The Big Picture and Patient Safety: The Health Bill 2026 and What It Means for Your Governance and Assurance Model
The Health Bill 2026–27 — badged by government as the NHS Modernisation Bill — is currently working its way through Parliament. It had its second reading on 1 June 2026, the Public Bill Committee finished its line-by-line scrutiny in mid-July, and the bill now moves toward report stage.
For independent and private providers, this is the point to stop treating it as a Westminster story and start treating it as a governance planning problem.
The headline purpose is to abolish NHS England and reassign its functions between Integrated Care Boards and the Secretary of State for Health and Social Care. But three changes inside the bill matter more directly to how independent providers are regulated, investigated and held to account: the folding of the Health Services Safety Investigations Body into the CQC, the abolition of Healthwatch England and local Healthwatch, and a significant transfer of discretionary power to the Secretary of State. Read together, they reshape the patient safety landscape your organisation currently operates inside.
Power moving to the centre
NHS England currently holds a wide range of statutory functions and regulatory powers as an arm's-length body, at one remove from ministers. The bill would strip that layer out. Some functions go to Integrated Care Boards; others transfer directly to the Secretary of State, including new powers to make regulations governing ICB conduct on waiting times, patient choice, and appeals over commissioned services — with the Secretary of State able to investigate and enforce where an ICB falls short.
Supporters, including the Nuffield Trust and the King's Fund, argue this removes a layer of duplication and gives the system a single clearer line of accountability. The concern raised repeatedly during committee scrutiny is the opposite side of that coin: decisions that used to sit with an operationally independent body move into direct ministerial hands, and the Commons Health and Social Care Committee has specifically questioned whether the Department has the operational capability to absorb NHS England's functions at the pace the bill assumes.
For providers, the practical read is this: your regulator relationship doesn't just involve the CQC and your ICB anymore. It runs, more directly than before, back to the Department. Contract terms, commissioning decisions and enforcement priorities are more likely to shift with political priorities than they have been under the current arm's-length arrangement.
HSSIB into the CQC: one door, two functions behind it
The bill would abolish the Health Services Safety Investigations Body and move its investigatory functions into the CQC, along with HSSIB's powers of entry and its ability to demand documentary and other evidence.
The tension here isn't hypothetical — the CQC named it directly in its own written evidence to the Health and Social Care Committee, warning of a conflict between its role as regulator and enforcer and the "safe space" HSSIB investigations were built to protect, and asking for legal certainty in the bill's drafting so the change doesn't leave it exposed. MPs raised the same point in the Commons: an investigation function is only useful to providers if the people involved can speak freely, without what they say being used against them in an enforcement decision made by the same organisation. Put the investigator and the enforcer under one roof and that separation gets harder to guarantee, whatever the operational firewalls say on paper.
There's a second change bundled into the same clauses that providers should register separately: the government is extending the limitation period for CQC criminal enforcement action from three years to five. That's a longer window in which a historic incident can result in prosecution — worth flagging to your legal team regardless of where you land on the wider HSSIB question.
Healthwatch abolished, functions redistributed
The bill would abolish Healthwatch England and local Healthwatch organisations, transferring their functions to ICBs and local authorities. The government's stated aim is simplification. The Health Foundation's second reading briefing put the risk more starkly: Healthwatch has had a mixed record, hampered by underfunding and a structural power imbalance with the NHS — but bringing its functions in-house means patients lose an institutionally independent voice, at a point where past patient safety inquiries have repeatedly shown the system doesn't listen well on its own. Local Healthwatch organisations have since formed a joint working group to submit evidence to Parliament making the same case.
The Public Bill Committee considered amendments to strike the Healthwatch clauses out. They didn't succeed — the committee agreed the clauses should proceed to the next stage, so as things stand the abolition is still in the bill heading into report stage. Worth watching, but not worth planning around a reversal.
What's gained and what's lost
Government's case for all three changes is the same: fewer bodies, fewer duplicated functions, one clearer set of lines back to ministers. That's a real gain if it happens as described — provider-facing simplicity is not nothing, and a single patient safety route through the CQC is, on paper, easier to navigate than three separate bodies with three separate remits.
What's lost is structural, not cosmetic. HSSIB's value wasn't just that it investigated — it was that it investigated at arm's length from the regulator with enforcement power. Healthwatch's value wasn't just that it collected patient views — it was that it did so as a body with no stake in the system's own performance. Streamlining removes the duplication, but duplication was doing a job: it was the separation itself that gave each function its independence. Folding both into a single, larger CQC doesn't just tidy the org chart. It removes the structural feature that made each function trustworthy on its own terms.
The reputational and legal exposure sitting inside CQC's expanded role
For providers, an enlarged CQC with investigatory powers, a longer limitation period, and a still-developing single assessment framework is a materially different regulator to plan governance around than the CQC you've been dealing with to date.
Three practical exposures worth taking to your board or governance committee now:
The evidentiary trail from an HSSIB-style investigation could, depending on how the transfer is drafted, end up informing an enforcement decision made by the same body. Providers should assume less separation between "tell us what happened so we can learn" and "tell us what happened so we can prosecute" than existed before, and brief staff and legal teams accordingly ahead of any incident, not after one.
A five-year rather than three-year limitation period means historic governance gaps carry legal exposure for longer. If your risk register or complaints log has entries sitting untouched from three or four years ago, this is the moment to check they've been properly closed out and documented, not just filed.
A regulator absorbing new functions, new powers and a still-developing assessment framework at the same time is a regulator more likely to produce inconsistent early decisions. That's a reputational risk as much as a legal one — an inspection outcome that looks harsh or inconsistent with peers is harder to challenge cleanly while the framework itself is in flux.
The Healthwatch gap, and what fills it
If Healthwatch functions move to ICBs and local authorities, the independent channel through which patient experience data reached providers and regulators changes shape. ICBs and local authorities have their own priorities and their own relationship with the providers they commission — not the same position of independence Healthwatch held.
The mitigation isn't complicated, but it does need to be deliberate rather than assumed. Providers who have historically treated patient experience data as something Healthwatch or the CQC gathered on their behalf now need their own structured route for capturing it directly — complaints data triangulated against a genuine patient feedback mechanism, not just satisfaction surveys, reviewed at board level on a fixed cycle rather than only when something goes wrong. Where a local Healthwatch function does continue in some diminished form through your local authority, keep that relationship active rather than letting it lapse quietly along with the rest of the national infrastructure. The organisations most exposed here are the ones who never built their own patient voice mechanism because a national one existed to lean on.
What this means for your governance and assurance model
None of this is settled yet — report stage and the Lords still lie ahead, and the Healthwatch clauses in particular remain contested. But governance and assurance frameworks built around the current architecture — NHS England as an intermediary, HSSIB as an independent investigator, Healthwatch as an independent patient voice — will need updating regardless of exactly where the final text lands, because the direction of travel on all three is now clear.
Boards should be asking three questions now, not once the bill receives royal assent: does our incident investigation process currently rely on an HSSIB-CQC separation that may not exist in the same form; does our complaints and risk log have any exposure that a longer limitation period would newly capture; and do we have a patient experience mechanism that doesn't depend on national infrastructure that's being abolished. Providers who can answer all three cleanly walk into report stage in a stronger position than those still waiting to see what the final text says.
This piece sits in Harbour Governance's regulatory coverage, tracking the Health Bill through Parliament as it affects independent and private provider governance. Subscribers to the monthly regulatory briefing get a fuller breakdown of clause-by-clause implications as the bill moves through report stage and the Lords.
