Most UK digital clinics treat CQC registration as a one-off hurdle and inspection as the thing to prepare for every few years. Notifications sit in between, quieter but just as binding: a running statutory duty to tell the regulator, as events happen, about a defined list of incidents and changes. Get the categories, the timescale or the ownership wrong, and it shows up at the next inspection as a governance gap, not a one-off slip.
Notifications are a different duty to registration and inspection
CQC registration and CQC inspection both get attention in telehealth compliance conversations. Notifications get less, but the legal basis is the same: the Health and Social Care Act 2008 and the CQC (Registration) Regulations 2009 place an ongoing duty on every registered provider, not a one-time or periodic one. The duty sits with the registered provider and, in practice, is usually carried out day to day by the registered manager.
That distinction matters operationally. A clinic can hold a current CQC registration, as covered in our guide to CQC registration for digital clinics, and still fall short on notifications, because the duty is triggered by events, not by a renewal date. Inspectors check for a working notification process as part of how they assess governance, not as a separate tick-box.
The events a digital clinic must notify CQC about
The CQC (Registration) Regulations 2009 define a specific set of notifiable events. They are narrower than 'anything that went wrong', which is where clinics most often misjudge the duty.
- Death of a service user connected to the care or treatment the clinic provided
- Serious injury to a service user arising from the service
- Abuse, or suspected abuse, of a service user
- An outbreak of a notifiable infectious disease affecting the service
- An incident reported to, or investigated by, the police where it relates to the service
For a digital clinic without physical premises where patients attend, these categories still apply wherever the treatment or advice given by the service is a contributing factor. It is the regulated activity, not the building, that brings the duty into play.
Notifying changes to your registration, not just incidents
A second, separate duty covers changes to what CQC already holds on file about the provider. This is about the accuracy of the register, not about something going wrong clinically.
Typical triggers include a change of registered manager, a change to the services the clinic is registered to provide, or a change to the provider's legal structure. The CQC Provider Portal is where most of these changes get submitted, and the Single Assessment Framework treats an out-of-date register entry as a signal that governance more broadly may be loose.
CQC can treat a missed or late notification as a breach of registration in its own right, separate from and in addition to whatever caused the underlying incident.
How and when to submit a notification
CQC's expectation for the serious incident categories, death, serious injury, abuse, is notification without delay: as soon as the provider becomes aware, not after an internal investigation has run its course. Change-of-detail notifications generally carry a working-day timescale rather than an immediate one, but still a defined one.
In practice, one named person should own the decision to notify and the submission itself, most often the registered manager, working alongside the clinic's superintendent pharmacist where a clinical and dispensing judgement overlaps. Leaving the decision to whoever happens to be on shift when an incident occurs is a common way notifications slip.
Where digital clinics get this wrong
The same handful of mistakes show up across most CQC inspection findings on notifications.
- Treating notification as optional admin rather than a statutory duty
- Confusing an internal incident report with the external statutory notification
- Waiting for an internal investigation to conclude before notifying
- Not keeping a record of what was submitted, when, and by whom
- Assuming a dispensing or clinical partner's own notifications cover the clinic's separate duty
That last point catches brand and clinic operators working through a white-label or partner model particularly often: a dispensing partner's regulatory obligations under GPhC do not substitute for the clinic's own CQC notification duty, because the two regulators and the two duties are not the same thing.
A CQC notification is not a confession. It is a record that the provider noticed, and said so, before anyone had to ask.
Building a notification process that holds up at inspection
A notification process that survives an inspection has three parts: a clear definition of what counts as notifiable, taken directly from the regulations rather than reinterpreted locally, a named owner with a deputy, and a log that shows the date of the event, the date of submission, and the outcome.
It is worth separating this explicitly from two adjacent duties that get blended together in practice: duty of candour, which is about what the clinic tells the patient, and LFPSE patient safety incident reporting, which feeds national learning rather than the provider's own registration. A single incident can trigger all three, and each has its own form, its own timescale and its own audience.
Where a dispensing partner fits, and where it doesn't
PExpo's role sits in the dispensing and fulfilment layer: clean audit trails on what was dispensed, when, and against which prescription, which a clinic can draw on when deciding whether an event is notifiable and when building the evidence trail behind that decision.
What a dispensing partner cannot do is discharge the clinic's own CQC registration or notification duty. That accountability sits with the registered provider named on the CQC register, whatever the operating model behind it. Clinics weighing up a dispensing partner can see how that split of responsibility typically works on our clinics page, or by talking to our team directly.
CQC notifications are a small, specific slice of a much broader compliance picture, but they are one of the few duties checked against a real paper trail rather than a policy document. Pair this with how the CQC inspection reports read your evidence and how the registration process sets the baseline, and the notification duty stops being a surprise.
Frequently asked questions
What counts as a notifiable event for a UK digital clinic registered with CQC?
The CQC (Registration) Regulations 2009 set out a defined list, including the death of a service user connected to the care provided, serious injury, abuse or suspected abuse, outbreaks of a notifiable infectious disease, and incidents involving the police. Not every adverse event qualifies; the categories are specific, not open-ended.
Who is legally responsible for submitting a CQC notification?
The duty sits with the registered provider named on the CQC register. In day-to-day practice it is usually carried out by the registered manager, though the provider remains accountable even where that task is delegated.
Is a CQC notification the same as reporting to the MHRA Yellow Card scheme?
No. They are separate duties to separate regulators. A CQC notification concerns the provider's registration and governance; an MHRA Yellow Card report concerns a suspected adverse drug reaction. A single incident can require both.
