CQC, ICO, HSE, and Now FWA: The 4 Regulators Every Healthcare Business Faces in 2026

UK healthcare businesses are now subject to four separate regulatory bodies — each with inspection powers, each with the ability to fine or close you down. From April 2026, a new enforcement agency has joined the mix, and the compliance burden on care homes, dental practices, GP surgeries, and private clinics has never been higher.

This guide breaks down exactly who the four regulators are, what they check, what happens if they find problems, and how to stay ahead of all four simultaneously.

---

Why 2026 Is a Turning Point for Healthcare Compliance

Most UK healthcare providers are already familiar with the Care Quality Commission. CQC inspections, ratings, and enforcement notices have been part of the landscape for years.

What's changed in 2026 is the addition of a fourth active enforcement body — and the simultaneous tightening of rules across employment, data, and workplace safety.

The result: a healthcare business that was compliant in 2024 may have four different sets of obligations to update before the end of this financial year.

---

The Four Regulators — An Overview

Regulator	What They Oversee	Powers	Active Since
CQC	Care quality, patient safety, governance	Inspection, ratings, enforcement notices, closure	2009
ICO	Data protection, GDPR, patient records	Investigation, fines up to £17.5m, enforcement notices	2018 (GDPR)
HSE	Workplace health and safety	Improvement notices, prohibition notices, prosecution	1975
Fair Work Agency	Wages, sick pay, holiday records	Proactive inspection, fines, arrears enforcement	April 7, 2026

---

Regulator 1: CQC (Care Quality Commission)

What the CQC Checks

The CQC regulates health and social care services in England. This includes care homes, home care agencies, GP practices, dental practices, hospitals, and mental health services.

Its inspection framework assesses five key questions:

• Safe — are patients protected from abuse and avoidable harm?
• Effective — does care, treatment, and support achieve good outcomes?
• Caring — do staff treat people with compassion, kindness, and dignity?
• Responsive — are services organised around individuals' needs?
• Well-led — does leadership ensure high-quality, person-centred care?

CQC Ratings and Consequences

The CQC assigns ratings from Outstanding to Inadequate. An Inadequate rating is publicly visible on the CQC website and can trigger:

• Special Measures: a formal improvement programme under enhanced monitoring
• Enforcement notices requiring specific changes within set deadlines
• Cancellation of registration (which means you cannot legally operate)

In 2025, the CQC issued 1,847 enforcement actions. The number of care homes rated Inadequate increased year-on-year for the third consecutive year.

Key 2026 change: The CQC is rolling out its new Single Assessment Framework, replacing the previous Key Lines of Enquiry (KLOEs) with six Evidence Categories. Services inspected under the new framework are finding the process more intensive and the evidence burden higher.

What to Watch For

• Staffing ratios and agency staff documentation
• Medication management records
• Safeguarding training logs (frequency and content)
• Feedback mechanisms for service users
• Infection prevention and control policies (post-COVID scrutiny remains high)

---

Regulator 2: ICO (Information Commissioner's Office)

What the ICO Checks

Healthcare businesses handle some of the most sensitive personal data in existence: medical records, diagnoses, prescriptions, and mental health histories. All of this is Special Category Data under UK GDPR, which means it carries stricter processing requirements and higher fine thresholds.

The ICO enforces:

• UK GDPR (General Data Protection Regulation)
• The Data Protection Act 2018
• Privacy and Electronic Communications Regulations (PECR)

ICO Fines in Healthcare

Fines can reach £17.5 million or 4% of global annual turnover — whichever is higher. The NHS has received more ICO enforcement actions than any other sector since 2018.

For private healthcare providers, common triggers include:

• Emailing patient records to the wrong recipient
• Staff accessing patient files without a clinical reason
• Using patient data for marketing without explicit consent
• Inadequate data retention and deletion processes
• Failure to report a breach within 72 hours

2026 update: The ICO has signalled it will increase proactive investigations in healthcare following a series of data breaches at private providers. The bar for "appropriate technical and organisational measures" has been raised.

