CQC ratings for UK digital clinics: what they mean, and what the law requires you to do

Most clinic owners register with the CQC, then forget the regulator exists until an inspector emails. But the rating that comes out the other side, not just the registration itself, is what patients, insurers and investors actually look at. Understanding how the four grades work, what moves one, and what the law requires you to do with the result matters as much as passing the assessment itself.

The four CQC ratings, and what they actually assess

The CQC uses four ratings: Outstanding, Good, Requires improvement, and Inadequate. They sit on top of the regulator's Single Assessment Framework, which groups the evidence it collects under five familiar themes: safe, effective, caring, responsive, and well-led. A digital clinic doesn't get one score for the whole service; it gets scored against the specific quality statements that apply to what it actually does, so two clinics offering different services can be assessed on a different mix of evidence even if they end up with the same overall rating.

What's changed since the old inspection model is less about the four-point scale itself, which has stayed the same for years, and more about how the regulator gets to a rating. We've covered the mechanics of the Single Assessment Framework in detail elsewhere; here, the focus is on what the rating means once it's published, and what a registered provider is required to do with it.

Which digital clinics actually get a published rating

Not every telehealth business needs its own CQC rating. Registration, and the rating that follows it, applies to providers carrying out a CQC-regulated activity, most commonly the treatment of disease, disorder or injury by a prescriber, or diagnostic and screening procedures carried out as part of a consultation. If your clinic employs or contracts the prescribers and makes the clinical decisions, you're very likely in scope. We've set out who needs to register in our guide to CQC registration for UK telehealth services.

Clinics that outsource prescribing entirely to a separately registered partner, and only handle marketing, logistics or patient support, may sit outside CQC's remit for that activity, though the dispensing side will usually carry its own GPhC registration regardless. The split matters commercially too: a brand without its own CQC rating has nothing to display, which some patients and partners will read as a gap rather than a loophole, so it's worth explaining the structure clearly rather than leaving it implicit.

The legal duty to display your rating

Once a provider is registered and rated, displaying that rating isn't optional. Regulation 20A of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires registered providers to display their current CQC rating prominently on their website and at the premises where the regulated activity takes place, in the form CQC specifies. For a digital clinic, that typically means the rating badge and a link to the full report on the homepage, not buried three clicks deep in a footer or an about page.

Getting this wrong is a compliance failure in its own right, separate from whatever the underlying rating says about the service. A clinic that quietly stops displaying a Requires improvement rating, or keeps linking to an old Good report after a downgrade, has created a second problem on top of the first. The safest approach is to treat the display requirement as part of the website release checklist, not a one-off task ticked off at registration.

What actually drives a rating up or down

A rating isn't decided by a single site visit any more. Under the current framework, CQC builds a picture from multiple evidence categories between inspections, so a clinic's rating can move on the strength of what the regulator sees day to day, not just what happens when an assessor is in the room. In practice, a handful of things carry disproportionate weight:

• How the service reports and investigates safety incidents, and whether those reports go through the right patient safety channels, including the pattern covered in our piece on CQC notifications.
• Complaint handling: whether complaints are logged, acted on, and closed out, rather than resolved informally and forgotten.
• Staffing and supervision records, particularly for prescribers working remotely across multiple sites or brands.
• How leadership responds when something goes wrong: a documented root cause review lands very differently to a defensive one-line explanation.
• Direct patient feedback, which increasingly includes online reviews the regulator can read as easily as anyone else.

None of this is about gaming a score. The quality statements are written around genuine patient safety outcomes, so the most reliable way to protect a rating is to run the service in a way that would hold up to scrutiny on any given day, not just the day an assessor happens to look.

If you get Requires Improvement or Inadequate

A Requires improvement or Inadequate rating triggers a fairly predictable sequence. CQC will usually issue a requirement notice setting out what must change and by when; for more serious findings, that escalates to a warning notice with a shorter deadline, and in the most serious cases to enforcement action that can restrict or cancel registration. None of these notices are private: they're published alongside the inspection report, which is one reason the response matters as much as the original finding.

A sensible response looks something like this:

1. Read the full report, not just the headline rating, and map every finding to a named owner inside the service.
2. Write an action plan with dates, not aspirations, and be ready to show evidence of progress, not just intent.
3. Fix the thing that actually caused the finding, rather than the symptom closest to the surface.
4. Update the website display and any partner-facing materials the moment the public rating changes, in either direction.
5. Keep a paper trail of what changed and when, because the next assessment will ask for exactly that.

A Requires improvement rating is not a one-off ticking-off. It's the regulator's evidence that something in the service's safety net has a gap, and the fix has to close that gap, not just the paperwork around it.

Why the rating matters beyond the regulator

Patients increasingly check a provider's CQC rating before booking, especially for anything beyond a one-off prescription, and a published Requires improvement sits right next to the brand on every search result and comparison site. That's before the rating reaches people a clinic doesn't see directly: professional indemnity insurers factor it into underwriting, as we've covered in our guide to insurance for UK telehealth businesses, and dispensing partners typically check it as part of onboarding due diligence.

Investors and acquirers do the same, usually earlier in a deal than founders expect. A clean rating doesn't close a funding round on its own, but a poor one, or an unexplained gap where a rating should be, is the kind of thing that turns a quick diligence call into a much longer one.

How PExpo's regulated layer supports clinics managing rating risk

PExpo isn't a substitute for a clinic's own CQC rating, and we don't claim to be. What we do is remove some of the operational risk that tends to show up in inspection findings: dispensing records, SOPs, and audit trails that are consistent across every clinic on the platform, rather than rebuilt from scratch by each one. Clinics on PExpo's clinic model inherit a dispensing layer that's already built to hold up to scrutiny, which leaves more attention for the parts of the service that are genuinely clinic-specific.

That won't fix a service with a real safety problem, and it shouldn't be treated as a shortcut around one. But for a clinic trying to keep its rating clean while it scales, a dispensing partner that doesn't introduce its own gaps is one less variable to manage.

A CQC rating is a published, legally displayed judgement on a service, not a background compliance box. If you haven't checked where your own rating sits, or how a prospective partner's compares, start with CQC's own register before you start anywhere else; our guide on how to check the CQC register walks through it. And if your rating has slipped, the fastest way back is usually the same one that got the rating there in the first place: fix the underlying service, then make sure the paperwork and the website catch up.

Frequently asked questions