Criminal Law in Healthcare (Part 2): Are the Care Quality Commission and Health and Safety Executive Fit for Purpose?

It is inarguable that the CQC needs improvement. Many who run care services in local authorities have little confidence in its performance. A new start with new leadership is what they need, as well as implementation of the recommendations.

Karin Smyth (MP for Bristol South) House of Commons debate, 7 January 2025

HSE has a first-class reputation as a proportionate regulator […] there are always things that could be made better in any organisation, but HSE is a strong, well established and well-run public body.

Review of HSE conducted by Gill Weeks (OBE) on behalf of the Department for Work and Pensions in 2023

The Care Quality Commission (‘CQC’) and the Health and Safety Executive (‘HSE’) are regulatory bodies that oversee health and social care providers in, respectively, England and Great Britain. HSE regulates general workplace safety across most industries (including healthcare), focusing on employee safety, while the CQC is the independent regulator for health and adult social care, focusing on quality of care and safety of service users. Broadly, HSE is about workplace safety, whilst the CQC is about care-specific user safety. Their oversight roles are fundamental to ensure the safety of both users and workers in healthcare setting. But are they fit for purpose? 

This is the second article in a two-part series in which Maya Sikand KC and Jordan Briggs consider the criminal and regulatory framework in healthcare. The first article, here, considered the criminal law, with a special focus on corporate manslaughter and its utility in the healthcare context  . This second article considers the functioning of the CQC and HSE,  by reviewing the regulatory landscape surrounding these bodies. 

THE REGULATORY LANDSCAPE

The King’s Fund, a charity that aims to improve public health, compiled a slide deck for the Lampard Inquiry, an investigation into the deaths of mental health patients in Essex between 2000 and 2023, which sets out the regulation of public health services by both NHS and non-NHS bodies from 2000 to date.  

In 2000, the regulation of NHS-funded and independent hospitals was spread between four different bodies. First, the Mental Health Act Commission (2000-2008) existed to monitor whether the Mental Health Act 1983 was being used appropriately. Second, the National Patient Safety Agency (2001-2011) monitored events affecting patient safety in NHS-funded care. Third and fourth, the National Care Standards Commission and Commission for Health Improvement (both 2000-2003) respectively regulated independent hospitals and inspected healthcare providers. 

There was a wave of consolidation in 2004-2008. In 2004, the National Care Standards Commission and Commission for Health Improvement were blended into a single Commission for Healthcare Audit and Inspection, which inspected NHS providers and regulated independent hospitals. But in 2009, the role of that organisation, and the Mental Health Act Commission, were vested in the newly created CQC.

Elsewhere, there were similar consolidating efforts. The National Patient Safety Agency became the NHS Commissioning Board (2012-2022), which existed alongside Monitor (NHS), responsible for regulating NHS Foundation Trusts. But, in 2022, both organisations were consolidated into NHS England.  NHS England’s life was short - the Labour government announced in March 2025 that “the biggest quango in the world” will be abolished and merged into the Department of Health and Social Care over the next two years[1].

The HSE predated and survived these frenetic changes, having been created by the Health and Safety At Work etc. Act 1974 (‘HSWA 1974’). It regulates all operations ‘at work’ (HSAQ 1974, s1), so covers worker safety in all sectors and conceivable workplaces. The CQC, on the other hand, is more narrowly defined to health and social care users. To assess their fitness for purpose, we must first review their roles and operation. 

