30 October: Is Your Harassment Policy Ready for "All Reasonable Steps"?

On 30 October, two changes to harassment law take effect under the Employment Rights Act 2025. For healthcare providers, the second one matters most: employers become liable when staff are harassed by patients, relatives and visitors, unless they've taken all reasonable steps to prevent it.

There's not much time. And an Acas survey of senior decision makers, carried out in the spring, found that 41% of employers weren't aware the changes were coming.

What changes on 30 October?

The sexual harassment duty gets tougher. Since October 2024, employers have had to take "reasonable steps" to prevent sexual harassment of their workers. From 30 October, that becomes "all reasonable steps". Acas puts it plainly: employers will be expected to take them all, with no exceptions. What counts as reasonable still depends on your size, sector and the work you do.

Employers become liable for third-party harassment. If a worker is harassed in the course of their work by someone outside the organisation, the employer can be liable, unless it took all reasonable steps to prevent it. This isn't limited to sexual harassment. It covers harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation - all of the protected characteristics.

Two existing rules sit alongside these. Tribunals can already increase compensation by up to 25% where an employer has failed in its duty to prevent sexual harassment. And since April 2026, disclosures about sexual harassment can count as protected whistleblowing disclosures.

Why this lands harder in healthcare

Most employers think of third parties as customers or contractors. In healthcare, they're patients, relatives and visitors, and staff deal with them in some of the most intimate and pressured settings there are. Personal care, home visits, lone working, night shifts, distressed families: each of these is a risk the new law expects you to have thought about.

There's a tension here too. A patient's behaviour may be linked to their condition, and good care means responding with compassion, not just enforcement. The law doesn't ask you to stop caring for people. It asks you to show you've assessed the risk to staff and taken reasonable steps to reduce it.

A practical checklist before 30 October

1.     Update your policy. Make sure it covers third-party harassment as well as harassment between colleagues, names the protected characteristics, and explains how patient and visitor behaviour will be handled.

2.     Do a risk assessment. Identify where staff are most exposed: lone working, community visits, personal care, night shifts, high-acuity settings. Record what you're doing about each one.

3.     Give people more than one way to report. Not everyone will go to their line manager. Include an anonymous route and your Freedom to Speak Up guardian.

4.     Train staff and managers. Staff need to know what to report and how. Managers need to know how to respond, investigate and support the person who raised it.

5.     Tell patients and visitors what you expect. Signage, patient information and admission agreements can set out the standard of behaviour and what happens if it isn't met.

6.     Plan your response to incidents. Decide in advance what options you have when a patient or relative harasses staff, from a conversation to changing the care arrangements, so decisions aren't made from scratch under pressure.

7.     Keep records. If you're ever challenged, you'll need to show what steps you took. A log of incidents and actions, and evidence of training and review, is the evidence you'll need.

8.     Give it board-level ownership. Name a board lead, and add staff safety from harassment to the risks your board actually discusses.

The governance angle

This is a good example of a duty that's easy to meet on paper and hard to meet in practice. A refreshed policy and a training module will tick a box. "All reasonable steps" asks something different: whether you know where your staff are at risk, and whether what you've done is actually working.

The Harbour Governance team will be covering what good looks like as guidance develops. In the meantime, if your policy hasn't been reviewed since 2024, this fortnight is the time.

Q3 2026 in review: the regulatory changes independent providers need to know…

July to September brought a new Prime Minister, a new Health Secretary, a Health Bill through the Commons and a CQC that finally hit its inspection target. What it didn't bring was the new assessment framework. For independent providers, that leaves a clear message for Q4: you are still being judged under the Single Assessment Framework, and the regulator is inspecting at pace.

Here's what happened, what it means for the independent sector, and what's on the horizon.

A new Prime Minister and a third Health Secretary in a year

What happened. Andy Burnham became Prime Minister in July and appointed Yvette Cooper as Secretary of State for Health and Social Care on 20 July. She replaced James Murray, who had held the post for about two months after Wes Streeting resigned in May. Cooper has named her early priorities as maternity services, social care reform and support for the NHS.

