Library, an independent board-research firm, had rated Lehman's board poorly before the collapse, flagging that few of the outside directors had current experience in banking, capital markets, or the kind of balance-sheet risk that was about to bring the firm down — at the exact moment that risk had become the only question that mattered. The board wasn't unintelligent or unengaged. It was composed for prestige and comfort, not for the specific thing it needed to be watching.

That's the pattern worth taking from it: an impressive board and a well-composed board are not the same board, and the gap between them only becomes visible once the thing nobody was positioned to catch actually happens.

Where to start

Build a skills matrix against your actual risks, not a generic template. List the five things most likely to seriously damage this specific organisation, then check whether the board has real, current expertise against each one — not adjacent experience from a decade ago.

Score the gaps honestly, in writing. Most boards can describe what their directors bring. Fewer can name, precisely, what's missing. Put the gap on paper before the next appointment is made.

Set a tenure and refreshment discipline, and hold to it. Long-serving directors bring institutional memory, and they also bring the comfort that dulls challenge. A defined term limit, applied without exception, keeps the board from quietly calcifying around one chair's or CEO's comfort.

Recruit for people who'll ask different questions, not just different-looking people. Diversity of category matters and is worth pursuing in its own right — but it isn't a substitute for diversity of thought. Ask what kind of failure a candidate has seen that nobody currently on the board has seen.

Chapter 2: The Board's One Job — Oversight, Not Management

What Good Looks Like — a board-level guide to governance done well

A board has exactly one job. Make sure the company is being run well, and step in if it isn't. That's it. Strategy input, risk oversight, succession, culture — all of it is that one job, applied to a different part of the business.

Most boards don't fail because they misunderstand this. They fail because they drift off it, in one of two directions, usually without noticing.

Drifting into management's lane

The first drift shows up dressed as diligence. A board starts weighing in on which candidate to hire for a role two levels below the executive team. It re-litigates a marketing campaign in the boardroom. It asks for the detail behind a supplier contract that carries no material risk, just because a director finds it interesting.

None of this looks wrong from inside the room. It looks thorough. But a board doing the executive team's job isn't adding oversight — it's substituting its own judgement for the judgement of people who were hired, and are paid, to have better judgement on exactly that question. It also usually means something has already gone wrong upstream: either the board doesn't trust the CEO enough to have appointed them, or nobody has done the work of building that trust properly.

Abdicating oversight entirely

The second drift is quieter, and more common. A board defers. It takes management's account of a situation as the account of the situation, asks a handful of process questions, and moves on. Chapter 1 described a service that kept failing its "well-led" inspection while board meetings and paperwork carried on as normal — a board that had abdicated oversight so completely it no longer registered the gap between what it was being told and what was actually happening.

Both failures look identical from the compliance side. Attendance is fine, minutes are filed, the code is met. Only one version of that board is actually doing the job.

Where the line sits

The distinction is simpler than it feels in the room. Oversight asks whether something should be happening, and whether it's being managed properly. Management decides how it gets done.

"Should we be comfortable with this level of customer concentration risk" is oversight. "Which account manager handles the renewal call" is management. "Is our safety case for this product sound, and who signed it off" is oversight. "What the engineering team's sprint plan looks like this month" is management. The test isn't how technical or important a question sounds — plenty of oversight questions are simple, and plenty of management decisions are hard. The test is whether the board is asking "is this being handled properly," or reaching in to handle it.

Boeing is a well-documented case of what happens when that line gets missed on the abdication side. Before the two 737 MAX crashes, in 2018 and 2019, Boeing's board had no standing committee dedicated to engineering or product safety; safety-related risk moved through the same channels as everything else, filtered by the same executive team whose judgement it was meant to check. The House Transportation and Infrastructure Committee's investigation that followed found the board had not been shown the internal safety analysis for the flight-control system later linked to both crashes. Boeing's response, that same year, was to create a permanent board-level Aerospace Safety Committee with its own direct reporting line. That's what "where the line sits" looks like once a board decides it needs to see the evidence, not just hear the summary.

Where to start

None of this requires reorganising the board. It requires the habit of checking, deliberately, which side of the line a given discussion is actually on.

Before a topic gets boardroom time, ask "whether" or "how." If the real question is how something gets executed, it belongs with management, however tempting it is to weigh in. If it's whether something should be happening at all, or whether it's being managed properly, it belongs with the board.

Give your highest-risk oversight area a standing committee, not an agenda slot. Whatever would hurt the organisation most if it went wrong quietly — safety, clinical or service quality, financial controls — deserves a committee with its own charter and a direct line to the full board, not fifteen minutes inside a general update.

Set an explicit rule about who talks to whom. Directors shouldn't be directing operational staff below the executive team without going through the CEO first. It's a simple guardrail against the management-drift side.

Build in a standing question for the abdication side. Not "what does management's summary say," but "what would we need to see to know this is actually going well, and are we seeing it?"

Once a year, review which side the board actually spent its time on. If most of the year went on execution detail, that's drift into management. If most of it went on nodding through management's account of things, that's abdication. Either finding is worth acting on.

Governance Is Not Compliance: Why the Difference Matters More Than Your Policy Folder Suggests

Ask most independent providers what "good governance" looks like and you'll get a description of good compliance instead: policies up to date, DSPT submitted, statutory notifications sent on time, CQC evidence portfolio populated. All of that matters. None of it is governance.

Compliance answers one question: are we meeting the minimum standard set by someone outside the organisation? Governance answers a different one: are we making good decisions, for the right reasons, in a way we could defend to a regulator, a coroner, or a patient's family if we had to? A service can be fully compliant and still be badly governed. It's a more common combination than most boards would like to admit.

