Duty of Candour: Why NHS Transparency Laws Matter in Medical Negligence

The duty of candour is one of the most important pillars of modern healthcare in the UK. It exists to protect patients, families, and the public by ensuring healthcare organisations and professionals are open and honest when things go wrong. For those navigating a potential medical negligence claim, candour can be the difference between months of uncertainty and a clear pathway to answers, accountability, and appropriate redress. For providers and clinicians, it is both a legal obligation and a professional standard, shaping the way serious incidents are disclosed, investigated, and learned from. In 2025, candour sits under an even brighter spotlight. The Thirlwall (Lucy Letby) Inquiry is scrutinising how concerns were escalated and communicated, and NHS bodies are sharpening their governance to rebuild trust. At the same time, the mechanics of compensation have shifted with the Personal Injury Discount Rate (PIDR) now +0.5% in England and Wales, a technical change that can influence how future financial losses are valued in serious injury claims.

What is the duty of candour?

At its core, the duty of candour requires health and social care organisations and professionals to inform patients promptly, apologise meaningfully, and explain what is known when care goes wrong and causes or could cause harm or distress. In the UK there are two overlapping strands: 1. Statutory Duty of Candour (Organisations). This is set out in Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 and enforced by the Care Quality Commission (CQC). It applies to all CQC-regulated providers, including NHS trusts, GP practices, and independent sector providers. The regulation requires a clear process following notifiable safety incidents: timely notification, an apology, an explanation of what happened and what will happen next, support for the patient or family, and accurate records of all communication and actions. The CQC is explicit that saying sorry is not an admission of liability. 2. Professional Duty of Candour (Individuals). The General Medical Council (GMC), Nursing and Midwifery Council (NMC) and other regulators set out expectations for clinicians to be candid with patients and their organisations. Professionals must explain what has gone wrong, apologise, record discussions accurately, participate fully in incident reviews, and raise concerns where necessary. The GMC and NMC publish joint guidance explaining when and how to apologise, what to include, and who should lead the discussion. Together, these duties ensure accountability at both institutional and individual levels. Patients benefit from a system that recognises their right to information, while providers are incentivised to learn from harm and improve safety.

What counts as a notifiable safety incident?

A notifiable safety incident (for providers under Regulation 20) generally involves unintended or unexpected incidents that result in or could result in moderate or severe harm, prolonged psychological harm, or death. The exact thresholds and definitions are set out in CQC guidance and local policies. Correctly determining whether an incident is notifiable is important: under-reporting can breach the regulation, while over-reporting can dilute focus. In practice, trusts use internal incident grading systems and seek advice from governance teams to ensure consistent decisions aligned with national definitions.

Key elements of the statutory duty (providers)

When the criteria are met, providers must notify the patient (or family) as soon as reasonably practicable. The initial candour conversation should not wait for a completed investigation; it should share known facts and outline next steps. They must offer an apology and a written account explaining what happened, what is known so far, and what further enquiries will be made. Providers must give ongoing support, which may include advocacy services, translation, bereavement counselling, or psychological support. They must keep a written record of all communications, decisions and actions taken under the candour pathway. They must follow through with updates as new information emerges, and share outcomes and learning. CQC guidance and NHS Resolution’s “Saying Sorry” materials emphasise that apologies should be genuine, timely, and person-centred. They also reiterate that apologising does not constitute a legal admission of negligence or liability, nor does it affect indemnity cover. Failure to comply can lead to regulatory action including warnings, conditions, or even prosecution of the provider organisation.

Key elements of the professional duty (clinicians)

For clinicians, candour is not just a one-off conversation after a serious incident; it is a continuing professional obligation. The GMC/NMC guidance expects clinicians to be open and honest with patients and families about adverse events, including near misses with potential for harm. They must apologise appropriately, explaining what is known and what is being done. The tone matters: a sincere, empathetic apology that acknowledges impact can reduce distress and maintain trust. Clinicians must record discussions carefully in the clinical notes and incident systems, participate in investigations and team debriefs, share learning, and avoid defensive practices that obstruct transparency. They must also speak up if a colleague or the organisation is not meeting candour requirements, using protected channels where necessary. These expectations aim to embed a safety culture where learning is more important than blame, and where transparency is the norm.

