Duty of Candour: When an Apology Is a Legal and Professional Responsibility

A patient receives the wrong dose of medicine and requires additional monitoring.

The incident is reported internally. The manager is informed. An investigation begins.

At the next handover, staff are told not to discuss the incident until the investigation has finished.

Meanwhile, the patient and their family know that something has changed—but nobody has clearly explained what happened.

Has the duty of candour been fulfilled?

No. Completing an incident report and beginning an investigation do not, by themselves, satisfy the obligation to be open with the person affected.

When care goes wrong, silence may feel safer to staff and organisations. Legally and professionally, it can create a second failure on top of the original incident.

Scope of this article

This article focuses primarily on health and adult social care services in England.

The statutory duty considered here is contained in Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014.

Scotland, Wales and Northern Ireland have their own statutory arrangements. Organisations operating across the UK must follow the framework applicable to the country in which the care was provided.

The professional duty discussed here applies to nurses, midwives and nursing associates registered with the Nursing and Midwifery Council.

What is the duty of candour?

Candour means being open and honest when something goes wrong with care or treatment.

There are two related but distinct duties:

DutyWho it applies toHow it is regulated
Statutory duty of candour	CQC-regulated providers and registered managers in England	Regulation 20 and CQC enforcement
Professional duty of candour	Individual regulated healthcare professionals, including nurses and nursing associates	Professional standards, including the NMC Code and candour guidance

The two duties have similar aims, but they are not interchangeable.

A nurse following their professional obligations does not automatically complete every procedural requirement placed on the registered provider. Equally, an organisation having a candour policy does not remove the individual professional’s responsibility to report concerns and help ensure that the person is told.

The statutory duty under Regulation 20

Regulation 20 requires registered persons to act openly and transparently with people receiving care or treatment.

This overarching requirement is broader than the formal procedure for a notifiable safety incident. Providers should not interpret the regulation as permission to remain silent about every incident that falls below the statutory notification threshold.

When an incident meets the legal definition of a notifiable safety incident, Regulation 20 requires a specific response.

The registered person must, as soon as reasonably practicable:

Notify the relevant person that the incident has occurred.
Provide a truthful account of the facts known at that time.
Explain what further enquiries or investigations will be undertaken.
Include an apology.
Follow the notification with the required information in writing.
Keep a secure written record of the communication.

The “relevant person” will normally be the person receiving care. In appropriate circumstances, it may be someone lawfully acting on their behalf.

What is a notifiable safety incident?

“Notifiable safety incident” is a defined legal term. It does not simply mean every mistake, complaint, accident, near miss or unexpected clinical outcome.

Broadly, the incident must:

Arise during the provision of a CQC-regulated activity.
Involve something unintended or unexpected in the care or treatment.
In the reasonable opinion of a healthcare professional, have caused—or be capable of causing—the level of harm specified in the regulation.

The detailed harm criteria differ between health service bodies and other registered providers. They may include death, specified forms of severe or prolonged harm, or moderate harm, depending on the provider category and circumstances.

Staff should therefore use the organisation’s current Regulation 20 procedure and obtain appropriate clinical or governance advice. They should not decide that the duty does—or does not—apply merely by looking at the incident category selected on an electronic reporting form.

Three points are commonly misunderstood

First: an undesirable outcome is not automatically a notifiable safety incident.

A person may deteriorate because of the natural progression of illness despite appropriate care. That outcome may be serious, but the statutory definition still needs to be applied.

Second: a recognised complication is not automatically excluded.

If something unintended or unexpected occurred during the delivery of care, the fact that harm is a recognised possible complication does not automatically remove the duty.

Third: falling below the statutory threshold does not justify concealment.

The professional duty, ordinary communication responsibilities, complaint-handling requirements and the general expectation of openness may still apply.

The professional duty of candour

The professional duty applies to individual health and care professionals.

The NMC’s candour guidance states that professionals must be open and honest when something goes wrong with treatment or care and causes, or has the potential to cause, harm or distress.

This means professionals must help ensure that the person—or, where appropriate, their advocate, carer or family—is:

Told what went wrong.
Given an apology.
Offered an appropriate remedy or support where possible.
Given an explanation of the known short- and long-term effects.