What compliance actually covers

Compliance is the floor. It's the set of external requirements — CQC fundamental standards, DSPT, statutory notifications, mandatory training completion rates — that exist whether or not your organisation has thought about them at all. You can outsource most of compliance. You can automate parts of it. A well-run compliance function tells you where you stand against a fixed external checklist, and that's genuinely valuable: it catches the gaps that would otherwise surface during an inspection instead of before one.

But compliance, by design, doesn't ask whether the checklist is the right one for your organisation's actual risks. It doesn't ask why an incident happened, only whether it was reported within the required timeframe. It doesn't ask whether your board understood the decision it signed off, only whether the sign-off exists on file.

What governance adds

Governance is the judgment layer sitting above compliance. It's the structure through which decisions get made, tested, and owned — who decided, on what evidence, weighed against what risk, with what oversight afterward. A governance framework asks compliance's questions and then a harder set on top: did we understand what we were agreeing to, did the right people have visibility before the decision was made rather than after, and can we show our reasoning, not just our paperwork, if we're asked to account for it later.

This is the distinction that shows up hardest in an incident. A provider with strong compliance and weak governance will have the notification on file, the policy referenced, the training record complete — and still struggle to explain why the decision that led to the incident was made, because no one owned it as a decision at the time. It just happened, inside a compliant system, without anyone particularly deciding it should.

Where this shows up in practice

Three places we see the gap most often with providers:

Risk registers that log risks without anyone owning the decision about what to do with them. A risk sitting at "amber" for eighteen months with no board discussion isn't a governance failure of documentation — the documentation is fine. It's a failure of someone actually deciding what amber means and what happens next.

Board minutes that record attendance and agenda items but not reasoning. If a board approved a change in staffing ratios, the minute that matters isn't "the board approved the proposal." It's what evidence was weighed, what alternative was considered and rejected, and why. That's the record that protects the organisation later — and it's the record most boards don't actually keep, because it takes longer to write and nobody's checklist requires it.

Assurance that flows one way. Compliance tells the board what's been done. Governance requires the board to test it — to ask the operational team a question they weren't expecting, rather than accepting the report as read. A board that only ever receives assurance, and never probes it, isn't governing. It's rubber-stamping with good intentions.

The practical fix

You don't fix this by adding more policies — that's compliance thinking applied to a governance problem, and it tends to make the folder thicker without making the decisions better. The fix is structural:

Separate the reporting question from the decision question on your board agenda. "Here's our compliance status" and "here's a decision we need to make, here's the evidence, here's what we're weighing" should be different agenda items with different expectations of the room.

Require reasoning in the minute, not just the outcome. One sentence on what was considered and why is usually enough. It's the habit that matters, not the length.

Build in genuine challenge. If every paper that reaches the board gets approved without a substantive question, that's worth noticing in itself — not because approval is wrong, but because it suggests the board isn't yet doing the second half of its job.

Compliance keeps you registered. Governance is what you'd actually want standing behind you if something went wrong and someone asked why the decision was made the way it was.

August regulatory round-up

A short one this month, but two dates worth having on your radar:

DSPT transition deadline — 14 August 2026. The Health Research Authority has confirmed that 2024/25 Data Security and Protection Toolkit assurances will only be accepted for CAG applications, amendments or annual reviews submitted before 14 August. After that date, only 2025/26 submissions will be accepted. If your DSPT renewal has slipped, this is the practical deadline that bites — not the toolkit's own nominal submission date.

CQC's sector-specific assessment framework — expected this summer. CQC has confirmed it's on track to publish the replacement for the single assessment framework this summer, with separate frameworks for adult social care, hospitals, primary care and mental health, ahead of implementation planned for the end of 2026. The single assessment framework remains in force for inspections in the meantime, so nothing changes operationally yet — but providers should expect the published framework text to set the shape of what changes later this year, and it's worth reading closely as soon as it lands rather than waiting for guidance to catch up.

We're tracking both, along with the Health Bill's progress through report stage, in this month's full regulatory briefing for Harbour and Deep Water subscribers.

Chapter 1: Why "Good" Is Harder Than "Compliant"

What Good Looks Like — a board-level guide to governance done well

Every board can point to its compliance record. Codes followed, papers filed, committees constituted, the annual report ticking every disclosure box a regulator or shareholder might ask for. None of that tells you whether the board is any good.

That's the uncomfortable starting point for this series. Compliance is achievable by any board willing to follow a checklist and hire people who know how to fill one in. Good governance is not. It requires judgment, several people willing to use it out loud, and a chair prepared to let them.

Two boards, same paperwork

Picture two boards with identical compliance records. Full attendance at every meeting. All committees quorate. Every disclosure filed on time, every code provision either met or properly explained. On paper, indistinguishable.

On one of these boards, a non-executive director reads the CEO's growth plan in March and asks a plain question: what happens to service quality if headcount doubles in nine months and the training pipeline doesn't change? The question gets minuted, the plan gets adjusted, and the year goes fine.

On the other board, nobody asks. Same plan, same numbers, same nine months. By October the business is short-staffed, quality has slipped, and the board is now managing a crisis instead of a growth plan. Both boards were compliant the whole way through. Only one of them was governing.

Why compliance became the ceiling

Most governance codes exist because something went badly wrong first. Enron collapsed in 2001 with a board that had approved the conflicts of interest behind its off-balance-sheet partnerships — waivers later scrutinised in detail by the US Senate investigation and the Powers Report. That's how most governance rules get written: a specific failure, then a fix for that specific failure, after the fact.