Why candour matters in medical negligence claims

For claimants, genuine candour can transform the experience of an otherwise traumatic process. Facts surface sooner, allowing patients to understand what happened and make informed choices about ongoing care. Trust is preserved because even after serious error, a candid approach can support healing and reduce the adversarial tone that often follows a denial or delay. Legal issues narrow because clear, timely information allows lawyers and experts to focus on whether there was a breach of duty, whether this caused harm, and what losses flow from it rather than expending months reconstructing events due to incomplete records. Costs and time can reduce because transparent disclosure, robust records, and well-run investigations can promote early resolution and proportionate litigation. Academic and policy literature often distinguishes statutory candour from professional candour. Both layers contribute to learning cultures that prevent recurrence and improve patient safety.

Common pitfalls in candour and how to avoid them

Despite clear frameworks, providers and clinicians can slip into practices that undermine candour. Waiting for the complete picture is a common error; candour requires early communication. Providers should share what is known now, explain uncertainties, and commit to updates. Over-legalising the conversation can also harm trust. Patients need clarity and compassion, not guarded language. Involve legal teams for process assurance, but keep patient conversations empathetic and plain-English. Documentation gaps are another pitfall. Poor or inconsistent records can derail both investigations and claims. Keep contemporaneous notes of what was said, by whom, and when. Treating apology as risk is damaging. The CQC and NHS Resolution both stress that apology is not an admission and will not void indemnity. Avoidance or euphemism damages trust. Failure to demonstrate learning is also common. Patients often ask: “What has changed?” Publicising improvements such as updated protocols, training, or equipment signals genuine accountability.

Accessing your medical records: legal rights

Transparency is inseparable from access to records. Under the UK GDPR and Data Protection Act 2018, you have the right to make a Subject Access Request (SAR) for your personal data, including medical records. Organisations must respond without undue delay and within one month. They may extend by up to two months if the request is complex or numerous. Requests are normally free of charge unless they are manifestly unfounded or excessive. The one-month clock starts when the organisation has enough information to identify you and understand your request. The Information Commissioner’s Office (ICO) provides plain-English guidance on time limits, scope, and what to expect after you submit a SAR. The House of Commons Library clarifies that UK healthcare records are not centralised; you must contact each provider such as your GP practice, hospital trust, dentist, optician, or private clinic that holds records relating to your care.

Practical steps: how to make an effective SAR

Address the right person by writing to the Data Protection Officer (DPO) or Information Governance team of each relevant provider. State your request clearly by saying you are making a Subject Access Request under the UK GDPR, and set out the timeframe, departments, clinicians, and any specific documents you want. Include proof of identity and authority if you are requesting on behalf of someone else. Ask for a complete set of records, not just the summary. This may include full clinical notes including contemporaneous handwritten entries, test results, imaging and reports, medication charts and care plans, incident reports and DATIX entries, Root Cause Analyses, complaints files, and correspondence mentioning your case. Keep a timeline of what you requested, when, and any responses. NHS England guidance confirms that SARs can be made verbally or in writing, to any part of the organisation, and that there is no special form required.

Limits, safeguarding and exemptions

In limited circumstances, providers may lawfully restrict or redact information, for example to protect the privacy of third parties identified in the records or to avoid a serious risk of harm to the physical or mental health of any individual. If you believe an exemption has been misapplied or the deadline missed, first complain to the provider and request an internal review. If unresolved, you may escalate to the ICO, which can investigate and issue enforcement action where appropriate.

What does good candour look like in practice?

Excellence in candour has recognisable features. It includes timely, face-to-face discussion led by a senior clinician who is informed, empathetic, and accountable. It involves a clear apology that acknowledges impact and avoids euphemism or conditional language. It requires plain-English explanations of what is known, what remains uncertain, and the investigation plan. There should be written follow-up summarising facts, next steps, points of contact, and support options. Families should be offered advocacy, interpreters, mental health support, and sign-posting to independent advice. Organisations should demonstrate visible learning with concrete changes communicated to patients, staff, and the public. Many NHS trusts align their policies with CQC guidance and NHS Resolution’s “Saying Sorry” resources to build confidence that candour is more than a tick-box exercise.

How candour and the Thirlwall Inquiry intersect

The Thirlwall Inquiry is examining how concerns were raised, escalated, and handled at the Countess of Chester Hospital. An official May 2025 update indicated warning letters would begin in September 2025, with the final report completed by November 2025 and publication after copy-editing in early 2026. For families and clinicians, the Inquiry reinforces the need for speaking up, investigation quality, and transparent communication with patients and relatives. Its recommendations are expected to influence local governance frameworks, board oversight of candour metrics, and training on responding to serious incidents. From a litigation perspective, Inquiry materials often help claimants articulate systemic negligence such as failures in escalation pathways or incident response, not just individual clinical errors. That in turn can shape disclosure requests in civil claims and the focus of expert evidence.