What it means for the independent sector. Three Health Secretaries in one year means policy priorities can move quickly. The 10-Year Health Plan is still the backbone, but watch for social care reform to move up the list. If you provide adult social care or community services, expect more political attention on quality, workforce and cost.

One detail worth noting: as Greater Manchester mayor, the new Prime Minister publicly opposed abolishing Healthwatch. That position matters for the Health Bill, below.

The Health Bill clears the Commons, with a Healthwatch rethink

What happened. The Health Bill 2026–27 finished its Commons stages on 8 September after Public Bill Committee (which ended on 16 July) and two days of Report Stage. The core of the Bill is unchanged. It abolishes NHS England, moves the Health Services Safety Investigations Body (HSSIB) into the CQC, and abolishes Healthwatch England and local Healthwatch.

The Healthwatch piece is now in play. On the last day of Report Stage, health minister Karin Smyth committed to review the abolition provisions, and ministers have signalled amendments in the Lords to keep an independent local voice for patients and people using care. The detail hasn't been decided.

What it means for the independent sector. HSSIB moving into the CQC is the change to watch. The government says the "safe space" for safety investigations will be preserved behind an internal wall. Critics, including the CQC itself in May, have warned about a conflict between investigating and regulating in the same body. For independent providers, this sharpens a question you should already be answering: if a safety investigator and your regulator share a building, how confident are you in your own PSIRF learning responses, candour records and board oversight of incidents?

If Healthwatch survives in a new form, Enter and View-style scrutiny of care services may survive with it. Plan as though independent patient-voice scrutiny will continue.

CQC: target beaten, framework delayed

What happened. The CQC set itself a target of 9,000 assessments between April 2025 and the end of September 2026. Its August update reported 9,646, a month early. For context, at the end of March it had completed 6,382, against 3,825 the year before.

The new assessment frameworks are running behind. The CQC's own plan was to publish final sector-specific frameworks in summer 2026 and implement from the end of the year. Instead, the summer pilots (the general practice pilot runs June to October) have been followed by an autumn programme of further sector-specific engagement, with the pilot evaluation due in November. A January 2027 launch now looks optimistic.

The CQC's instruction to providers hasn't changed: until the new approach is implemented, keep working to the current published guidance.

What it means for the independent sector. Two things. First, every one of those 9,646 assessments used the Single Assessment Framework, and that will carry on until the CQC says otherwise. Your evidence still needs to map to the 34 quality statements. Second, the CQC now has capacity. If your rating is more than two years old, the chance of an assessment in the coming months is higher than it has been for years.

The drafts still give you a head start. All four replace quality statements with key lines of enquiry (24 in the adult social care draft) and bring back rating characteristics instead of numerical scoring, with more weight on learning culture and outcomes. Build evidence that works under both.

AI scribes: the regulators draw a line

What happened. On 29 July the MHRA published guidance on ambient voice technology (AVT), better known as AI scribes. NHS England updated its own ambient scribing guidance to version 3 at the same time and withdrew its earlier position that any summarising scribe had to be a registered medical device. The MHRA's view: a tool that only transcribes, summarises, drafts letters or suggests codes for a clinician to check is not a medical device. A tool that supports diagnosis or treatment, or acts without clinician review, is. Clinicians stay responsible for checking what the AI produces. HSSIB has also opened an investigation into AVT.

What it means for the independent sector. Many independent clinics adopted scribes quickly. The new guidance is welcome clarity, but it moves the governance burden onto you. Your board should be able to show what each tool is for, a completed DPIA, how clinicians verify outputs, and how patients are told. Healthwatch England found that 81% of people want explicit consent when AI scribes are used, so consent is a good place to start.

