Key takeaways
- Regulation 17 requires a record that is secure, accurate, complete and contemporaneous for each service user.
- It also covers staff employment records and records of running the regulated activity, which is the half most providers under-manage.
- CQC does not endorse any particular system, so the test is what a provider can evidence rather than what it has bought.
- Records must be accessed, amended or destroyed only by authorised people, which a shared drive cannot demonstrate.
- Adult social care records are generally kept for 8 years from when they cease to be operational, which is a separate duty from record quality.
- The usual failure is not a missing record but an inability to show which version was in force on the day it mattered.
Regulation 17 is read by most care providers as a rule about care plans. It is not. It asks for an accurate, complete and contemporaneous record for every person using the service, and in the same breath it asks for records about staff employment and about running the service itself. The second half is where the filing cabinets still are.
Most providers have bought a digital care records system and genuinely improved the first half. The supervision notes, the training matrix, the maintenance certificates and the policy that was updated in March are a different story.
What does Regulation 17 actually say?
Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires providers to maintain securely an accurate, complete and contemporaneous record in respect of each service user, including the care and treatment provided and the decisions taken about it. It then requires records relating to the employment of staff and the overall management of the regulated activity.
Four words carry the weight, and each is a separate test:
| Requirement | What it means in practice |
|---|---|
| Securely | Accessed, amended or destroyed only by authorised people, and you can show who those people were |
| Accurate | Reflects what happened, including decisions and the discussions behind them |
| Complete | Nothing material missing, including test results, correspondence and changes following advice |
| Contemporaneous | Written at the time rather than reconstructed, with no undue delay in adding and filing |
A record can satisfy three of those and fail the fourth. A beautifully complete care note written up a fortnight later is not contemporaneous. A perfectly contemporaneous note on a shared drive that anyone can edit afterwards is not secure.
The half everyone forgets
Service-user records usually live in a care system and are the thing providers think about. The rest of Regulation 17 covers:
- Recruitment files, right to work and DBS evidence
- Supervision, appraisal and competency assessments
- Training records and the matrix showing who is current
- Policies and procedures, including which version was in force and when
- Complaints, their investigation and their outcome
- Incidents, accidents and safeguarding referrals
- Medicines audits
- Maintenance, servicing and equipment certificates
- Insurance, contracts and service agreements
Every one of those is a Regulation 17 record. In most services they are spread across a drive, an inbox, a wall-mounted folder and a manager's drawer, which is defensible item by item and falls apart the moment somebody asks to see the whole picture for a particular date.
Why CQC will not tell you which system to buy
CQC is explicit that it does not endorse or recommend a specific digital social care record system. The responsibility sits with the provider to assure itself that whatever it uses lets it meet people's needs, deliver the regulated activity and meet the regulations.
That is more demanding than a list of approved products would be, because it means the question is never "do you have the right system". It is "show me". And the showing is the part that takes an afternoon when the records are scattered and ninety seconds when they are not.
The failure that actually gets found
In our experience it is rarely a missing record. It is the inability to prove which version of something was in force on a given day.
A moving and handling policy exists in three places with three review dates. The training matrix is a spreadsheet somebody updates monthly, so it shows who is current today but not who was current in June. Supervision notes are real but on paper in an office that has since been reorganised. None of these is negligence. Together they make it impossible to answer the only question that matters after an incident: what did we require of staff that day, and can we show the person involved had been trained to it.
That is a version control and audit trail problem rather than a care problem, and it is solvable.
Record quality is not the same as retention
These get conflated constantly. Regulation 17 is about whether a record is secure, accurate, complete and contemporaneous. Retention is about how long you keep it afterwards.
Adult social care records are generally kept for 8 years under the NHS Records Management Code of Practice 2023, and the clock starts when the record ceases to be operational rather than when it was created. We have covered the schedule and that distinction in detail in NHS records management retention periods.
A record can be flawlessly retained for eight years and still fail Regulation 17, and a record can be impeccable and still be disposed of too early. Both duties have to hold.
Where a document system fits, and where it does not
To be clear about what DocFlow is and is not: it is not a digital social care record system and it does not replace one. Care plans, daily notes and medication administration belong in a care system built for them.
What DocFlow holds is the governance layer around that: staff files, training evidence, policies with version history, contracts, certificates, audits and complaints, each with a retention rule applied automatically and an audit trail of every access, amendment and disposal that cannot be rewritten afterwards. It is the second half of Regulation 17, the half that is usually still on paper.
The practical test is the one an inspector applies. Ask somebody to produce the current moving and handling policy, the training record of the member of staff on duty last Tuesday, and the servicing certificate for the hoist in room 4. If that takes more than a couple of minutes, the gap is not in the care system.
DocFlow is built and supported in the UK by Mastercopy, which holds ISO 27001 for information security and ISO 9001 for quality management, and has served organisations in regulated environments since 1989.
Sources: the wording of the duty is taken from regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 and CQC's guidance on Regulation 17. The position on record systems and on what good records look like is from CQC's guidance for adult social care. Last reviewed 8 October 2026.