Candour and compensation: where it fits

Candour itself does not determine whether compensation is payable, nor the amount. Courts still decide cases on the familiar tests of breach of duty, causation, and damage. However, candid handling of incidents can influence the trajectory of a claim. Earlier investigations can support better clinical outcomes and may reduce long-term losses. Complete records and timely disclosure can streamline litigation, lowering costs and shortening timescales. Poor candour such as delayed or incomplete disclosure can lead to adverse inferences and increase distress, sometimes inflating non-financial losses due to prolonged uncertainty.

2025 update: the PIDR link

For serious and catastrophic injury cases where negligence is established, the PIDR matters because it affects how future pecuniary losses like lifelong care, therapies, and loss of earnings are capitalised into a lump sum. Following the 2024 review, the Lord Chancellor set the England & Wales rate at +0.5%, effective 11 January 2025. In practice, claimant teams pair facts uncovered through candour and investigation with updated Ogden multipliers to model future loss. Periodical Payment Orders (PPOs) remain a key alternative for life-long needs, providing index-linked annual payments rather than a discounted lump sum.

For patients and families: a practical action plan

Ask whether Regulation 20 has been triggered. If you believe a notifiable safety incident occurred, request confirmation that the provider has started the formal candour process and ask for the named contact leading it. Make a SAR early to secure the full clinical picture: records, imaging, test results, incident reports, and complaints files. Clarify the time period and departments involved. Keep your own record by maintaining a diary of conversations, apologies, assurances, and timelines. Seek specialist advice. Medical negligence especially neonatal, obstetric, or catastrophic injury requires experienced legal teams and appropriate medical experts. Consider early resolution or mediation. Where providers are candid and proactive, non-adversarial routes can resolve issues faster and with less emotional cost.

For providers: a practical compliance checklist

Policy refresh is essential. Ensure your duty of candour policy reflects the latest CQC guidance including definitions, thresholds, and documentation expectations. Training should use real-world scenarios to build confidence in difficult conversations, focusing on empathy, plain English, and inclusive practice. Documentation discipline is vital. Log who informed the patient, when, what was said, and what support was offered. Align incident and complaints processes so nothing falls through gaps. Board-level assurance is required. Report candour metrics such as timeliness, quality of letters, and patient feedback to Quality Committees and Boards, and demonstrate learning with published changes. Create a culture of saying sorry. Normalise apology as a safety behaviour. Circulate NHS Resolution’s guidance and reinforce that indemnity is not affected by saying sorry. Support staff through psychological safety, debriefs, and pastoral care to encourage openness.

Frequently asked questions

Is an apology an admission of liability? No. The CQC and NHS Resolution are clear that apologising is not an admission of liability, and it does not void indemnity coverage. It is a legal and ethical expectation under the duty of candour and good professional practice.
Do I have to wait for the final investigation report before I’m told anything? No. Candour requires timely disclosure of the facts known at the time, with updates to follow as investigations progress. Waiting for a final report can breach the spirit and sometimes the letter of Regulation 20.
How long does a Subject Access Request take? Organisations must respond within one month, with limited scope to extend by up to two months for complex requests. The one-month clock starts once they have the information needed to identify you and understand the request.
If I’m bringing a claim, does the duty of candour help me? Candour doesn’t decide liability, but it often accelerates access to facts, narrows legal issues, and supports proportionate resolution benefiting both claimants and providers.
What changed in 2025 that might affect compensation? The PIDR in England & Wales is +0.5% from 11 January 2025, affecting the valuation of future losses in lump sums. Large cases may also consider PPOs for long-term security.
How does the Thirlwall Inquiry relate to candour? The Inquiry’s focus on escalation and transparency is expected to strengthen governance, training, and board oversight of candour nationwide, with a final report due to be published in early 2026 following the 2025 completion phase.
What can I do if my SAR is delayed or incomplete? Complain to the provider’s Data Protection Officer and request an internal review. If unresolved, escalate to the Information Commissioner’s Office (ICO), which can investigate and take enforcement action.

Bottom line

The duty of candour is more than a regulatory requirement; it is a practical expression of respect, honesty, and safety in healthcare. For patients and families, it guarantees the right to an explanation, an apology, and access to information. For providers, it is the backbone of learning from harm and sustaining public trust. In 2025, amid heightened scrutiny from the Thirlwall Inquiry and with compensation rules evolving under the PIDR +0.5%, embedding genuine candour is both a legal obligation and a moral imperative.

Request Free Consultation