THE CQC

The CQC began operating on 1 April 2009, intending to ‘make sure health and social care services provide people with safe, effective, compassionate, high-quality care and [to] encourage care services to improve’, as stated here. The CQC is run by a Board, which sets overall strategy, and an executive team, which oversees day-to-day operations and plans business objectives. The CQC has four main functions: 

1. Registration: Health and social care providers must register with the CQC in order to operate lawfully. This requires the provider to adhere to the CQC’s safety and quality requirements in order to practice.
2. Monitoring and inspection: The CQC continually monitors providers through data collection, public feedback and inspections. Based on this information, it uses a ‘single assessment framework’ (‘SAF’) system to rate the provider as ‘Outstanding’, ‘Good’, ‘Requires improvement’ or ‘Inadequate’. Inefficiencies in the monitoring and registration system provoked the remarks of Karin Smyth MP cited at the beginning of this article, which followed similar conclusions in the Dash Review in 2024.
3. Public information: The CQC publishes its inspection reports and ratings to allow the public to make informed choices about who provides their health and social care.
4. Enforcement: If a provider fails in specified regards, the CQC has the power to take a range of enforcement actions, as set out below.

Enforcement is overseen by a Director (there are four, each with competence over: London and East of England; Midlands; North, or; South). Beneath them are Deputy Directors, who line manage Operations Managers. The Operations Managers oversee local teams comprising assessors, inspectors, co-ordinators and regulatory officers, as described here.

The enforcement powers available to these personnel derive from the Health and Social Care Act 2008, as amended by the Care Act 2014. In short, the CQC can enforce breaches of The Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 , as amended, (‘HSCA Regs 2014’) and The Care Quality Commission (Registration) Regulations 2009, as amended, (‘CQC Regs 2009’). 

Some regulations can only be enforced using civil law. For example, Regulation 4 of HSCA Regs 2014 requires the provider to be ‘of good character’ (see here), and Regulation 13 of CQC Regs 2009 requires that providers have the financial resources required to deliver the services in their statement of purpose (see here). The civil enforcement powers applicable to breach of either include issuing warning notices to the provider, imposing conditions on registration or suspending or cancelling registration.

Other regulations can also be enforced using the criminal law. Examples include Regulation 14 of HSCA Regs 2014, which requires service users to have ‘adequate nutrition and hydration’ (see here) and Regulation 16 of CQC Regs 2009, which requires the provider to notify the CQC of deaths occurring while services were being carried out (see here).

When such a regulation is breached, the CQC use a ‘Decision Tree’ to decide which enforcement tool to use. It involves four stages. Each stage involves an exercise of discretion. 

1. Initial assessment: First, the CQC review the evidence of the alleged breach, which may have accrued through a safeguarding alert, complaint, whistleblowing incident or similar. The CQC can respond by gathering more information, or referring the matter to another public body, but should consider proceeding to the next stage of the Decision Tree ‘where initial enquiries do not provide assurance that people using regulated services are reasonably protected from harm – and when they suggest that a provider or individual may need to be held to account for a breach’, as described here. Whether to proceed is decided at a ‘Decision-Making Meeting’ or ‘Management Review Meeting’. The decision is informed by factors including ‘the importance of working co-operatively with registered persons’, the CQC’s ‘limited enforcement resources’ and whether the facts suggest ‘a serious breach of the provider’s legal duties’, provided the CQC is ‘best placed to take the lead’ and ‘it is feasible to collect evidence.’
2. Legal and evidential Review: The test at this stage is ‘whether there is sufficient evidence of a breach of the legal requirements by a registered person’. The CQC considers factors including ‘the breach of legal requirement that appears to have taken place’, ‘whether enforcement action may be appropriate, having regard to relevant guidance and the Enforcement Policy’ and whether the CQC possesses or can obtain ‘sufficient, credible and appropriately recorded evidence that is stored and retrievable.’ The CQC may proceed if the evidence ‘is sufficient and robust’ and shows an ‘identifiable breach of a legal requirement’, as described here.
3. Selecting the appropriate enforcement action: This stage involves three sub-questions, as described here. First, the CQC consider the ‘seriousness’ of the breach, taking into account its ‘potential impact’ and likelihood of recurrence. These matters produce a seriousness rating as ‘low’, ‘medium’, ‘high’ or ‘extreme’, the latter three of which trigger an ‘initial recommendation’ of civil enforcement. 

Second, the CQC consider whether the ‘initial recommendation’ is adequate. This includes considering whether the provider has historically failed to assess or act on risks, or committed multiple breaches, or been unable to improve services, or has inadequate leadership and governance.