Employment Rights Act: the October wave

What happened. The second big tranche of the Employment Rights Act 2025 lands this month. The main changes:

•      The time limit for most employment tribunal claims doubles from three months to six.

•      Employers must take "all reasonable steps" to prevent sexual harassment of staff, up from "reasonable steps".

•      Employers become liable for harassment of staff by third parties, such as patients, relatives and visitors.

•      Trade unions gain stronger rights of access and recognition.

What it means for the independent sector. Healthcare is a patient-facing sector, so third-party harassment is a live exposure every day. Check that your harassment policy covers patients and visitors, that staff know how to report it, and that your risk register reflects it. Longer tribunal time limits also mean HR records need to be complete and kept for longer. This is a workforce issue, but it is also a well-led issue: boards should see it.

Assisted dying bill falls

What happened. The reintroduced Terminally Ill Adults (End of Life) Bill was defeated at Second Reading on 11 September, by 286 votes to 270. It makes no further progress in its current form.

What it means for the independent sector. Nothing changes in practice for now. Hospices and palliative care providers should still expect the issue to return, whether through another Private Member's Bill or government legislation. The debate kept attention on access to palliative care, which may well shape funding and policy before any law on assisted dying does.

On the horizon

Health Bill Lords stages - Amendments on Healthwatch; scrutiny of the HSSIB safe space inside CQC

CQC sector-specific engagement events - Last chance to shape the frameworks for your sector

CQC pilot evaluation - The clearest signal yet on when new frameworks go live

To be confirmed

New CQC Chair

Sir Mike Richards is stepping down once a successor is in post; a permanent Chief Executive appointment follows

2027

Medical device regulation overhaul

The MHRA published draft amending regulations in May; relevant to any clinic using software or AI tools

January 2027

Unfair dismissal reforms

The next major Employment Rights Act change

What to do this quarter

🌊 Keep evidence mapped to the current 34 quality statements, and start a parallel map to the draft key lines of enquiry for your sector.

🌊 If your rating is over two years old, run a mock assessment now.

🌊 Take your incident, PSIRF and duty of candour records to the board, assuming an investigator could read them.

🌊 List every AI tool in clinical use, its intended purpose, DPIA status and how outputs are verified.

🌊 Update harassment policies to cover patients and visitors before the end of October.

Regulatory updates and horizon scanning to keep you on course as the rules shift: that's what the Harbour Governance team is here for. If any of this lands on your board agenda, we can help you make sense of it.

Sources

•      Digital Health: PM Burnham appoints Yvette Cooper as health secretary

•      House of Commons Library: Health Bill 2026–27 progress

•      UK Parliament: Health Bill publications

•      Patient Safety Learning hub (HSJ): Ministers to unpick Healthwatch abolition

•      Nuffield Trust: What's in the new Health Bill?

•      Healthcare Management: Health Bill risks 'patient safety bonfire'

•      Log my Care: CQC's new assessment framework, what happens by Christmas?

•      CQC Board, 3 June 2026: Q4 performance report

•      Price Bailey: CQC's new primary care framework

•      Safework: CQC's new assessment frameworks

•      Credentially: what changed on 24 March

•      Brodies: MHRA clarifies AI scribes are not automatically medical devices

•      Mills & Reeve: AVT guidance as HSSIB launches investigation

•      NHS Employers: October employment law changes

•      Mills & Reeve: Assisted dying bill falls at second reading

The Big Picture and Patient Safety: The Health Bill 2026 and What It Means for Your Governance and Assurance Model

The Health Bill 2026–27 — badged by government as the NHS Modernisation Bill — is currently working its way through Parliament. It had its second reading on 1 June 2026, the Public Bill Committee finished its line-by-line scrutiny in mid-July, and the bill now moves toward report stage. 

For independent and private providers, this is the point to stop treating it as a Westminster story and start treating it as a governance planning problem.

