From 1 April 2018 a new 'duty of candour' will be brought into force in relation to organisations providing health and social care. 

The duty was introduced by the Health (Tobacco, Nicotine etc. and Care) (Scotland) Act 2016 ("the 2016 Act"), and comes into force later this year as a result of regulations made by the Scottish Government.

What is the duty of candour?

The 2016 Act creates a legal duty on health and social care organisations to inform patients, or their carers/families, when they have been harmed as a result of their care or treatment. The duty applies where there has been an unexpected or unintended incident in providing a health, care or social work service that, in the opinion of an independent health professional, has or may result in death or harm to the person receiving care or treatment.

What constitutes 'harm' includes:

  • A permanent lessening of physical and mental functions (including removal of the wrong limb or organ, or brain damage) - defined as 'severe harm';
  • Shortening of life expectancy;
  • An increase in the person's treatment;
  • Changes to the structure of the person's body;
  • Impairment of sensory, motor or intellectual functions, or pain or psychological harm, lasting continuously for at least 28 days;
  • Treatment required in order to prevent death or any of the above outcomes.
  • The harm must have been caused as a direct result of the incident rather than as a result of the person's underlying condition or illness taking its natural course.

Who exercises the duty of candour?

The 2016 Act states that it is the 'responsible person' who carries out the duty of candour and acts in accordance with the procedure set down by the 2016 Act and the Duty of Candour Procedure (Scotland) Regulations 2018 ("the 2018 Regulations"). The 'responsible person' is the organisation responsible for delivering the health, social care or social work service to the person, and may include local authorities, health boards, care homes, and private health and care providers. In general the responsible person is not an individual, except where an individual provides a care service and employs or contracts other persons to assist with the provision of the care service. We refer to the responsible person below as the service provider.

What must be done under the duty?

When the duty of candour applies, the service provider must notify the 'relevant person' about the incident. The 'relevant person' will usually be the person who has received the service. However, where the person has died or is lacking in capacity, the 'relevant person' becomes someone acting on behalf of the patient (usually a carer or family member).

The notification kick-starts the duty of candour process, and must include a description of the incident, and an explanation of the actions the service provider will take as part of the duty of candour procedure (as set out below). If the notification comes more than a month after the date of the incident, the reason for the delay must be set out.

As part of the duty of candour procedure, the relevant person must be given the opportunity to attend a meeting with the service provider. The 2018 Regulations, which come into force on 1 April 2018, set out what must be covered in this meeting. The meeting must include:

  • An account of the incident;
  • An explanation of further steps to be taken in investigating the circumstances leading or contributing to the incident;
  • An opportunity for the relevant person to ask the service provider about the incident and to express their views on the same;
  • Information about any legal or review procedures, separately to the duty of candour procedure, being carried out by the service provider in relation to the incident.

It is mandatory in terms of the regulations for these matters to be included in the meeting. If the relevant person refuses or is unable to attend the meeting, then he can request information as to the incident, the investigation into the incident and any legal/review procedures. If a request is made then the service provider must provide that information.

As well as a meeting, the service provider is obliged to carry out of a review of the circumstances leading or contributing to the incident. This should be completed within three months of the date of notification. While the review must examine the incident in question, its primary purpose is to improve the quality of the service provided by the responsible person. Therefore, the report of any review must include a statement of actions to be taken by the service provider with the aim of improving the quality of service provided, and sharing learning points with other organisations to "support continuous improvement in the quality of health, care or social work services." The report of the review must detail the manner in which it was carried out and the actions taken in accordance with the duty of candour procedure.

The views of the relevant person must be canvassed when carrying out the review. In addition the service provider is obliged to offer to send a copy of the report of the review to the relevant person. Alongside the report, it must also be able to provide information regarding the further actions to be taken for improvement in the quality of service and details of support available to the relevant person.

The service provider is also obliged to offer a written apology to the relevant person. This is in addition to any apology which may have been made at the time of the incident.

Finally, the service provider is required to provide training to its employees on the duty of candour procedure, and support to any employees involved in the incident.

What has changed?

Many health and social care professionals are already subject to a duty of candour as part of their professional practice requirements. These are personal rather than organisational duties. The statutory duty of candour does not affect these professional practice obligations. However, the 2016 Act and 2018 Regulations impose a statutory duty on service providers to provide information about the incident to relevant persons. Just as importantly, the 2018 Regulations require that service providers consider any steps that can be taken to improve the quality of their services, and to set out the actions they propose to take to those affected by the incident. The impetus underpinning t this legislative requirement is the role of transparency in promoting the improvement of service quality.

Service providers should bear in mind that statutory timescales apply to the duty of candour process - specifically, notification of the incident within one month and a review to be completed within a further three months - breaches of which will require to be explained to the relevant person. In addition, service providers are under an obligation to keep a written record of each incident and the subsequent duty of candour procedure. Given the statutory requirements to hold a review and in relation to record keeping, it is ever more important that service providers have robust data retention and security policies and procedures in place to ensure compliance.


Douglas Waddell

Senior Associate