Third, the CQC squarely consider criminal enforcement action. The analysis involves consultation with legal services, a review of the two-stage test in the Code for Crown Prosecutors (here), and in particular ‘the sufficiency of evidence gathered’ and ‘the public interest to be served in taking criminal enforcement action’. When deciding whether to charge, the CQC will consider their ‘prosecution criteria’, which favours prosecution if services result in ‘Avoidable harm (whether of a physical or psychological nature) to a person using a service’ and if a service user has exposed to a significant risk of such harm occurring’.

4. Final review: Finally, the CQC consider whether the enforcement action indicated by the above considerations coheres with their ‘overall approach to enforcement’ (see here). The final decision is taken at a Decision-Making Meeting or Management Review Meeting, as described here.

The Decision Tree appears to have taken roughly the form above since 2015 (see here, at §1.5). Interestingly, at that time, the CQC had to issue a ‘warning notice’ before prosecuting and, despite having had criminal enforcement powers for six years, had only used them 13 times (i.e. 1.5 times each year), as set out in this table. In 2015, the CQC dispensed with the requirement to issue a ‘warning notice’ before prosecuting and has prosecuted 144 times since (i.e. 14.4 times each year). This is indicative of an increased appetite for prosecution – and additionally, since April 2015, the CQC has had the power to prosecute breaches of fundamental standards under the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, without needing police involvement. 

One notable aspect of the CQC’s prosecution record has been its conviction of NHS Trusts. As explained in the first article in this series, the offence of corporate manslaughter has only twice been used by the CPS to charge NHS Trusts and both charges ended in acquittals, most recently in connection with the sad death of Alice Figueiredo, as described here.

The CQC on the other hand has prosecuted 170 times since 2009. There have been 22 prosecutions of NHS Trusts, and the CQC has secured convictions in all but 1 of those cases (see this table, with examples set out here). The fact patterns have ranged from mental health patients gaining access to rooves in order to abscond, to deaths in healthcare units in prisons, to failure to share details of an avoidable death following an endoscopy procedure. If fitness for purpose is judged with reference to the number of prosecutions, the CQC are faring better than the CPS. 

The most recent conviction was of University Hospitals Sussex NHS Foundation Trust, in connection with the tragic death of Ellame Ford-Dunn (see here). Ellame, a child, was under 1:1 supervision in an acute inpatient ward, from which she absconded and was deliberately not followed, leading to her death. The Trust pleaded guilty to offences contrary to Regulations 12(2) and 22(2) of  HSCA Regs 2014 and was fined £200,000. This follows the CQC, as far back as 2018, specifically requesting that NHS Trusts do more to ensure patient safety. 

To-date, fines of £7,78m have been imposed in connection with convictions of NHS Trusts. However, the total cost to the NHS may be higher, as other areas of law are impacted by death related convictions.

For example, as explained by Chief Coroner’s Guidance No 33, which sets out that the requirements of Schedule 1 of the Coroners and Justice Act 2009, inquests will be impacted. This is because when a person has been, or may be charged with a homicide offence involving the death of the deceased, or a related offence (e.g. a non-homicide which involves the death of the deceased – as per Schedule 1, para 1(6)), the Coroner must suspend and adjourn the inquest. Thereafter, the Coroner will await the outcome of criminal proceedings and will resume the investigation if there is ‘sufficient reason’ to do so. If resumed, and the circumstances previously mandated empanelment of a jury, that empanelment becomes discretionary, with ‘sufficient reason’ again being the test (Coroners and Justice Act 2009, Schedule 1, para 11(3)).

Civil claims, including post-inquest civil claims, are also affected by CQC prosecutions. If, for example, the CQC secures a conviction for breach of Regulation 14 of HSCA Regs 2014 (i.e. failure to provide adequate nutrition or hydration) that will be relied upon as evidence of negligence arising from the same set of facts. As such, each time an NHS Trust receives a fine in the criminal law following CQC prosecution, a compensation award in civil law may well follow.   