The headline purpose is to abolish NHS England and reassign its functions between Integrated Care Boards and the Secretary of State for Health and Social Care. But three changes inside the bill matter more directly to how independent providers are regulated, investigated and held to account: the folding of the Health Services Safety Investigations Body into the CQC, the abolition of Healthwatch England and local Healthwatch, and a significant transfer of discretionary power to the Secretary of State. Read together, they reshape the patient safety landscape your organisation currently operates inside.

Power moving to the centre

NHS England currently holds a wide range of statutory functions and regulatory powers as an arm's-length body, at one remove from ministers. The bill would strip that layer out. Some functions go to Integrated Care Boards; others transfer directly to the Secretary of State, including new powers to make regulations governing ICB conduct on waiting times, patient choice, and appeals over commissioned services — with the Secretary of State able to investigate and enforce where an ICB falls short.

Supporters, including the Nuffield Trust and the King's Fund, argue this removes a layer of duplication and gives the system a single clearer line of accountability. The concern raised repeatedly during committee scrutiny is the opposite side of that coin: decisions that used to sit with an operationally independent body move into direct ministerial hands, and the Commons Health and Social Care Committee has specifically questioned whether the Department has the operational capability to absorb NHS England's functions at the pace the bill assumes.

For providers, the practical read is this: your regulator relationship doesn't just involve the CQC and your ICB anymore. It runs, more directly than before, back to the Department. Contract terms, commissioning decisions and enforcement priorities are more likely to shift with political priorities than they have been under the current arm's-length arrangement.

HSSIB into the CQC: one door, two functions behind it

The bill would abolish the Health Services Safety Investigations Body and move its investigatory functions into the CQC, along with HSSIB's powers of entry and its ability to demand documentary and other evidence.

The tension here isn't hypothetical — the CQC named it directly in its own written evidence to the Health and Social Care Committee, warning of a conflict between its role as regulator and enforcer and the "safe space" HSSIB investigations were built to protect, and asking for legal certainty in the bill's drafting so the change doesn't leave it exposed. MPs raised the same point in the Commons: an investigation function is only useful to providers if the people involved can speak freely, without what they say being used against them in an enforcement decision made by the same organisation. Put the investigator and the enforcer under one roof and that separation gets harder to guarantee, whatever the operational firewalls say on paper.

There's a second change bundled into the same clauses that providers should register separately: the government is extending the limitation period for CQC criminal enforcement action from three years to five. That's a longer window in which a historic incident can result in prosecution — worth flagging to your legal team regardless of where you land on the wider HSSIB question.

Healthwatch abolished, functions redistributed

The bill would abolish Healthwatch England and local Healthwatch organisations, transferring their functions to ICBs and local authorities. The government's stated aim is simplification. The Health Foundation's second reading briefing put the risk more starkly: Healthwatch has had a mixed record, hampered by underfunding and a structural power imbalance with the NHS — but bringing its functions in-house means patients lose an institutionally independent voice, at a point where past patient safety inquiries have repeatedly shown the system doesn't listen well on its own. Local Healthwatch organisations have since formed a joint working group to submit evidence to Parliament making the same case.

The Public Bill Committee considered amendments to strike the Healthwatch clauses out. They didn't succeed — the committee agreed the clauses should proceed to the next stage, so as things stand the abolition is still in the bill heading into report stage. Worth watching, but not worth planning around a reversal.

What's gained and what's lost

Government's case for all three changes is the same: fewer bodies, fewer duplicated functions, one clearer set of lines back to ministers. That's a real gain if it happens as described — provider-facing simplicity is not nothing, and a single patient safety route through the CQC is, on paper, easier to navigate than three separate bodies with three separate remits.

What's lost is structural, not cosmetic. HSSIB's value wasn't just that it investigated — it was that it investigated at arm's length from the regulator with enforcement power. Healthwatch's value wasn't just that it collected patient views — it was that it did so as a body with no stake in the system's own performance. Streamlining removes the duplication, but duplication was doing a job: it was the separation itself that gave each function its independence. Folding both into a single, larger CQC doesn't just tidy the org chart. It removes the structural feature that made each function trustworthy on its own terms.

