Sharing concerns
If the Health Protection Agency or its successor, or the relevant local director of public health or equivalent official, becomes concerned that a provider's management of healthcare associated infections is or may be inadequate to provide sufficient protection of patients or public safety, they should immediately inform all responsible commissioners, including the relevant regional office of the NHS Commissioning Board, the Care Quality Commission and, where relevant, Monitor, of those concerns. Sharing of such information should not be regarded as an action of last resort. It should review its procedures to ensure clarity of responsibility for taking this action.
- The NHS Standard Contract requires providers to adhere to the Code of Practice on the Prevention and Control of Infections (DHSC and NHS England implementation update provided to the Thirlwall Inquiry, April 2025).
- The Department of Health and Social Care issued a statutory Code of Practice on infection prevention and control in 2022 (Code of Practice on infection prevention and control, DHSC, 2022).
- The Penny Dash Review in October 2024 found significant failings in the Care Quality Commission's inspection regime (Penny Dash Review of CQC, DHSC, October 2024).
How was this evidence gathered?
Response
Accepted
Response
AcceptedThe government published "Hard Truths: the Journey to Putting Patients First" (Cm 8777) on 19 November 2013, responding to all 290 recommendations of the Francis Report. This followed an initial response "Patients First and Foremost" in March 2013. Key reforms included a new Chief Inspector of Hospitals, strengthened Care Quality Commission inspection regime, a statutory duty of candour, and the fit and proper person test for NHS directors. Volume 2 (Cm 8754) contains the government's detailed responses to each of the 290 recommendations. See: https://assets.publishing.service.gov.uk/media/5a7cd486ed915d63cc65d167/34658_Cm_8777_Vol_1_accessible.pdf
Progress Timeline
DHSC and NHS England implementation update provided to the Thirlwall Inquiry (April 2025). This is the government's own account of progress, submitted to the inquiry. Reviewed extent of implementation: Implemented - Ongoing. On 1 April 2013 the Health Protection Agency was abolished, and its functions were transferred to the Secretary of State (section 56 and Part 2 of the Health and Social Care Act 2012). Public Health England (PHE) was established as an executive agency of the Department of Health in 2013. On 1 April 2012 the UK Health Security Agency (UKHSA) was formally established as an executive agency of the Department of Health and Social Care. All of PHE's health protection functions transferred to UKHSA and PHE was abolished. UKHSA's regional teams lead UKHSA's response to all health related incidents within their part of the country. They provide specialist input to local authorities, the local NHS and other partners to prevent and reduce the impact of infectious diseases; environmental, chemical and radiation hazards; and major emergencies. This includes investigating and managing health protection enquiries, cases, incidents and outbreaks, as well as delivering regional disease surveillance and alert systems. See associated standards for healthcare associated infections. The NHS Standard Contract (SC 21) requires providers to adhere to Code of Practice on the Prevention and Control of Infections and put in place and implement an infection prevention programme in accordance with it . In 2022 DHSC issued a detailed statutory Code of Practice on infection prevention and control.
Published Evidence
Published assessments of progress from inspectorates, select committees, official progress reports, and other sources. Source type badge indicates whether each assessment is independent or government self-reported.
Penny Dash Review (commissioned May 2024) found significant failings at CQC. Health Secretary declared CQC "not fit for purpose". Key findings: one in five services never rated; inspection levels well below pre-pandemic levels; lack of specialist inspector expertise; 5,000 notification-of-concern backlog. CQC consulting on resetting its approach from October 2025.
Learn from Patient Safety Events (LFPSE) service replaced the National Reporting and Learning System (NRLS). NRLS fully decommissioned 30 June 2024. LFPSE has broader coverage including primary care, uses machine learning for analysis and improved trend identification.
HSSIB formally launched 1 October 2023 as independent statutory body under Health and Care Act 2022. Replaced HSIB (non-statutory, established 2016). Has statutory "safe space" protections, powers of entry, inspection and seizure. Conducts system-focused patient safety investigations.
Patient Safety Incident Response Framework (PSIRF) replaced the Serious Incident Framework from Autumn 2023. Shifts from individual blame to system-based learning approaches. Mandatory for all NHS-funded secondary care providers. Part of NHS Patient Safety Strategy (July 2019).
Tom Kark QC reviewed the Fit and Proper Person Test in 2019 and found it essentially "does not ensure directors are fit for the post they hold, and does not stop the unfit from moving around the system." NHS England published updated FPPT Framework effective 30 September 2023 requiring standardised board-level assessments.
Research published 2023 marking ten years since the Francis Report found mixed results. Structural and legislative changes largely delivered (duty of candour, FPPR, CQC overhaul, revalidation, Freedom to Speak Up Guardians). However, cultural change not fully embedded; understaffing, fear of speaking up, and poor complaint handling persist in parts of the NHS.
Clinical Commissioning Groups replaced by 42 Integrated Care Boards from 1 July 2022 under Health and Care Act 2022. ICBs have broader responsibilities for population health, bringing together NHS organisations, local authorities and partners. Implements some Francis recommendations on commissioning integration.
Monitor merged with the Trust Development Authority to form NHS Improvement from 1 April 2016. NHS Improvement then merged with NHS England from 1 July 2022 under Health and Care Act 2022. Francis recommended incremental merger of system regulatory functions between Monitor and CQC; this was partially achieved through structural reorganisation.
Government published "Culture Change in the NHS" (Cm 9009) reporting progress on all 290 recommendations. Key achievements: 19 hospitals placed in special measures; those trusts recruited 109 additional doctors and 1,805 additional nurses; 129 board-level changes made; excess avoidable deaths fell by 450 in less than a year.
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Regulation 5: Fit and Proper Person Requirement came into force November 2014. Requires providers to ensure directors meet fitness requirements including good character, qualifications, competence. CQC can require removal of directors.
New "Fundamental Standards" replaced previous CQC registration requirements from 7 November 2014. Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 introduced clearer minimum standards including: person-centred care (Reg 9), dignity (Reg 10), safe care (Reg 12), staffing (Reg 18), good governance (Reg 17), fit and proper persons (Reg 5), duty of candour (Reg 20).
CQC overhauled its inspection regime in response to Francis. Professor Sir Mike Richards appointed as first Chief Inspector of Hospitals (July 2013). New methodology based on five key questions (Safe, Effective, Caring, Responsive, Well-led) rolled out nationally October 2014. Four-tier ratings introduced (Outstanding/Good/Requires Improvement/Inadequate). Specialist expert-led inspection teams replaced generalist compliance model.
Government published "Hard Truths: The Journey to Putting Patients First" (Cm 8777) in two volumes. Vol 1 set out new actions; Vol 2 provided detailed response to each of the 290 recommendations. Approximately 204 of 290 recommendations were fully accepted.