Digital Care Records: What CQC Expects from Adult Social Care Providers
CQC does not endorse any digital care records system. It does expect your records to be accurate, secure and useful. Here are its four principles and how to evidence them.
CQC expects digital care records to meet the same Regulation 17 standard as paper: accurate, complete, up to date and secure. It also expects you to comply with the Data Security and Protection Toolkit (DSPT) or equivalent each year. CQC does not endorse, recommend or assess any particular digital system, so it is your job to be sure your system helps you meet the regulations and the needs of the people you support.
Digital care planning and electronic medication records are now common, and CQC supports the Digitising Social Care programme. Its guidance (CQC: digital record systems) explains what inspectors look for. This article turns it into a provider checklist for your CQC compliance work.
If you are comparing systems, remember that CQC does not approve software. See what “CQC approved” software means.
Key takeaways
- Regulation 17 applies equally to paper and digital records: accurate, complete, up to date, secure.
- CQC assesses records under the well-led key question, in the quality statement on governance, management and sustainability.
- You are expected to show DSPT compliance or equivalent, completed annually.
- Four principles: person-centred, availability, security and governance.
- CQC does not assess how the digital system itself performs, only how you use it.
In this guide
What Standard Must Digital Records Meet?
CQC points to Regulation 17, which sets minimum requirements for the records a provider keeps for each person using the service, for staff employment and for the management of the regulated activity. It applies to paper and digital records and requires them to be accurate, complete and up to date. Inspectors look at the information in the records, how it is used and the security measures for storing and sharing it. See Regulation 17 explained.
The Four Principles CQC Uses
1. Person-centred
The system helps staff put people at the centre of care. Evidence: care plans reflect needs, choices, preferences and communication needs (including the Accessible Information Standard), people and their representatives were involved in the rollout, and staff were involved in setting up the system.
2. Availability
The right people can access the information when they need it, without unnecessary barriers. Evidence: staff know how to operate the system, people understand what is recorded and shared and why, representatives can see what they are entitled to, and data protection law is not used as an excuse to block appropriate sharing.
3. Security
People can trust that information is kept safe. Evidence: you comply with the DSPT or equivalent (also where you mix digital and paper), staff understand their responsibilities, records are kept and shared in line with UK GDPR and the common law duty of confidentiality, and you have plans for data breaches, loss and cyber-attacks plus contingency plans if the system is unavailable.
4. Governance
The system helps you be well-led. Evidence: it supports quality assurance and spotting risks, information is accurate and complete, where digital and paper systems co-exist they align, and you work with suppliers to maintain devices and update software.
How CQC Looks at Digital Records on Inspection
CQC considers digital record systems under the well-led key question. It does not assess the technical functioning or capabilities of the system itself, but it does expect DSPT or equivalent compliance each year.
CQC’s guidance on accessing records on site says assessors may use log-in details on your computers while at your premises. It prefers read-only access to prevent accidental changes, expects you to provide guest log-ins where an assessor can use them independently, and says you must not use the log-in details or smart cards of anyone who is not present. If read-only access is not available, or the assessor needs help, you should have a staff member available. Assessors will generally not ask for paper copies if they can access the digital record, though you may need to provide hard copies in some circumstances, and CQC may request specific formats for enforcement or regulatory decisions.
Inspection-Day Preparation Checklist
- Set up a read-only or guest account for assessors, with a named person who can help.
- Test that you can quickly print or export records if asked.
- Keep your latest DSPT submission and evidence ready.
- Document your data breach, cyber-incident and downtime contingency plans, and run a downtime drill.
- Check records are contemporaneous: time-stamped, complete and consistent with paper notes.
- Train all staff, including agency workers, to use the system and understand confidentiality.
- Record how people and families can view their records and how you meet communication needs.
See our inspection day checklist and GDPR and data protection for care home records.
Choosing and Reviewing a System
CQC says you need to assure yourself that any digital record system you use meets the needs of the people you support, lets you deliver your regulated activity and enables you to meet the regulations. The Digitising Social Care programme provides resources for choosing a system. Keep a record of how you decided, who was involved, what testing you did and how you review performance, so you can evidence good governance.
Where a Compliance System Fits
Digital care records, such as electronic care plans and medication records, are separate from compliance tracking. CQCLogic is a compliance system, not a care records system. It tracks audits, incidents, notifications, training, supervision and improvement actions, so you can evidence governance over the records you keep elsewhere. See care home compliance software for the difference between compliance and care management software.
Evidence governance over your records
CQCLogic helps you track audits, incidents, training and actions so you can show how you oversee records and data security. See a sample improvement plan, view pricing or get started free.
Frequently Asked Questions
Does CQC require digital care records?
No. CQC says digital records will increasingly replace paper and supports the Digitising Social Care programme, but the requirement is that records, paper or digital, are accurate, complete, up to date and secure under Regulation 17.
Which digital care records system does CQC recommend?
None. CQC says it does not endorse or recommend a specific system and does not assess the technical functioning of systems. You must assure yourself that your system helps you meet the regulations.
What is the DSPT and do I need it?
The Data Security and Protection Toolkit is a self-assessment for data security. CQC says it expects providers to demonstrate compliance with the DSPT or equivalent, completed annually, including where digital and paper records are mixed.
How will CQC look at my digital records on inspection?
Assessors may use log-ins on your computers on site, preferably read-only. You should provide guest log-ins where suitable and have a staff member available if help is needed. Never share log-ins of people who are not present.
Which key question covers records?
CQC considers digital record systems under well-led, specifically the quality statement on governance, management and sustainability.
What if my digital system goes down?
CQC expects contingency plans so essential information is available if the system is inaccessible, so that care is not affected. Document and test them.