The reputational and legal exposure sitting inside CQC's expanded role

For providers, an enlarged CQC with investigatory powers, a longer limitation period, and a still-developing single assessment framework is a materially different regulator to plan governance around than the CQC you've been dealing with to date.

Three practical exposures worth taking to your board or governance committee now:

The evidentiary trail from an HSSIB-style investigation could, depending on how the transfer is drafted, end up informing an enforcement decision made by the same body. Providers should assume less separation between "tell us what happened so we can learn" and "tell us what happened so we can prosecute" than existed before, and brief staff and legal teams accordingly ahead of any incident, not after one.

A five-year rather than three-year limitation period means historic governance gaps carry legal exposure for longer. If your risk register or complaints log has entries sitting untouched from three or four years ago, this is the moment to check they've been properly closed out and documented, not just filed.

A regulator absorbing new functions, new powers and a still-developing assessment framework at the same time is a regulator more likely to produce inconsistent early decisions. That's a reputational risk as much as a legal one — an inspection outcome that looks harsh or inconsistent with peers is harder to challenge cleanly while the framework itself is in flux.

The Healthwatch gap, and what fills it

If Healthwatch functions move to ICBs and local authorities, the independent channel through which patient experience data reached providers and regulators changes shape. ICBs and local authorities have their own priorities and their own relationship with the providers they commission — not the same position of independence Healthwatch held.

The mitigation isn't complicated, but it does need to be deliberate rather than assumed. Providers who have historically treated patient experience data as something Healthwatch or the CQC gathered on their behalf now need their own structured route for capturing it directly — complaints data triangulated against a genuine patient feedback mechanism, not just satisfaction surveys, reviewed at board level on a fixed cycle rather than only when something goes wrong. Where a local Healthwatch function does continue in some diminished form through your local authority, keep that relationship active rather than letting it lapse quietly along with the rest of the national infrastructure. The organisations most exposed here are the ones who never built their own patient voice mechanism because a national one existed to lean on.

What this means for your governance and assurance model

None of this is settled yet — report stage and the Lords still lie ahead, and the Healthwatch clauses in particular remain contested. But governance and assurance frameworks built around the current architecture — NHS England as an intermediary, HSSIB as an independent investigator, Healthwatch as an independent patient voice — will need updating regardless of exactly where the final text lands, because the direction of travel on all three is now clear.

Boards should be asking three questions now, not once the bill receives royal assent: does our incident investigation process currently rely on an HSSIB-CQC separation that may not exist in the same form; does our complaints and risk log have any exposure that a longer limitation period would newly capture; and do we have a patient experience mechanism that doesn't depend on national infrastructure that's being abolished. Providers who can answer all three cleanly walk into report stage in a stronger position than those still waiting to see what the final text says.

This piece sits in Harbour Governance's regulatory coverage, tracking the Health Bill through Parliament as it affects independent and private provider governance. Subscribers to the monthly regulatory briefing get a fuller breakdown of clause-by-clause implications as the bill moves through report stage and the Lords.

CQC inspection surge — are you on the priority list?

CQC has published exactly which services it's assessing first, and the independent sector is named specifically.

On 26 May 2026, CQC set out how it's prioritising assessments to hit its target of publishing at least 9,000 reports by September 2026. For hospitals, secondary and specialist care, four groups are named. Two of them will apply to a lot of independent providers reading this.

Who's first in the queue

For hospitals, secondary and specialist care, CQC is prioritising:

• Services not assessed for a significant period, where CQC's monitoring data points to a need to re-inspect

• Services registered but never assessed, ranked by how long they've been registered

• NHS providers applying for advanced foundation trust status without a recent assessment

• Independent sector services specifically, because of "unknown or emerging risk" and the growing volume of NHS-commissioned work they deliver

That last point is the one worth sitting with. CQC isn't treating the independent sector as background noise in a wider inspection push. It's calling it out as a named priority, and the reasoning is explicit: as more NHS-commissioned activity moves into independent settings, CQC wants more current data on how those services are performing.