Carillion is a closer-to-home example of what that ceiling looks like from the inside. One of our team spent a year working for a Carillion-run service before resigning, once it became clear that governance there meant compliance and nothing more. The service kept failing its CQC inspections on "well-led" — the domain that asks, in effect, whether the people running the organisation actually understand and act on what's happening inside it — and the board never seemed to register that its own narrow view of the business was the reason why. Meetings happened. Papers were filed. Nobody in the room was asking the question "well-led" is actually testing for.

That's a sound way to build a floor. It's a poor way to build a standard. A code can tell a board what to have on file. It can't make anyone in the room actually think, and it can't manufacture the willingness to say something unwelcome to a confident CEO. Boards that treat the code as the job description will always be compliant and sometimes still fail badly, because the code was never designed to catch what killed those two companies: a room full of qualified people who didn't push.

What "good" actually adds

Good governance sits on top of compliance, not instead of it. It's the judgment to know which item on a packed agenda deserves forty minutes instead of four. It's a chair who notices the room agreeing too quickly and asks the question that breaks the consensus open. It's a director willing to be the one voice that slows things down, and a board culture where doing that doesn't cost you your seat at the table.

None of that shows up in a compliance audit. All of it shows up in the outcome.

Where to start

None of this requires a new committee or a thicker policy. It's a handful of specific, testable habits, and a board can start on any of them next quarter.

Audit your last four board packs for narrative versus status. How much is genuine analysis, and how much is a RAG-rated table someone updates before the meeting? A pack where everything reads green isn't reassurance — it's a sign nobody is being asked to explain why.

Count the challenge in your minutes, not just the attendance. Go back over the last twelve months and check how many recommendations went through unamended and unquestioned. If it's nearly all of them, the board is confirming decisions, not testing them.

Get information the executive team hasn't filtered first. Meet frontline staff or middle managers without the executive in the room, even once or twice a year. It's the only way to test whether what reaches the board matches what's actually happening on the ground — the gap our own team watched widen at Carillion, inspection after inspection.

Give someone in the room the explicit job of disagreeing. Before a significant decision, the chair asks whoever's spoken least what they think, or names someone to make the case against. It feels artificial the first few times. Then it's just how the board thinks.

Test for judgment at induction and evaluation, not just process. Tell new directors plainly that challenge is the job, not a bonus feature. And have the annual board evaluation ask for evidence of real disagreement and what came of it, not just confirmation that the committees met.

What this series is

Over the coming weeks, this series works through what "good" actually looks like at board level, one part at a time: how a board should be composed, what the chair and CEO owe each other, what a board should actually see and ask for, how risk oversight differs from a risk register, how a board adds value to strategy without doing management's job, and more. Each piece stands alone, but together they build into a working picture of a board that governs rather than one that merely complies.

The first question worth asking of any board, including your own, isn't "are we compliant." It's "if something in this business went wrong quietly, over months, would anyone in this room notice before it became a crisis."

That's the difference this series is about.

CQC's Rebuild: Where It Actually Stands, and What It Means for You

CQC has spent the best part of two years publicly acknowledging what providers already knew‚ that its own systems were failing under the weight of backlogs, delayed reports, and inconsistent assessments. What's less widely understood is how much progress has actually been made, and where the gaps still sit. Worth knowing, because the pace of that rebuild directly shapes how often you're likely to be inspected, and what CQC will be looking for when you are.

How bad it got…

The rebuild followed two external reviews‚ by Dr Penny Dash and Professor Sir Mike Richards‚ that were unflinching about CQC's operational state. At the start of 2025, roughly 500 assessment reports were sitting in a backlog, unpublished. Providers were operating for months, sometimes longer, without knowing where they stood.

What's actually changed

The numbers are genuinely better. That backlog of around 500 reports has been reduced to just four. CQC set a target in April 2025 to publish 9,000 assessments by September 2026, and as of January 2026 it was ahead of that schedule, having completed over 5,000 since the previous April‚ including 50% more inspections in November 2025 than the same month a year earlier.

Structurally, CQC has appointed four permanent Chief Inspectors, each leading assessment teams organised around specific sector expertise rather than generic inspection capacity. That's a meaningful shift if you've previously felt inspected by someone without a clear grasp of how an independent provider actually operates. Registration has also had attention‚ a pilot to simplify and speed up home care registrations, a simpler registration form being tested, with plans to extend both across other sectors.

On the framework itself, CQC ran a consultation‚ Better Regulation, Better Care‚ which drew more than 1,600 responses, feeding into ongoing refinements of the assessment approach and how ratings get applied. That work is still live rather than finished.

What's still unresolved

Two things are worth watching rather than assuming are settled. First, the final shape of the revised assessment framework hasn't landed yet‚ the consultation feedback is still being worked through, so exactly how assessments and ratings will operate once the changes are finalised isn't yet locked in. Second, the digital and case management systems underpinning all of this are being rebuilt gradually, with full functionality not expected until later in the programme. Progress on process doesn't necessarily mean progress on the tools providers actually interact with day to day.

What this means for you

The practical read for independent providers is straightforward: inspection activity is increasing, not easing off, and it's increasing with more sector-specific expertise behind it. If you've been operating on the assumption that CQC's own struggles bought you time, that assumption is getting less safe by the month.

Recent enforcement action against an independent provider‚ UCS Medical, an ambulance service rated inadequate in early August with three warning notices issued‚ is a reminder that increased inspection volume is translating into real outcomes, not just more paperwork.

There's also a timing point worth flagging alongside our recent piece on HSSIB. CQC is absorbing new investigative responsibilities from HSSIB at the same time it's still mid-rebuild on its core inspection function. Whether that expansion sits comfortably alongside a regulator that's still catching up on its existing workload is a fair question, and one worth watching rather than assuming will resolve itself smoothly.

