Most digital clinic founders know CQC registration exists and that inspectors hand out ratings. Fewer can list what they are actually being assessed against day to day. The fundamental standards are the legal requirements sitting underneath every rating and every inspection: not aspirational good practice, but the floor a registered provider cannot fall below, backed by enforcement that can reach prosecution rather than just a poor report.
What the fundamental standards actually are, and where they come from
The fundamental standards sit in the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, broadly Regulations 9 to 20A. They apply to every provider registered with CQC for a regulated activity, which, as we cover in our guide to CQC registration for digital clinics, includes most services that diagnose or treat patients remotely rather than simply supplying medicines against an existing prescription.
It helps to separate them from a CQC rating. A rating judges how well a provider is doing against a scale from Outstanding to Inadequate. The fundamental standards are binary: a provider either meets them or it doesn't, and meeting them is the minimum condition of staying registered at all, regardless of how the rest of the service performs.
They were written with hospitals and care homes in mind long before digital clinics existed at any scale, so a founder reading the regulations cold will find language about premises and face-to-face care that doesn't map neatly onto a remote consultation. CQC's own guidance fills that gap, and inspectors assessing a telehealth provider interpret the same standards through a digital lens rather than applying a different, looser set of rules.
Person-centred care and consent: the two standards a remote consultation leans on hardest
Regulation 9 requires care and treatment that is tailored to the individual, with the patient involved in decisions about their own care rather than funnelled through a generic pathway. Regulation 11 requires valid, informed consent before any care or treatment is given, and documented in a way that shows it was actually obtained, not assumed.
Both get scrutinised harder in a remote setting than in a face-to-face clinic, because there is no incidental moment, a glance at body language, a pause before signing a form, for a clinician to fall back on if the consultation record itself is thin. What a digital clinic writes down at the point of consultation carries more evidential weight than it would in person.
Safe care and treatment, and safeguarding from abuse
Regulation 12, safe care and treatment, is the standard most frequently behind serious enforcement action across healthcare generally, and it is the one that turns clinical judgement into an auditable process: risk assessment, safe prescribing against clear protocols, and a governance structure that actually sits behind day-to-day decisions rather than existing only on paper.
Regulation 13 covers safeguarding from abuse and improper treatment, which for a telehealth operator usually means building a process for recognising and escalating concerns that only ever surface through a screen, with no home visit or face-to-face cue to prompt it. We go into this in more depth in our guide to safeguarding in UK telehealth.
- Written clinical protocols for each treatment pathway offered
- A documented approach to assessing red-flag presentations and knowing when to refer on
- Medicines reconciliation and allergy checks completed before dispensing
- An audit trail connecting the consultation, the prescription and the dispensing record
- An incident escalation route that feeds into pharmacovigilance reporting where relevant
The fundamental standards aren't a checklist you pass once at registration. CQC expects ongoing evidence against every one of them, and a breach of safe care and treatment or duty of candour can lead directly to enforcement action without a prior warning notice.
Complaints, and the good governance standard that ties everything together
Regulation 16 requires an effective system for receiving, investigating and responding to complaints, and for showing that the loop actually closes rather than ending with an apology email. Regulation 17, good governance, is the one that catches most digital clinics out, because it expects an evidenced management system rather than a policy folder that was written once at registration and never revisited.
In practice, this is where CQC's Single Assessment Framework does most of its work: it is the mechanism inspectors now use to gather continuous evidence that the governance standard is actually being met, not just declared. Our breakdown of the Single Assessment Framework for digital clinics covers what that evidence trail should look like in practice.
Staffing, and the fit and proper persons requirement
Regulation 18 requires sufficient numbers of suitably qualified, skilled and experienced staff deployed appropriately, which for a telehealth model usually means proving flexible clinical capacity can absorb demand spikes without compromising consultation quality, not just that headcount exists on an org chart.
Regulation 19 requires that staff employed are fit and proper for their role, and a separate fit and proper persons requirement applies to directors and the registered manager: checks on character, competence, qualifications, and in some cases a formal assessment before someone can take on that accountable role. Typical checks include a DBS check, references covering recent employment, verification of relevant qualifications, and an explanation for any unexplained gap in someone's work history.
A fundamental standard isn't a target to aim for. It's the line a registered provider is not allowed to be under, on any day CQC happens to look.
Duty of candour, and the display requirement operators forget
Regulation 20, duty of candour, requires a provider to tell a patient when something has gone wrong that meets the notifiable safety incident threshold, apologise, and keep a written record of that conversation. It is one of the standards CQC can act on directly and firmly, and it deserves its own read: see our full guide to duty of candour in UK telehealth.
Regulation 20A, less dramatic but just as binding, requires a provider's current CQC rating to be displayed at every relevant premises and on its website. It is the standard most often missed through simple neglect, an outdated footer link or a rating page nobody updated after a reinspection, rather than any deliberate failing. Our guide to CQC ratings for digital clinics sets out what the display duty actually requires.
Where a regulated dispensing partner changes the picture
A clinic running its own dispensing has to evidence the fundamental standards across the full span of the service: consultation, prescribing, dispensing and delivery. Working with a dispensing partner that holds its own GPhC registration and CQC-relevant inspection history narrows that span, because the partner carries its own accountability for safe care and treatment and governance on the dispensing side, with prescriber discretion applying throughout.
That doesn't remove the clinic's own duty of candour or its own consent and person-centred care obligations, those stay with the clinic regardless of who dispenses. What changes is the amount of evidence a clinic has to build and maintain itself for the parts of the standards that sit downstream of the prescribing decision: stock safety, dispensing accuracy, cold-chain handling and courier tracking all become the partner's documented responsibility rather than a gap the clinic has to paper over at inspection time.
PExpo's model is built around keeping that split clear, so a clinic can point an inspector to exactly who is accountable for which standard rather than discovering the gap during an inspection.
None of the fundamental standards are optional, and none of them are satisfied by a one-off policy document. They are evidenced continuously, through the same records a well-run clinic should already be keeping: consultation notes, protocols, complaint logs and incident reports. Read alongside our guides to CQC registration for digital clinics and the Single Assessment Framework, this should give a founder a realistic picture of what CQC is actually checking, and why the standards matter more than the headline rating.
Frequently asked questions
What are the CQC fundamental standards?
They are the legal minimum requirements every CQC-registered provider, including a digital clinic carrying out a regulated activity, must meet. They sit in the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 and cover areas such as person-centred care, consent, safe care and treatment, safeguarding, staffing, good governance and the duty of candour. Falling below any one of them is treated as a breach of the regulations, not simply a lower inspection score.
What happens if a digital clinic breaches a fundamental standard?
CQC can respond in several ways depending on severity: a requirement notice asking for improvement within a set timeframe, a warning notice naming the specific failing, or, for the most serious standards such as safe care and treatment or duty of candour, direct enforcement action including prosecution without a prior warning notice. The response generally reflects how much risk to patients the breach actually created.
Do the fundamental standards apply to a dispensing partner as well as the clinic?
A GPhC-registered pharmacy dispensing on a clinic's behalf is regulated separately by the GPhC for that dispensing activity, though CQC's governance standard still expects a clinic to evidence that its wider supply chain, including dispensing, is safe and properly overseen. In practice the two regulators' expectations overlap more than they conflict, which is why checking a partner's own registration and inspection history matters, prescriber discretion applies throughout.