Yet, enforcement activity should not be taken to imply that, overall, the CQC is operating as well as it should. An independent review of the CQC, conducted by Dr Penny Dash, identified substandard day-to-day activity, including poor operational performance (e.g. a recent drop in CQC inspections and assessments, a backlog in registering new providers and delays in providers receiving reports), problems with the CQC’s IT system, a ‘considerable loss of credibility within the health and care sectors’ and concerns around the reliability of the SAF system.

The review recommended a rapid improvement in the operational performance, fixing the IT system, rebuilding expertise across the sector, a review of the SAF system, and increased transparency about providers’ ratings and how they are reached. In response, the CQC in November 2025 set out its plan for the next year, which directly reflect these recommendations. They intend to redesign the entire regulatory process, test and pilot new technology, improve the online portal and strengthen the registration service.  As the CQC has limited resources, this plan may result in funds being  diverted away from prosecution and towards an adequate day-to-day service for registration and operations.

THE HSE

The HSE began operating on 1 January 1975, and is ‘dedicated to protecting people and places, helping everyone lead safer and healthier lives’, as stated here. The HSE is run by a Board which sets overall strategy, oversees the effectiveness of HSE’s functioning and reviews significant issues affecting the health and safety of those at work, as described here. The HSE has five statutory duties, namely to:

1. Propose and set necessary standards for health and safety performance, including submitting proposals to the Secretary of State for Health and Social Care, and as regards safety regulations and codes of practice;
2. Secure compliance with these standards, including making appropriate arrangements for enforcement;
3. Make such arrangements as it considers appropriate for the carrying out of research and the publication of the results of research and encouraging research by others;
4. Make such arrangements as it considers appropriate for the provision of an information and advisory service, ensuring relevant groups are kept informed of and adequately advised on matters related to health and safety; and
5. Provide Ministers on request with information and expert advice.

Enforcement is performed by Inspectors, which are appointed pursuant to section 19 of HSAW 1974. Once appointed, the Inspectors can enforce laws within HSE’s jurisdiction, as set out in the instrument of their appointment, or ‘warrant’ (see here). The enforcement powers, too, derive from HSAW 1974, and enable the HSE to take civil and criminal enforcement action.

The civil powers are various. Some empower the HSE to investigate, including a right to access premises without a warrant, gather evidence and interview (HSWA 1974, s20). Others empower the HSE to take action against workplaces, including through seizure of dangerous articles or substances (HSWA 1974, s25), service of ‘improvement notices’ requiring remedy of an apparent contravention of a statutory provision (HSWA 1974, s21) or a ‘prohibition notice’ requiring cessation of operations that give rise to the risk of serious personal injury until that risk, and the associated apparent contraventions of statutory provisions, are resolved (HSWA 1974, s22). 

The criminal powers are largely set out in sections 33 to 42 of HSWA 1974. Section 33 is a key section. It sets out the prosecutable offences, including failure to ensure the health and safety at work of employees so far as is reasonably practicable (HSWA 1974, s2) and a failure to conduct the undertaking, so far as is reasonably practicable, in a way that avoids exposing persons not in employment to health and safety risks  (HSWA 1974, s3). Reported convictions often cite breach of section 33 (see, for example, here). Finally, section 37 provides that such criminal liability can extend to the corporation itself, as well as its director, manager, secretary or similar officer. 

When deciding whether to prosecute, the HSE follow an Enforcement Policy Statement (‘EPS’), here. It states the HSE’s guiding principles as, ‘proportionality in how we apply the law and secure compliance; targeting of our enforcement action; consistency of our approach; transparency about how we operate and what you can expect, and accountability for our actions’. 