None of this changes the fundamentals of good governance‚ but it does raise the stakes on having your evidence genuinely current rather than assembled hastily before a visit. A regulator moving faster, with sharper sector expertise, is less likely to be satisfied by a policy that technically exists but hasn't been reviewed in eighteen months.

The bottom line

CQC's rebuild is real, not just presentational‚ the backlog numbers back that up. But "improving" and "settled" aren't the same thing, and the framework you'll eventually be assessed against is still being finalised.

The safest position is the one that doesn't depend on knowing exactly when CQC's changes land: governance and evidence that would hold up under scrutiny whenever the visit comes.

HSSIB's Abolition: What It Actually Means for Independent Providers

Most sector commentary on the Health Bill has focused on the big, headline structural changes‚ NHS England disappearing, the Secretary of State's powers expanding, ICBs being reshaped.

One change getting less attention deserves more, particularly if you're an independent provider: the Health Services Safety Investigations Body is being abolished, and its functions are moving into the Care Quality Commission.

That's not a footnote. It changes who investigates patient safety incidents, on what terms, and‚ for independent providers specifically‚ with what relationship to the body that also inspects and rates you.

What HSSIB actually does today

HSSIB was set up as a fully independent, arm's-length body carrying out no-blame patient safety investigations. Its remit already extends beyond the NHS: it investigates concerns across the NHS and in independent healthcare settings where the safety learning could also help improve NHS care.

The mechanism that makes this work is "safe space"‚ legal privilege over investigation evidence, meaning what staff tell HSSIB investigators can't be disclosed without the chief investigator's consent or a High Court order. The entire premise is that people speak more honestly when they know their words won't be used against them in a disciplinary or regulatory process. It's the same principle that underpins investigation branches in aviation and rail.

The critical structural feature, for our purposes, is separation. HSSIB investigates. CQC regulates. Different organisations, different purposes, and a firewall between the two.

What changes under the Bill?

The Health Bill folds HSSIB's investigative functions directly into CQC. This implements a recommendation from Dr Penny Dash's review of the patient safety landscape, which argued the current system is fragmented and needs consolidating. Report Stage and Third Reading in the Commons are scheduled for 7 September 2026, so this is close to settled rather than a distant possibility.

The concern being raised in Parliament isn't abstract. Once the organisation running "safe space" investigations is the same organisation that inspects your service, rates it, and can issue warning notices or move toward prosecution, the separation that made safe space credible starts to look harder to maintain in practice‚ even with internal protocols and process barriers in place. Recent parliamentary scrutiny has centred on exactly this: whether HSSIB's independence, and by extension the confidence staff have to speak openly, can survive being absorbed into a regulator with enforcement powers.

This isn't a theoretical worry from outside government either. CQC's own evidence to the committee scrutinising the Bill acknowledges it needs "maximum clarity" on how the safe space provisions will operate within CQC, and flags that the existing approval mechanism‚ Secretary of State sign-off before certain thematic reviews‚ needs to continue functioning without creating a regulatory gap. In other words, even CQC is asking for clearer rules on how it's meant to run something that was designed, from the outset, to be independent of it.

Why this matters specifically for independent providers

Two things are true at once. HSSIB already investigates in independent settings where the learning has wider relevance, so this isn't a new relationship being created from scratch. But independent providers arguably have more at stake in the safe space firewall holding, not less‚ you're already navigating a regulator that inspects you commercially as well as clinically, and staff confidence to disclose openly during an investigation matters just as much in a private setting as an NHS one, arguably more given smaller teams and less institutional distance between staff and leadership.

If safe space becomes something CQC administers rather than something a genuinely separate body guarantees, the practical question for your organisation becomes: how do you reassure your own staff that speaking to an investigation isn't functionally the same as speaking to your regulator? That's a governance and culture question your organisation will need to answer locally, regardless of how Parliament resolves the structural one.

What to do now

Nothing changes today‚ the Bill hasn't passed, and even after Royal Assent, the detail of how CQC operationalises this will come through secondary legislation and statutory guidance rather than the Act itself. But there's value in getting ahead of it:

• Watch for CQC's protocols, not just the Bill's passage. The operational detail, how CQC ring-fences investigation evidence internally, what staff training changes, what governance sits between the investigatory and regulatory arms‚ is where this will actually be decided.

• Revisit how your incident policies reference HSSIB. Any internal document, induction material, or duty of candour guidance that names HSSIB specifically will need updating once the transfer takes effect, and it's worth flagging now rather than scrambling later.

• Think about staff confidence, not just process. If your team already has reservations about raising concerns, a structural change to the body meant to protect their disclosures is exactly the moment those reservations either get addressed or get worse. A conversation now, framed honestly, costs little and buys goodwill.

We'll track this through Report Stage and flag what changes once the detail lands‚ this is very much a "watch this space" rather than a "here's what you must do" moment, but it's the kind of change that rewards early attention rather than a scramble after Royal Assent.

Employing Third-Party Software: What Independent Providers Actually Need to Check

A vendor demo can make almost any system look ready. Slick dashboards, a confident sales lead, a case study from a trust three counties over. None of it tells you whether the product is safe to put in front of your clinicians and your patients.

That's what due diligence is for.

Below is the checklist we use with independent providers before any new clinical or care-related software goes near a live environment, what to ask for, who needs to sign it off, and the three red flags that should stop a procurement in its tracks.

The Due Diligence Checklist

1. Mandate Digital Technology Assessment Criteria (DTAC).

DTAC is the baseline for procurement, and it's just been refreshed. NHS England introduced an updated form in February 2026, with a hard cutoff on 6 April 2026, the previous version should no longer be in circulation. Independent providers delivering NHS care should insist on the standard NHS England DTAC form rather than accepting a vendor's own version of it. Providers delivering arms-length care should do likewise.