If your organisation has never been assessed under the current framework, or hasn't had contact in a while, that combination — never assessed, or overdue, plus independent sector — puts you closer to the front of the queue than you might assume.

What this means in practice

Two questions worth answering honestly this week:

When were you last assessed, and does your evidence reflect it? A service that hasn't had a full assessment in some time is exactly the profile CQC has said it's targeting. If your governance evidence, policies, and risk data haven't been refreshed to match, that gap will show on the day.

Is your risk data telling CQC a different story than you'd tell them yourself? CQC's monitoring activity — data it already holds, not just what happens on inspection day — feeds directly into who gets prioritised. Incident reporting, complaints data, and notifications all shape that picture before an inspector ever arrives.

Neither of these is about panic. It's about knowing where you sit before CQC tells you, rather than after.

Where to start

Our CQC framework transition self-assessment tool walks through exactly this — mapping your current evidence against what the new framework will expect, and flagging where the gaps are before they're someone else's finding. It's free to use, and takes about twenty minutes.

If you'd rather talk it through first, get in touch and the Harbour Governance team can help you work out where you actually stand.

Source: CQC, "Priorities for delivering more assessments and tackling aged ratings," published 26 May 2026.

Healthcare Complaint Management in England & Wales — What's Coming and Why It Matters

A Harbour Governance Sector Insight  ·  July 2026

Category: Regulatory Updates

Complaint management is one of the most under-governed areas in independent healthcare. Most providers have a complaints policy.

Far fewer have a complaints system — one that identifies patterns, drives learning, closes the loop with patients, and gives the board genuine assurance.

That gap matters more now than at any point in the last decade. Because the regulatory and legislative landscape around complaint handling in England and Wales is changing — faster, and more significantly, than most providers realise.

This briefing sets out where things stand, what good looks like right now, and what is coming in the next twelve to eighteen months.

The current landscape — in brief

In England, the legal framework for complaint handling is the Local Authority Social Services and National Health Service Complaints (England) Regulations 2009. These establish a two-stage process: local resolution by the provider, followed by referral to the Parliamentary and Health Service Ombudsman (PHSO) for complaints that remain unresolved.

The PHSO has developed NHS Complaint Standards that set out how organisations providing NHS services should approach complaint handling. These place a strong emphasis on early resolution, compassionate engagement and fair, accountable responses.

For independent providers — here is where it gets complicated.

The PHSO has no jurisdiction over privately funded care. If a patient receives privately funded treatment and remains dissatisfied following the provider's local complaints process, their options are limited. ISCAS (the Independent Sector Complaints Adjudication Service) provides independent adjudication — but membership is voluntary. If your organisation is not registered with ISCAS, a dissatisfied private patient currently has no independent route of appeal.

This is a significant governance and reputational gap. And it is one that is increasingly on Parliament's radar.

In Wales, the most significant complaints reform in fifteen years has just come into force. The new Listening to People framework replaced Putting Things Right on 1 April 2026, introducing a two-stage process — Early Resolution and Formal Investigation — with financial redress of up to £50,000 in eligible cases. For independent providers regulated by Healthcare Inspectorate Wales, the expectation that complaint governance aligns with these four core principles is increasingly being applied in HIW inspections.

What good complaint management looks like in 2026

Drawing from PHSO standards and CQC's Well-Led expectations, there are eight defining characteristics of good complaint management right now. The four that independent providers most consistently get wrong are:

1. Agreed — not imposed — timescales The 2009 Regulations do not set a mandatory response deadline. Good practice requires agreeing a timescale with the complainant at the acknowledgement stage. Not telling them when you will respond. Agreeing it. The distinction matters both to patients and to inspectors.