Professionals must also be open with colleagues, employers, investigators and regulators. They must report adverse incidents, cooperate with reviews and avoid preventing other people from raising concerns.

Not every nurse involved must separately conduct the formal disclosure conversation. In multidisciplinary care, an appropriate person—often the accountable clinician, senior nurse or designated manager—may lead it.

However, each professional should ensure that responsibility has been clearly allocated. Assuming that “someone else will tell them” is not a defensible system.

Saying sorry is not an admission of liability

One of the most damaging misconceptions is that staff should avoid apologising because it could be treated as admitting negligence.

An appropriate apology acknowledges that something went wrong and expresses sorrow or regret for the harm or distress caused. It does not, by itself, establish legal liability.

The CQC and NHS Resolution are explicit that saying sorry is not an admission of liability.

A useful apology should be personal and meaningful. It should address:

What is known to have happened.
What is being done to manage the consequences.
What remains uncertain.
What will be investigated.
What support is available.
How the person will receive further information.

Compare the following statements:

Weak and defensive:

“We are sorry you feel that the care was inadequate.”

This shifts attention to the person’s feelings and does not acknowledge what happened.

Premature and speculative:

“I am sorry. It was entirely my colleague’s fault.”

This assigns blame before the facts have been established.

Appropriate:

“I am sorry that you received the wrong dose of medicine. We have assessed you and arranged additional monitoring. We are investigating how this happened and will update you when we know more.”

This acknowledges the known facts without inventing conclusions.

Do not wait for the investigation to finish

Staff sometimes believe that nothing should be disclosed until the investigation produces a final report.

That is wrong.

The person should be informed as soon as reasonably practicable. Staff must explain:

What is currently known.
What has not yet been established.
What immediate action has been taken.
What further enquiries will occur.
When and how an update will be provided.

Openness does not require guessing. If the cause is uncertain, say that it is uncertain.

Candour is an ongoing process rather than a single conversation. Further information may need to be provided as the investigation develops.

An illustrative medication incident

Mr Ali is prescribed 2.5 mg of a medicine. A 5 mg dose is administered in error.

The nurse recognises the error, assesses Mr Ali, informs the responsible clinician and follows the medication-incident procedure. Additional monitoring is arranged.

The unsafe response

The nurse completes the electronic incident report. A manager says:

“Do not tell the family until we know who is responsible.”

The clinical records state only that observations were increased. Mr Ali is not told that he received the wrong dose.

This response creates several problems:

Internal reporting has been treated as a substitute for openness.
The person has not been told what happened.
The additional monitoring has not been properly explained.
Disclosure has been delayed to protect the investigation rather than the patient.
The records do not provide a transparent account.
No one has been clearly allocated responsibility for the candour conversation.

A safer response

Immediate clinical risks are managed first.

The incident is escalated through the organisation’s clinical, medication and governance procedures. A responsible professional is identified to speak with Mr Ali promptly.

Mr Ali is told what is known, what action has been taken and what remains under investigation. A sincere apology is offered.

The conversation, his questions and the support provided are recorded. The organisation determines whether the incident meets the statutory definition and completes the required written notification and follow-up where applicable.

The investigation then continues. Mr Ali receives updates as further facts become available.

What nurses should do when something goes wrong

1. Protect the person first

Candour does not replace emergency or clinical action.

Assess the person, reduce continuing risk, obtain help and arrange necessary treatment or monitoring. Do not delay urgent care while determining whether the formal statutory threshold is met.

2. Report the incident promptly

Use the organisation’s incident-reporting and escalation systems.

Report facts rather than minimising the event or speculating about blame. Include the immediate clinical consequences and actions taken.

3. Escalate possible candour requirements

Notify the appropriate senior nurse, clinician, registered manager, patient-safety team or governance lead according to local procedure.

Do not assume that selecting a severity rating on an incident form automatically completes the legal assessment.

4. Establish who will communicate with the person

Clarify:

Who will lead the initial conversation.
When it will happen.
Who will provide support.
Who will issue any required written notification.
Who will communicate investigation findings.
Who will remain the person’s contact.

If nobody has accepted responsibility, escalate again.

5. Be honest about what is known

Do not conceal confirmed facts, but do not present assumptions as established findings.