2. Demand the Clinical Safety Case.

Ask for the vendor's DCB0129 Clinical Safety Case and Hazard Log. This is the evidence that clinical risk was managed properly during development, and it's a statutory obligation for manufacturers of health IT systems under the Health and Social Care Act 2012. As the deploying organisation, you'll need it as the starting point for your own risk assessment, you can't complete DCB0160 without it. During checking, make sure that the hazards were investigated using standard methods.

3. Appoint your own Clinical Safety Officer (CSO).

You need a CSO to review the vendor's documentation and assess risk in the context of your own deployment‚ that's your DCB0160 obligation, and it sits with you, not the vendor. The CSO should be a registered senior clinician (GMC, NMC, GPhC, or HCPC). One detail worth knowing: the requirement for a specific NHS-mandated training course has recently been dropped from the DTAC framework, so don't let a vendor use its absence as a reason to wave through a weaker appointment‚ competence and registration still matter, the formal course just isn't the only route there anymore. If you don't have someone internally, this role can be outsourced to a consultant.

4. Check the Data Security and Protection Toolkit (DSPT).

Your organisation needs a current DSPT self-assessment. If you're a Category 2 supplier‚ with 50 or more staff, or turnover above £10 million‚ that now requires independent audit rather than self-declaration. "Standards Met" status is written into NHS Standard Contract Clause 21.2, so falling short isn't a paperwork gap, it's a contractual breach.

5. Verify Cyber Essentials Plus.

Cyber Essentials Plus has become the de facto requirement for NHS suppliers handling patient data or providing IT and digital services, driven by Procurement Policy Note 014. Strictly, the policy itself allows Cyber Essentials, Cyber Essentials Plus, or demonstrably equivalent controls‚ but NHS Supply Chain's own implementation pushes suppliers firmly toward Cyber Essentials Plus specifically, with a fallback security questionnaire for those who don't hold it. In practice, for an independent provider evaluating a vendor, Cyber Essentials Plus is the standard to ask for. Don't let ISO 27001 be offered as a straightforward substitute‚ it covers different ground.

6. Test with your own clinicians.

Insist on a pilot with your own clinical staff, using dummy or test data in a sandbox rather than live patient records. This is where you actually learn whether the system fits your workflow‚ particularly if you're running a private/NHS hybrid setting, which often behaves differently to a pure NHS deployment. This pilot is also where DCB0160 gets applied in practice: clinical risk management isn't a document you file once, it's something you test.

7. Confirm NHS interoperability.

Ask directly about integration with the NHS Spine and whether the vendor builds to Fast Healthcare Interoperability Resources (FHIR) standards. Independent providers are increasingly expected to integrate with NHS systems rather than sit apart from them, and the NHS Business Partners programme that used to help with this has been retired. That support gap means the burden of asking the right integration questions now sits with you.

8. Embed exit and performance clauses.

Get your legal team to build in explicit exit clauses, data extraction rights, and performance benchmarks tied to clinical outcomes‚ not just uptime. The Data (Use and Access) Act 2025 gives regulators direct enforcement powers over IT suppliers for the first time, which strengthens your hand at the contract stage. Make sure your contract is drafted to take advantage of that.

Three Red Flags

Missing or outdated DTAC form. Anything submitted on the pre-April 2026 version is a sign the vendor isn't keeping pace with its own compliance obligations.
No DCB0129 documentation. If a vendor can't produce a Safety Case and Hazard Log, that's not a gap to work around, it's a statutory obligation they haven't met, and a reason to walk away.
No independent DSPT audit, where one's required. If you're a Category 2 organisation and the vendor's DSPT submission hasn't been independently audited, they're non-compliant, and by extension so is your supply chain.

Your Governance Pathway

For an independent provider, sign-off on a new system should move through a clear sequence rather than sitting with one person's judgement:

1. Commercial/Procurement runs the RFP and negotiates the contract.
2. Your Clinical Safety Officer reviews DCB0129 and completes the DCB0160 risk assessment for your specific deployment.
3. Your Data Protection Officer signs off the DPIA and the DSPT submission.
4. Your Cyber Security Lead verifies Cyber Essentials Plus and the underlying technical security.
5. End-user clinicians test usability and workflow fit in your actual setting, not a generic demo environment.
6. Your Governance Committee reviews the evidence from each stage and gives formal approval.

Bottom Line

Due diligence isn't about ticking a form‚ it's about demanding the right documentation and getting the right people, particularly your CSO and DPO, to put their name to a formal sign-off. DTAC, DCB0129, DSPT, and Cyber Essentials Plus are the four pillars that should be non-negotiable. If a vendor can't produce all four without a fight, that tells you something worth knowing before you sign, not after.

Governance Bingo: The Words You'll Hear in Every MDT Meeting

You know the meeting. Ten minutes in, someone says "going forward" and you feel it — the low hum of a hundred meetings just like this one, stretching back through your entire career.

We thought it was time someone wrote the bingo card.

The card

Print it, screenshot it, tape it under the boardroom table. Five across, five down, one free square in the middle for whoever brought biscuits.

Commonly Used Words in Governance Meetings.

Full house gets you nothing except the quiet satisfaction of having survived the meeting with your sense of humour intact.

Why we all talk like this

Here's the less funny bit, and it's worth two minutes of your day.

Jargon in governance meetings isn't just habit. It does actual work — some of it useful, most of it not.

The useful part: shorthand saves time between people who already share the same reference points. "Triangulate the data" means something specific to a room full of quality leads who've done it a hundred times. Said to a new starter, or worse, to a patient or family member, it means nothing at all.