2. Any open door - The NHS (and therefore the CQC) doesn't have a formal "open door" policy, but it lives by a "no wrong door" principle. That means complaints can be raised anytime, anywhere—by phone, email, or in person—and staff are trained to catch concerns even if you never use the word "complaint." Issues are fixed informally on the spot if possible, and if not, the door simply opens onto the next stage, all the way up to the independent Ombudsman. In short: the system is designed so you never have to fight to be heard—you just have to walk in.

3. A coordinated response when multiple providers are involved Where a patient's complaint spans more than one provider, those providers are required to give a coordinated response. This is one of the most frequently cited complaint handling failures in CQC inspection reports — particularly in independent providers who share patients with NHS services.

4. Genuine learning — not just resolution Modern complaint governance is not about closing cases. It is about triangulating complaint themes with incident data, patient feedback and audit findings to identify where systems are failing. PSIRF expects this. CQC's Well-Led framework expects this. The PHSO expects this. Resolving individual complaints without analysing the patterns is compliance theatre.

The horizon — what's coming in the next 12-18 months

The following section provides a summary of the key developments on the horizon. Our full horizon scan — covering all five developments in detail, with governance action points for each — is available to Harbour and Deep Water subscribers.

The 10 Year Health Plan — complaint reform commitment The government has committed to reforming the NHS complaints process through the 10 Year Health Plan — setting clear standards for both timeliness and quality of responses, and introducing a new National Director of Patient Experience. The most significant proposal is the introduction of patient power payments — allowing patients to withhold a portion of payment for their care if dissatisfied. If enacted, this would be the most significant shift in complaint leverage for patients in a generation.

PHSO jurisdiction — the independent sector gap Parliamentary attention on the absence of a mandatory independent complaints route for privately funded patients is growing. The most likely development is a tightening of CQC registration expectations — requiring all independent providers to belong to an approved independent adjudication scheme such as ISCAS. This is not yet confirmed, but providers who are not currently ISCAS members should be reviewing that position now.

Healthwatch England abolished Healthwatch England is being abolished, with patient voice functions moving to the Department of Health and Social Care. For independent providers, this removes one patient advocacy route and may increase the volume of complaints that escalate directly to CQC.

For the full analysis — including the Wales Listening to People framework in detail, the CQC/HSSIB merger implications for complaint governance, and our recommended governance action plan for independent providers — see our full Complaints Horizon Scan, available to Harbour and Deep Water subscribers.

Three questions to ask about your complaints governance today

Before the landscape changes further, here are the three questions every governance lead and board member in independent healthcare should be able to answer:

1. If a private patient exhausts your internal complaints process and remains dissatisfied — where do they go? If the answer is "I'm not sure" or "there isn't anywhere," that is a governance gap and a reputational risk. The answer should be: to ISCAS, or to an equivalent approved adjudication scheme.

2. Can you show your board a complaints themes analysis from the last twelve months — not just a case count? A board that only sees how many complaints were received, and how many were resolved within timescale, is not being given the governance information it needs. Themes, learning, and evidence of service change are the markers of a mature complaints system.

3. Does your complaints process meet the Accessible Information Standard? If patients cannot access your complaints process in a format that meets their communication needs — large print, BSL interpretation, easy read — your complaint handling is failing before it has started. This is a compliance gap that CQC is increasingly focused on.

How Harbour Governance can help

Our Complaints, Compliments and Feedback policy — included in all subscription tiers — is aligned to current PHSO standards and CQC expectations, and will be updated as the landscape changes.

Our full Complaints Horizon Scan — covering all five horizon developments in detail with governance action points — is available to Harbour and Deep Water subscribers.

If you are a governance lead or board member who wants to understand your complaints position before the landscape shifts further, book a conversation with our founder here — available to Deep Water subscribers.

Harbour Governance publishes regular regulatory analysis and practical governance guidance for independent and private healthcare providers in England and Wales. Subscribe to receive updates directly.