Useful language includes:

“This is what we know at present.”
“We have not yet established why this happened.”
“These are the immediate actions we have taken.”
“We will update you after the next stage of the investigation.”

6. Give a genuine apology

An apology should not be conditional, evasive or written to protect the organisation’s reputation.

It should recognise the person’s experience and the effect of what happened.

7. Document the process

Records should identify:

The incident and when it was recognised.
The immediate assessment and actions.
Who was informed internally.
Whether Regulation 20 was considered.
Who spoke with the person or relevant representative.
The facts explained.
The apology offered.
Questions raised and responses provided.
Support or remedy offered.
Written information supplied.
Further enquiries and promised updates.
Follow-up communication and outcomes.

Clinical records, incident records and candour documentation serve different purposes. One should not be assumed to replace the others.

8. Continue appropriate care

A patient-safety incident can damage trust. Do not allow embarrassment, defensiveness or fear of a complaint to affect the person’s subsequent care.

9. Raise concerns if disclosure is obstructed

If a colleague or manager attempts to conceal an incident, falsify records, discourage reporting or prevent an appropriate candour response, use the organisation’s raising-concerns or freedom-to-speak-up process.

Registered professionals remain accountable for their own conduct. “My manager told me not to report it” is not a reliable professional defence.

What healthcare assistants and support workers should do

Healthcare assistants and support workers may be the first people to recognise that something has gone wrong. They should:

Make the person safe.
Report the concern immediately.
Preserve relevant evidence without conducting their own investigation.
Record factual observations within their role.
Avoid speculation or attributing blame.
Avoid promising a particular outcome.
Cooperate with the formal review.
Escalate again if the concern is dismissed and safety remains at risk.

They should not be left to conduct a complex formal disclosure without appropriate support and authority. However, they should not be instructed to mislead the person or pretend that nothing happened.

What managers and providers must not do

Unsafe organisational responses include:

Delaying disclosure solely to protect reputation.
Waiting for a complaint before acting.
Treating the incident form as completion of candour.
Giving a vague apology without explaining known facts.
Blaming an individual before the investigation is complete.
Telling staff that an apology admits negligence.
Altering or retrospectively rewriting records.
Discouraging staff from raising concerns.
Failing to provide written follow-up.
Communicating once and then leaving the person without updates.

A policy stored on the intranet is not evidence of compliance if staff do not understand or implement it.

What if the person does not want the details?

Some people may not want to receive every detail.

Professionals should explore this sensitively and explain why the information may matter. If the person continues to decline information, their wishes should normally be respected as far as possible.

The discussion should be recorded, and the person should know that they may request further information later.

Confidentiality, capacity and lawful representation must also be considered before information is disclosed to relatives.

“Next of kin” status alone does not automatically authorise access to confidential information or decision-making on behalf of another adult.

What about near misses?

A near miss is an incident that could have caused harm but did not.

A near miss will not automatically trigger the formal statutory process in the same way as a qualifying notifiable safety incident. Nevertheless, it must still be reported and reviewed according to the applicable procedure.

Under professional candour guidance, clinical judgement is required when deciding whether to tell the person. Disclosure may be appropriate when:

The information could affect their future care.
The person would reasonably want to know.
Openness would protect trust.
Continuing consequences or risks remain.
The event may require additional monitoring.

Seek senior or governance advice when uncertain. Do not use the label “near miss” simply to avoid an uncomfortable conversation.

Five questions for every service

Managers and clinical teams should be able to answer:

Can staff distinguish statutory candour from professional candour?
Who decides whether an incident meets the Regulation 20 definition?
Who is responsible for the initial conversation and written follow-up?
How does the service record apologies, questions and promised updates?
Can staff challenge an attempt to delay, minimise or conceal disclosure?

If the answers depend on one manager being present, the system is fragile.

The essential message

The duty of candour is not fulfilled by quietly completing an incident form.

When something goes wrong, safe practice requires more than internal administration. It requires timely clinical action, honest communication, an appropriate apology, clear documentation, continued support and organisational learning.

Not every error is automatically a notifiable safety incident. That legal threshold must be assessed properly.

But uncertainty about the threshold is not permission to hide what happened.

The original incident may have been accidental.

The decision to conceal it is not.