The less useful part is what "robust" is really doing in most sentences. It's rarely describing anything. It's filling the space where a specific claim should be — the actual staffing ratio, the actual audit frequency, the actual number of incidents reviewed last quarter. "We have a robust incident reporting process" tells an inspector nothing. "We reviewed 94% of incidents within five working days last quarter, against a target of 90%" tells them everything.

That's the real cost. Not that jargon is annoying — though it is — but that vague language lets vague thinking hide in plain sight. A policy document full of "comprehensive frameworks" and "ongoing assurance" can sail through several review cycles without anyone checking whether it actually says anything. Precise language forces precise thinking, because you can't write a specific number or a specific date without first knowing it.

CQC inspectors have heard "we take a holistic approach" more times than any of us have. What lands, every time, is the plain sentence: what happened, what you did about it, what changed as a result.

A small challenge for your next document

Before you next write "robust," stop and ask what number, date, or named person would actually prove the point. Nine times out of ten, that's the sentence you meant to write.

Full marks if you get through the next MDT without needing your bingo card at all.

We'll believe it when we see it.

The Big Picture and Patient Safety: The Health Bill 2026 and What It Means for Your Governance and Assurance Model

The Health Bill 2026–27 — badged by government as the NHS Modernisation Bill — is currently working its way through Parliament. It had its second reading on 1 June 2026, the Public Bill Committee finished its line-by-line scrutiny in mid-July, and the bill now moves toward report stage. 

For independent and private providers, this is the point to stop treating it as a Westminster story and start treating it as a governance planning problem.

The headline purpose is to abolish NHS England and reassign its functions between Integrated Care Boards and the Secretary of State for Health and Social Care. But three changes inside the bill matter more directly to how independent providers are regulated, investigated and held to account: the folding of the Health Services Safety Investigations Body into the CQC, the abolition of Healthwatch England and local Healthwatch, and a significant transfer of discretionary power to the Secretary of State. Read together, they reshape the patient safety landscape your organisation currently operates inside.

Power moving to the centre

NHS England currently holds a wide range of statutory functions and regulatory powers as an arm's-length body, at one remove from ministers. The bill would strip that layer out. Some functions go to Integrated Care Boards; others transfer directly to the Secretary of State, including new powers to make regulations governing ICB conduct on waiting times, patient choice, and appeals over commissioned services — with the Secretary of State able to investigate and enforce where an ICB falls short.

Supporters, including the Nuffield Trust and the King's Fund, argue this removes a layer of duplication and gives the system a single clearer line of accountability. The concern raised repeatedly during committee scrutiny is the opposite side of that coin: decisions that used to sit with an operationally independent body move into direct ministerial hands, and the Commons Health and Social Care Committee has specifically questioned whether the Department has the operational capability to absorb NHS England's functions at the pace the bill assumes.

For providers, the practical read is this: your regulator relationship doesn't just involve the CQC and your ICB anymore. It runs, more directly than before, back to the Department. Contract terms, commissioning decisions and enforcement priorities are more likely to shift with political priorities than they have been under the current arm's-length arrangement.

HSSIB into the CQC: one door, two functions behind it

The bill would abolish the Health Services Safety Investigations Body and move its investigatory functions into the CQC, along with HSSIB's powers of entry and its ability to demand documentary and other evidence.

The tension here isn't hypothetical — the CQC named it directly in its own written evidence to the Health and Social Care Committee, warning of a conflict between its role as regulator and enforcer and the "safe space" HSSIB investigations were built to protect, and asking for legal certainty in the bill's drafting so the change doesn't leave it exposed. MPs raised the same point in the Commons: an investigation function is only useful to providers if the people involved can speak freely, without what they say being used against them in an enforcement decision made by the same organisation. Put the investigator and the enforcer under one roof and that separation gets harder to guarantee, whatever the operational firewalls say on paper.

There's a second change bundled into the same clauses that providers should register separately: the government is extending the limitation period for CQC criminal enforcement action from three years to five. That's a longer window in which a historic incident can result in prosecution — worth flagging to your legal team regardless of where you land on the wider HSSIB question.

Healthwatch abolished, functions redistributed

The bill would abolish Healthwatch England and local Healthwatch organisations, transferring their functions to ICBs and local authorities. The government's stated aim is simplification. The Health Foundation's second reading briefing put the risk more starkly: Healthwatch has had a mixed record, hampered by underfunding and a structural power imbalance with the NHS — but bringing its functions in-house means patients lose an institutionally independent voice, at a point where past patient safety inquiries have repeatedly shown the system doesn't listen well on its own. Local Healthwatch organisations have since formed a joint working group to submit evidence to Parliament making the same case.

The Public Bill Committee considered amendments to strike the Healthwatch clauses out. They didn't succeed — the committee agreed the clauses should proceed to the next stage, so as things stand the abolition is still in the bill heading into report stage. Worth watching, but not worth planning around a reversal.

What's gained and what's lost

Government's case for all three changes is the same: fewer bodies, fewer duplicated functions, one clearer set of lines back to ministers. That's a real gain if it happens as described — provider-facing simplicity is not nothing, and a single patient safety route through the CQC is, on paper, easier to navigate than three separate bodies with three separate remits.

What's lost is structural, not cosmetic. HSSIB's value wasn't just that it investigated — it was that it investigated at arm's length from the regulator with enforcement power. Healthwatch's value wasn't just that it collected patient views — it was that it did so as a body with no stake in the system's own performance. Streamlining removes the duplication, but duplication was doing a job: it was the separation itself that gave each function its independence. Folding both into a single, larger CQC doesn't just tidy the org chart. It removes the structural feature that made each function trustworthy on its own terms.

The reputational and legal exposure sitting inside CQC's expanded role

For providers, an enlarged CQC with investigatory powers, a longer limitation period, and a still-developing single assessment framework is a materially different regulator to plan governance around than the CQC you've been dealing with to date.

