For years, CQC inspection meant a scheduled visit, a report, and a rating that stood until the next one. The Single Assessment Framework changes that rhythm. Instead of a single snapshot, CQC now builds a live picture from ongoing evidence — and for digital clinics offering remote consultations or prescribing, that picture is assembled from records most operators weren't previously keeping in a structured, retrievable form.
What the Single Assessment Framework actually changed
CQC's previous approach relied on periodic comprehensive or focused inspections, each producing a narrative report and an overall rating of Outstanding, Good, Requires Improvement, or Inadequate. The Single Assessment Framework keeps those same four rating categories and the same five key questions — Safe, Effective, Caring, Responsive, Well-led — but breaks each one down into a longer list of specific quality statements, each assessed and scored individually before being aggregated back up.
The practical shift is from periodic to continuous. Rather than gearing up for a scheduled visit, providers are expected to hold evidence that stands up whenever CQC chooses to look — which for a digital clinic operating year-round, with patients onboarding and prescribing decisions made daily, is a meaningfully different operating posture than preparing a file ahead of a known inspection date.
Who this actually applies to in telehealth
Not every business in the UK telehealth chain sits under CQC. Registration turns on whether a service carries out a CQC-regulated activity — most relevantly for this sector, the treatment of disease, disorder or injury, or diagnostic and screening procedures, delivered directly to patients. A pharmacy that only dispenses against a prescription written elsewhere is typically a GPhC matter, not a CQC one; a service that consults, diagnoses and prescribes remotely usually does need to register.
That distinction matters because the compliance stack differs. A CQC-registered digital clinic needs a registered manager, defined governance arrangements, and now SAF-ready evidence, on top of everything the superintendent pharmacist already owns for the dispensing side. See our breakdown of what each regulator actually does, and the separate walk-through of CQC registration itself if you haven't registered yet — this piece assumes you're already registered and focuses on staying compliant under SAF.
Quality statements and the evidence categories behind them
Each key question is now assessed through a set of quality statements — precise expectations about what good care looks like — rather than a single broad judgement. Under Safe, for example, assessors look separately at safeguarding, learning from incidents, environmental safety and staffing, rather than folding all of it into one paragraph of narrative.
CQC groups the evidence it draws on into a small number of categories: people's experiences, feedback from staff and leaders, observation of how a service actually operates, and process and outcome data. For a remote-only clinic, "observation" looks different to a bricks-and-mortar surgery — it's more likely to mean reviewing consultation records, triage pathways and how safety-netting advice is actually given, than a physical walkthrough.
Under the Single Assessment Framework, CQC assesses continuously against evidence you should already be holding — the shift for most digital clinics is less about clinical practice and more about whether that practice is documented in a form an assessor can actually review.
Building an evidence trail that survives continuous assessment
The operators who find SAF straightforward are usually the ones who already run tight clinical SOPs — documented processes for prescribing decisions, escalation and audit, rather than practices that live in one clinician's head. That documentation is exactly what an assessor asks to see first.
Four things worth having in permanent, retrievable form:
- A live safeguarding log, not just a policy document, showing referrals made and outcomes tracked
- Complaint records with resolution timelines, not just totals
- Evidence of clinical governance meetings — minutes, actions, and whether actions were closed out
- Patient feedback mechanisms that feed back into service changes, not just satisfaction scores collected and filed
Where digital clinics actually get caught out
The most common gap isn't clinical quality — it's evidencing quality that's genuinely there. A clinic with good safeguarding practice but no structured log looks, on paper, worse than one with mediocre practice and a tidy spreadsheet. Assessors work from what's documented, not what a founder can describe verbally.
The second gap is governance separation. In a small digital clinic, the same person can end up acting as registered manager, clinical lead and de facto complaints officer, with no independent oversight of their own decisions. Under SAF's Well-led statements, that concentration of roles is exactly the kind of structural risk assessors are trained to probe, regardless of how competent the individual is.
An assessor can only score what's written down. Good practice that lives in someone's head reads, on paper, exactly like practice that doesn't exist.
Making continuous assessment a routine, not a scramble
Treat SAF evidence-gathering as a standing operational task with an owner, not a project that spins up before a visit. A short recurring review — are the safeguarding log, complaints record and governance minutes actually up to date this month — catches the gaps CQC would otherwise find first.
It's also worth mapping your existing records against the five key questions before CQC does it for you. Most digital clinics already generate the underlying data through their consultation, prescribing and dispensing systems; the work is usually in making it retrievable and attributable, not in creating it from nothing.
Where PExpo's regulated layer fits in
None of this changes because a clinic dispenses through a partner rather than an in-house pharmacy — a CQC-registered service is still the CQC-registered service, evidence obligations included. What changes is how much of the underlying record-keeping you have to build yourself. PExpo's dispensing infrastructure already generates structured audit trails — batch and dispatch records, prescription-to-dispatch timestamps, returns and recall handling — that plug directly into the process evidence a SAF assessment asks for.
That doesn't remove the need for your own clinical governance, safeguarding log or complaints process — those stay yours to run. But it does mean the dispensing side of the evidence trail arrives already structured, rather than being reconstructed from scratch when an assessment notice lands. If you're tightening your evidence base ahead of an assessment, our clinic team can walk through where the platform's records line up with SAF's evidence categories.
Under the Single Assessment Framework, CQC compliance for a digital clinic is less an event to prepare for and more a standing operational habit — safeguarding logged as it happens, complaints tracked to resolution, governance minuted and actioned. Pair that with a clear safeguarding process, a working complaints playbook, and disciplined records retention, and most of the evidence an assessment asks for already exists — it just needs to be retrievable.
Frequently asked questions
Does every UK digital clinic need CQC registration under the Single Assessment Framework?
No — registration turns on whether the service carries out a CQC-regulated activity, most commonly treating or diagnosing patients directly. A pharmacy dispensing against prescriptions written elsewhere typically sits under GPhC rather than CQC. Services that consult, diagnose and prescribe remotely usually do need to register, and SAF then governs how they're assessed once registered.
How is the Single Assessment Framework different from CQC's old ratings system?
The four overall rating categories — Outstanding, Good, Requires Improvement, Inadequate — haven't changed, and neither have the five key questions. What's changed is the mechanics: each key question is now broken into individual quality statements scored against defined evidence categories, with assessment treated as an ongoing process rather than a single scheduled inspection.
How often does CQC reassess a digital clinic under SAF?
There's no fixed universal cycle — CQC can review evidence for a specific quality statement at any point, rather than waiting for a full comprehensive inspection. In practice, that means providers should treat their evidence base as always current rather than something refreshed shortly before a known visit.