The procedure used when deciding whether to prosecute is complex, but helpfully set out on these flowcharts on the HSE website. It can be summarised as follows:

1. Notice: The process begins when an Inspector learns that a business is or may be in breach of health and safety law. The Inspector then follows an Enforcement Management Model (EMM), available here, which is ‘a guide […] not a strict set of rules’ about what enforcement to take.
2. Initial review: The EMM states that, where there is a risk of ‘serious personal injury’, investigators must immediately consider civil action (i.e. whether to affect a prohibition notice or seizure) and, thereafter, review whether there are any further issues for enforcement. However, investigators need not take civil action before prosecuting, and in practice may not when there is ‘a combination of high risk and extreme failure to meet an explicit or clearly defined standard, which is well known and obvious’.
3. Whether to prosecute: When deciding whether to prosecute, the HSE ‘use[s]discretion’ and ‘take[s] account of the evidential stage and the relevant public interest factors set down by the Director of Public Prosecutions in the Code for Crown Prosecutors’. In principle, this requires that there is ‘sufficient evidence to provide a realistic prospect of conviction and that prosecution is in the public interest’.  The EMM states that the public interest test is normally satisfied if:

• Death was a result of a breach of the legislation;
• The gravity of an alleged offence, taken together with the seriousness of any actual or potential harm, or the general record and approach of the offender warrants it;
• There has been reckless disregard of health and safety requirements;
• There have been repeated breaches which give rise to significant risk, or persistent and significant poor compliance;
• Work has been carried out without, or in serious non-compliance with, an appropriate licence or safety case;
• A duty holder’s standard of managing health and safety is found to be far below what is required by health and safety law and to be giving rise to significant risk;
• Additionally, prosecution ‘should normally be considered where it is appropriate’ as ‘a way to draw general attention to the need for compliance with the law, or a conviction may deter others from similar failures to comply with the law.’

4. Next steps: If a prosecution is indicated, another chain of events will follow. These can include obtaining additional evidence, consulting the police, identifying the charges and defendants, preparing a Prosecution Report, submitting it to an approval officer for independent review and, once approved, the instruction of a solicitor. For more detailed information, readers are advised to review the flowcharts above. 

These steps are comparable to those in the CQC’s Decision Tree. 

Overall, the HSE prosecutes overwhelmingly more often than the CQC. This is because the HSE can prosecute any workplace in Great Britain, whereas the CQC may only prosecute registered providers of health and social care. Interestingly, however, the HSE’s database suggests that they have prosecuted NHS Trusts an almost identical number of times as the CQC has done. The HSE has prosecuted 23 times since inception, compared to the CQC’s 22 prosecutions. 

The bottom line is that the HSE prosecutes more than the CQC overall. The HSE sets out its prosecution statistics in ‘Annual Reports and Accounts’, but there is no publicly accessible table or list of every single prosecution and conviction since the HSE began operating in 1975. In 2024/25, the HSE prosecuted 246 times, with a 96% conviction rate in that year and fines levied of over £33m (see here). This towers above the CQC’s 170 prosecutions, overall, since 2009.

The HSE’s 2024/25 prosecution rate seems broadly comparable with recent years. In 2023/24, there were 248 prosecutions with a 92% conviction rate (see here). In 2022/23, there were 216 prosecutions with a 94% conviction rate (see here). In 2021/22, there were 290 prosecutions with a 96% prosecution rate (see here). Interestingly, prosecutions were much higher a decade ago (the 2015/16 rate was over 650 prosecutions with a 95% conviction rate) and the decline has here been attributed to a lack of qualified inspectors, a lengthening in the duration of hearings, the coronavirus pandemic and a backlog in the criminal courts. 

Notably, in 2023, Gill Weeks (OBE), on behalf of the Department for Work and Pensions, published a report on whether the HSE was fit for purpose. The answer was overwhelmingly positive, describing the HSE as ‘a mature and well-run regulator and [that] overall, it fulfils its purpose’. Recommendations included developing an updated communication strategy, improving the website and organisational culture and improving input from external stakeholders. Yet the report largely concerned the HSE’s efficiency, spending and research. The word ‘prosecution’ does not appear at all.