Three practical exposures worth taking to your board or governance committee now:

The evidentiary trail from an HSSIB-style investigation could, depending on how the transfer is drafted, end up informing an enforcement decision made by the same body. Providers should assume less separation between "tell us what happened so we can learn" and "tell us what happened so we can prosecute" than existed before, and brief staff and legal teams accordingly ahead of any incident, not after one.

A five-year rather than three-year limitation period means historic governance gaps carry legal exposure for longer. If your risk register or complaints log has entries sitting untouched from three or four years ago, this is the moment to check they've been properly closed out and documented, not just filed.

A regulator absorbing new functions, new powers and a still-developing assessment framework at the same time is a regulator more likely to produce inconsistent early decisions. That's a reputational risk as much as a legal one — an inspection outcome that looks harsh or inconsistent with peers is harder to challenge cleanly while the framework itself is in flux.

The Healthwatch gap, and what fills it

If Healthwatch functions move to ICBs and local authorities, the independent channel through which patient experience data reached providers and regulators changes shape. ICBs and local authorities have their own priorities and their own relationship with the providers they commission — not the same position of independence Healthwatch held.

The mitigation isn't complicated, but it does need to be deliberate rather than assumed. Providers who have historically treated patient experience data as something Healthwatch or the CQC gathered on their behalf now need their own structured route for capturing it directly — complaints data triangulated against a genuine patient feedback mechanism, not just satisfaction surveys, reviewed at board level on a fixed cycle rather than only when something goes wrong. Where a local Healthwatch function does continue in some diminished form through your local authority, keep that relationship active rather than letting it lapse quietly along with the rest of the national infrastructure. The organisations most exposed here are the ones who never built their own patient voice mechanism because a national one existed to lean on.

What this means for your governance and assurance model

None of this is settled yet — report stage and the Lords still lie ahead, and the Healthwatch clauses in particular remain contested. But governance and assurance frameworks built around the current architecture — NHS England as an intermediary, HSSIB as an independent investigator, Healthwatch as an independent patient voice — will need updating regardless of exactly where the final text lands, because the direction of travel on all three is now clear.

Boards should be asking three questions now, not once the bill receives royal assent: does our incident investigation process currently rely on an HSSIB-CQC separation that may not exist in the same form; does our complaints and risk log have any exposure that a longer limitation period would newly capture; and do we have a patient experience mechanism that doesn't depend on national infrastructure that's being abolished. Providers who can answer all three cleanly walk into report stage in a stronger position than those still waiting to see what the final text says.

This piece sits in Harbour Governance's regulatory coverage, tracking the Health Bill through Parliament as it affects independent and private provider governance. Subscribers to the monthly regulatory briefing get a fuller breakdown of clause-by-clause implications as the bill moves through report stage and the Lords.

How to Make Shared Governance Work: Navigating the NHS and Independent Sector Divide

A growing share of NHS-funded care now happens in independent hospitals. As of 2022, the independent sector delivered around 9% of all NHS-funded elective procedures, and for hip and knee replacements and cataract surgery specifically, that figure rises to roughly one in three. NHS spending on independent sector care reached £11.8 billion in 2020/21, up £2 billion on the year before.

This isn't a niche arrangement at the margins of the system. It's a substantial and growing part of how NHS-funded care actually gets delivered.

Nearly all of it runs on a shared medical workforce. Most consultants working in independent hospitals hold a substantive NHS post, and their NHS employer carries legal responsibility for oversight of their whole scope of practice, including the work they do on the independent side. Which raises an obvious question: when a consultant's practice spans both sectors, how well does governance actually follow them across that boundary?

Until this year, the honest answer was mostly anecdotal. A national survey published in 2026 changes that. Researchers from the University of Manchester and University of York surveyed 769 senior leaders with governance responsibility across NHS trusts and independent hospitals in England; 320 responded (a 42% response rate), and asked, in detail, how shared clinical governance actually functions between the sectors. The findings are worth taking seriously, because they confirm something many independent providers have probably suspected but rarely seen measured: shared governance across this boundary runs largely on goodwill, not process.

The headline finding: informal is the norm, not the exception

Only around one in five respondents said they had a formal agreement or policy governing shared clinical governance arrangements with their counterpart hospitals in the other sector. The rest relied on contact of varying frequency, described by respondents as ad hoc, sporadic, and reactive: meetings that happened when something went wrong, rather than as a standing part of how the relationship worked.

Where relationships were strong, they tended to be strong with one or two specific partner hospitals, and considerably weaker, sometimes non-existent, with others, even where consultants were shared across all of them. The researchers found this pattern repeatedly: a good relationship with the hospital down the road, and almost nothing with three others where the same doctor also holds practising privileges.

The mechanism holding this together, more than anything else, was personal relationships. Responsible-officer-to-responsible-officer conversations were the main channel respondents described. When those individual connections existed, the system worked reasonably well. When they didn't—because of staff turnover, a large multi-site independent group with too many NHS trusts to build relationships with individually, or simply no prior contact—governance information didn't reliably flow at all.

The perception gap independent providers should sit with

Here's the finding that's genuinely worth pausing on if you're on the independent sector side: when asked to rate the quality of their shared governance arrangements, independent hospital respondents rated them significantly more positively than their NHS counterparts did—a statistically significant gap, not a marginal one. Nearly two-thirds of independent sector leaders rated their processes for verifying consultants' scope of practice as robust; fewer than a fifth of NHS leaders said the same about theirs. Three-quarters of independent sector leaders were confident they knew the NHS scope of practice of their dual-practice consultants; under a third of NHS leaders had equivalent confidence about the independent side.

