Most UK telehealth compliance effort goes on getting registered and staying inspection-ready. Duty of candour sits quietly underneath both, and it is one of the few CQC requirements that is triggered by a single incident rather than an ongoing standard. Get the mechanics wrong (miss the notification window, skip the apology, fail to keep a record) and the failure to be candid becomes its own regulatory breach, separate from whatever went wrong clinically.
What duty of candour actually is
There are two versions running in parallel. The statutory duty of candour is Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, enforced by the CQC. It applies at organisational level to every CQC-registered provider, which for most telehealth operators means the registered digital clinic or the dispensing pharmacy, not the parent company.
The professional duty of candour runs alongside it. GPhC standard 6.6 requires individual pharmacy professionals to be open and honest when something goes wrong, and the GMC and NMC hold prescribers and nurses to equivalent expectations. A service can satisfy one and still fall short on the other, so both need a home in your SOPs, not just one.
When it is triggered: the notifiable safety incident test
The organisational duty applies specifically to a 'notifiable safety incident', which CQC guidance defines as an unintended or unexpected incident that occurred during care or treatment and that, in the reasonable opinion of a healthcare professional, could result in, or already appears to have resulted in, death, or severe or moderate harm, or prolonged psychological harm to the patient.
Moderate harm is the threshold most telehealth operators underestimate: it covers things like an incorrect dispensing that required a further intervention to correct, not only the more obvious severe-harm or fatality cases. A near miss that caused no harm at all sits outside the statutory duty, though most operators log it anyway under their own incident-reporting policy.
What 'being open' actually involves
- Tell the patient (or their representative) that the notifiable incident happened, in person or by phone where practical, as soon as reasonably possible after you become aware of it.
- Give a truthful account of what is known at that point, including what further enquiries will follow.
- Apologise, in the specific legal sense of expressing sorrow or regret for what happened, which is not an admission of liability.
- Follow the initial conversation with a written notification, and keep a copy of that letter.
- Offer reasonable support to the patient, which might include signposting to further clinical review.
- Keep a complete written record of the incident, the notification, and every step taken.
None of this waits for a root cause analysis to finish. The notification duty starts running as soon as the incident meets the threshold, well before you necessarily know why it happened.
Duty of candour is triggered by the incident, not by a completed investigation. Notify, apologise and record first; the root cause analysis can (and usually does) continue afterwards.
Why remote services find this harder
A face-to-face pharmacy can walk a patient through what happened at the counter. A telehealth service usually cannot, and 'in person or by phone where practical' becomes a genuine operational decision rather than a formality. Build a default channel (phone first, written follow-up always) into your SOP rather than leaving frontline staff to improvise mid-incident.
The split supply chain adds a second complication. A dispensing error, a prescribing error and a courier failure can each trigger the duty, but they usually sit with different registered entities: the dispensing pharmacy, the prescribing service, the logistics partner. Your complaint-handling playbook should already map who owns which failure mode; duty of candour needs the same map, because the CQC-registered entity closest to the incident is the one legally required to notify, not whichever party the patient happens to contact first.
Building it into your SOPs
Duty of candour works best as an extension of the incident-reporting process you already run for pharmacovigilance and adverse events, not a separate parallel system. A workable structure has four parts: a severity-grading step applied to every logged incident, a clear trigger point at which grading crosses into 'notifiable', a named role (typically the superintendent pharmacist or registered manager) accountable for authorising the notification, and a template letter that staff can adapt quickly rather than draft from scratch under pressure.
- Log every incident centrally, including near misses, so grading has a consistent baseline.
- Grade for harm severity at first triage, then re-grade once more facts are known.
- Set a maximum internal escalation time (many operators use one working day) from grading to notification decision.
- Record the notification conversation itself, not just the fact that one happened.
- Review closed incidents at a fixed interval to confirm the letter, apology and support step all actually landed.
The apology is a legal step, not an admission of liability, and treating it as the latter is the single most common reason services delay it past the point where it still counts as candid.
How it overlaps with other reporting duties
A single incident can trigger several obligations at once, and treating them as one workflow with several outputs avoids duplicated (or contradictory) records. A dispensing error involving an adverse reaction may need a Yellow Card report to the MHRA, a duty of candour notification to the patient, and a note in the file the CQC will expect to see referenced at your next inspection under the Single Assessment Framework.
Where a patient under 18 or a vulnerable adult is involved, safeguarding reporting runs in parallel too. None of these substitute for one another: MHRA notification is about the product and the wider patient population, duty of candour is about that specific patient, and safeguarding is about protecting that individual going forward. Your clinical SOPs should route an incident through all the relevant checks rather than assuming one report covers the rest.
Where PExpo fits
Duty of candour is non-delegable: it sits with the CQC-registered provider and cannot be outsourced to an infrastructure partner. What PExpo's dispensing and operations layer supports is the evidence trail underneath it, order and dispatch records, batch and courier data, and a consistent audit history that a registered manager can pull quickly when grading an incident and drafting the notification. For brands and clinics building this out for the first time, having that record already structured is the difference between a same-day notification and a delayed one.
Duty of candour rewards a service that already has clean incident logging and a clear ownership map across its supply chain. If those exist, adding the notification and apology step is mechanical. If they do not, this is usually the moment operators discover it. See our guides on CQC registration for UK telehealth services and how PExpo supports registered clinics for the wider compliance picture.
Frequently asked questions
Is duty of candour a legal requirement or a professional one?
Both, and they run in parallel. The organisational duty under Regulation 20 is a legal requirement enforced by the CQC against the registered provider. The professional duty, set out in GPhC standard 6.6 and equivalent GMC and NMC guidance, applies to the individual pharmacist, prescriber or nurse personally. Meeting one does not automatically satisfy the other.
Does duty of candour apply to a white-label brand as well as its dispensing pharmacy?
The statutory duty attaches to whichever entity is CQC-registered for the activity where the incident occurred, typically the dispensing pharmacy or the registered clinical service, not the consumer-facing brand itself. In practice, brands and their infrastructure partners should agree in advance which party notifies the patient for each type of failure, since the patient will not know or care about the underlying corporate structure.
What happens if a provider fails to comply with duty of candour?
Failing to notify, apologise or keep the required records is a breach of Regulation 20 in its own right, separate from whatever caused the original incident, and the CQC can take enforcement action for that failure alone, including a fixed-penalty notice or prosecution in serious cases. It also tends to surface at the next inspection, where evidence of candour (or its absence) feeds directly into the provider's rating.