In November 2025, warning bells were sounded when, following their first ever inspection of the HSE, the HM Crown Prosecution Service Inspectorate (‘HMCPSI’) published its ensuing report. The report agreed that the HSE was operating well overall but made recommendations including better guidance and training materials for prosecutors, and a more structured approach to the management and assurance of casework. These imply clear, specific, enforcement-related shortcomings. They may, in part, reveal why prosecutions have declined year-on-year.

Currently, the prosecutions cover a range of fact patterns. With the CQC competent over health and social care, the HSE’s cases largely concern other workplaces. For example, last year, the HSE secured fines of £16,000 and £6,000 of an employer and corporation in connection with an employee falling through a fragile room when installing CCTV (see here), and a £433,550 fine to a corporation after an employee was killed by a forklift that had not been subject to a full inspection (see here). However, the HSE also publish convictions against healthcare providers, including a £200,000 fine to Betsi Cadwaladr University Health Board in connection with the deaths of three elderly patients who fell in their hospitals (see here). Convictions can have the same impact on inquests and civil claims that was described in connection with the CQC, above. 

The HSE describes prosecution as ‘an essential part of enforcement, ensuring that where there has been a serious breach of the law, duty holders (including individuals) are held to account’. One can expect that it will continue to prosecute, alongside the CQC, particularly where corporate manslaughter charges are also brought, given the known complexities of that offence. 

CONCLUSION

We have sought to addressed the elements of corporate manslaughter, and the prosecution of individuals and corporations by the CQC and HSE for breaches of regulations and the HSAW 1974 in this two-part article.

We have noted that the corporate manslaughter offence is a largely unhelpful tool in the healthcare context, but also that the CQC and HSE are active in their enforcement. If that is the metric by which the organisations are judged fit for purpose, the CQC could be described as such, in particular due to its increasing readiness to prosecute NHS Trusts. However, if fitness for purpose  is judged by the CQC’s day-to-day operation, including the inspection, assessment and registration of providers, it is clearly in need of radical change. This will no doubt require an increase in resourcing, especially if the CQC is to redesign the entire regulatory process as it currently intends to.

The HSE’s fitness for purpose is, perhaps, harder to analyse. Whilst it received a glowing from the Department of Work and Pensions in 2023, sceptics may attribute that to one government department marking the homework of another, and side-stepping the question of effective prosecutions. Indeed, the year-on-year decline in HSE prosecutions, and the pointed, enforcement-related recommendations from the HMCPSI, are potentially causes for concern. They raise doubt about whether, in future, the HSE will be an effective regulator. 

As such, the story of criminal law in healthcare will continue in 2026 and beyond. The Thirlwall Inquiry is expected to publish its findings, and most importantly its recommendations for change in NHS governance and cultural practices generally as well as regulatory oversight by the CQC - and not just at the Countess of Chester Hospital where Lucy Letby’s victims were patients. The Lampard Inquiry will continue in 2026 to hear evidence from bereaved families, healthcare staff and corporate witnesses and will also inevitably make recommendations for NHS wide change in the mental health context in 2027. Similarly, investigations will continue into alleged medical negligence by surgeons at the Brighton Royal Sussex County Hospital in connection with over forty suspicious deaths between 2015 and 2021, as set out here, and the recently announced public inquiry into the Tees, Esk and Wear Valleys NHS Trust in connection with young people who took their own lives following contact with the Trust.

These inquiries and investigations are vital for uncovering malpractice, negligence and systemic failures. They may trigger prosecution, and will in any event, simulate further thinking and reporting about the use of the criminal law as a tool of enforcement in health and social care. That said, the significant financial penalties flowing from successful CQC and HSE prosecutions of individual Trusts do not necessarily result in improved practice or greater accountability as funds are inevitably diverted away from patient care and the media impact of high-profile prosecutions can do significant reputational damage. Whilst the very point of hefty fines is deterrence and punishment, what service users and bereaved families want is for the systemic failures in safety protocols, training, and oversight, highlighted by these prosecutions, to be prevented in the future.