Interestingly, the survey suggests the complexity runs the other way round from what you might expect: independent hospital respondents most commonly reported that their consultants come from three or more different NHS trusts, while NHS respondents mostly said their consultants who also work independently were active at just one or two independent hospitals—and over a third of NHS respondents didn't know which independent hospitals their consultants worked at, at all. If anything, independent providers are often the ones managing the wider spread of relationships, which makes the confidence gap more striking, not less.

This is worth sitting with because it means an independent provider can genuinely believe the relationship with its NHS partner is working well, while the NHS side experiences the same relationship as thin, uncertain, and hard to rely on. If your own confidence in shared governance rests entirely on your side of the process feeling solid, that confidence may not be shared by the trust you'd need it from in a crisis, and you may not find that out until you actually need it.

Where the practical risk actually sits: scope of practice and probity

The survey asked in detail how organisations verify a consultant's scope of practice at the other hospital, and how concerns get shared. The pattern that emerged across both sectors was a heavy, largely unavoidable reliance on the consultant's own honesty.

NHS respondents described relying on a "letter of good standing" provided at appraisal, self-reported by the consultant, rarely independently verified. Independent hospital respondents described a similar dependency running the other way—scope of practice information supplied by the consultant when applying for practising privileges, sometimes supported by a letter from their NHS trust, but frequently not checked in any real depth afterward. One independent sector hospital director's own assessment, reported in the study, was blunt: they were relying on trusting that the consultant was telling the truth, and probably weren't rechecking scope of practice as often as they should.

This matters more than it might first appear, because it's precisely the gap the Paterson Inquiry identified after Ian Paterson was able to continue harming patients across both NHS and independent settings, in part because information about his practice wasn't being systematically shared between the organisations where he worked. The Inquiry's first recommendation called for a single, shared repository of consultants' whole practice, accessible to both sectors. A pilot of exactly this—the Acute Data Alignment Programme (ADAPt), run jointly by the Private Healthcare Information Network and NHS Digital—ran between 2020 and 2023. It has not yet been implemented nationally. Five years after Paterson, the infrastructure recommendation still doesn't exist in practice, and the survey's findings show why that gap continues to matter: without it, verification still depends heavily on the consultant's own account.

This sits close to what medical revalidation is meant to capture in the first place—a doctor's whole scope of practice, wherever they work. The survey shows plainly that, in practice, the mechanism to evidence that fully across sectors still isn't there for most organisations.

Concern-sharing looks better on paper than it works in practice

Most organisations do have a policy for handling concerns about a consultant's practice, 79% of NHS respondents and 93% of independent sector respondents confirmed this. But having a policy and having concerns actually reach the other sector in practice are different things. Only 64% of NHS policies specifically included a process for sharing concerns with the other sector hospital, against 93% of independent sector policies.

When asked directly whether consultants fulfil their professional obligation to inform other organisations about significant concerns, restrictions, or exclusions, the most common answer from NHS respondents wasn't yes or no, it was "I don't know," at nearly half of all responses. Only around one in ten NHS respondents and roughly one in five independent sector respondents felt this always happened. Respondents from both sides described a system that, in practice, isn't a genuine two-way exchange: independent providers frequently reported passing information to the NHS without it being reciprocated, and vice versa, often attributed to unclear ownership within large NHS organisations (where responsibility bounces between the Medical Director, the Responsible Officer, and divisional leads) rather than any deliberate withholding.

What this means practically for independent providers

None of this is really an indictment of individual organisations trying their best within an unregulated, non-mandatory process. This is a structural gap, not a behavioural one, and the researchers are explicit that it needs systemic fixing, better data infrastructure, and full implementation of the Paterson recommendations, rather than individual organisations solving it alone. But waiting for that infrastructure to arrive isn't a governance strategy. Here are five concrete steps worth taking now:

• Don't treat a "letter of good standing" as verification. It's a useful data point, but the survey shows plainly that both sectors know these rely on the consultant's own account rather than independent checking. Where you can, build in an actual verification step—a direct conversation with the Responsible Officer or equivalent at the other organisation, not just a form.

• Formalise the relationship, even informally. You don't need a heavyweight contract to move from ad hoc to structured. A simple written understanding—who the named contacts are on each side, how often you'll touch base, what triggers an out-of-cycle conversation—closes most of the gap the survey identifies between "some contact" and "an actual formal agreement," which only one in five organisations currently have.

• Don't assume reciprocity. The survey found information sharing was frequently one-directional, more often independent sector giving without receiving back. If you're only getting what's volunteered, build in a habit of actively asking, rather than waiting for information to arrive.

• Build resilience beyond one relationship. Where governance depends on one individual's personal connection with one RO, it collapses the moment either person moves on. Document who holds the relationship and make sure at least one other person in your organisation has visibility of it.

• Watch the Paterson recommendation timeline. The infrastructure gap this survey identifies is a known, named policy priority. When ADAPt or an equivalent shared data system does move toward implementation, providers who've already built strong internal scope-of-practice and concern-sharing habits will adapt far more easily than those relying entirely on goodwill today.

This is exactly the kind of gap that sits between disciplines—part clinical oversight, part information governance, part plain organisational habit—which is precisely why it tends to fall through the cracks of governance built around a single specialism. It's also exactly the kind of standing, cross-disciplinary assurance work we build into ongoing governance support for independent providers, rather than treating it as a one-off policy exercise.

Source: Stringer G, Ferguson J, Walshe K, et al. Shared clinical governance arrangements between NHS and independent acute hospitals in England: findings from a national survey of senior leaders. Journal of Health Services Research & Policy, 2026. Funded by the NIHR Health and Social Care Delivery Research Programme.