Practical Obligations

• Document all data processing activities in a Record of Processing Activities (ROPA)
• Conduct a Data Protection Impact Assessment (DPIA) for any new system handling patient data
• Ensure all staff complete annual GDPR training (keep the logs)
• Have a written breach response plan with the 72-hour reporting clock built in

---

Regulator 3: HSE (Health and Safety Executive)

What the HSE Checks

The HSE oversees workplace health and safety across all sectors, but healthcare carries specific risks: manual handling injuries (moving patients), sharps injuries, exposure to biological agents, and high levels of occupational stress and burnout.

In a care home or clinical environment, the HSE inspects:

• Moving and handling risk assessments and training records
• Control of Substances Hazardous to Health (COSHH) assessments — cleaning chemicals, disinfectants, medications
• Lone worker policies (particularly for community care staff)
• Violence and aggression risk management
• Stress and wellbeing procedures for staff

HSE Enforcement in Healthcare

The HSE can issue:

• Improvement notices: you must fix a problem by a specific date
• Prohibition notices: you must stop an activity immediately
• Prosecution: for serious or repeated breaches — fines are unlimited, directors can be imprisoned

Healthcare is one of the top three sectors for HSE prosecution. In 2024-25, the average fine for a healthcare employer found guilty of a serious H&S breach was £180,000.

The hidden risk: Stress-related absence and burnout are classified as H&S issues. If the HSE audits your lone worker or wellbeing policies and finds them inadequate, the cost of an improvement notice is minor compared to the reputational damage of a public inspection report.

---

Regulator 4: Fair Work Agency (NEW — April 7, 2026)

What the Fair Work Agency Is

The Fair Work Agency (FWA) is a new statutory enforcement body that launched on 7 April 2026. It replaces and absorbs HMRC's National Minimum Wage enforcement team, giving it significantly expanded powers and a wider remit.

The FWA enforces:

• National Living Wage / National Minimum Wage compliance
• Statutory Sick Pay (SSP) — now payable from day one, no three-day wait
• Holiday pay entitlements
• Holiday record-keeping (new requirement: 6 years' records from April 6)
• Zero-hours contract obligations (guaranteed hours offer from April 7)

Why Healthcare Is High-Risk

Healthcare and social care is among the sectors with the highest proportion of minimum-wage and near-minimum-wage workers. Care assistants, support workers, and domiciliary care staff are frequently paid at or near the NLW floor.

Common traps the FWA will find in healthcare:

• Sleep-in shifts: workers on sleep-in shifts at care homes must now be paid at least £12.71/hour for qualifying working time
• Travel time: community care workers travelling between clients must be paid for travel time — it counts as working time
• Zero-hours workers: from April 7, if a zero-hours care worker has worked regular hours for 12 weeks, you may be required to offer them a guaranteed-hours contract
• SSP records: from April 6, you must be able to demonstrate SSP eligibility and payment records on request

Critical: Unlike HMRC previously, the FWA can inspect proactively — without a complaint from a worker. This changes the risk profile entirely. You cannot rely on workers not complaining. The FWA can audit you because it has sector intelligence.

The April 6 Employment Changes — Healthcare Summary

Change	What It Means for Healthcare
SSP Day One	No more 3-day wait — SSP from the first day of absence
Holiday records 6-year retention	Must keep records for all workers including zero-hours and bank staff
NLW £12.71/hour	Applies to care assistants, support workers, kitchen staff, cleaners
Guaranteed hours obligation	Zero-hours workers with 12 weeks' regular hours may qualify

---

Managing Four Regulators at Once

The Problem: Fragmented Monitoring

Most healthcare businesses have a CQC compliance lead, a designated data protection officer (or nominee), and a health and safety officer. But employment law compliance — including NLW, SSP, and now the FWA — often falls between the cracks of HR, payroll, and operations.

The result: organisations that pass CQC inspections and maintain solid ICO compliance get caught by the FWA on a payroll issue nobody knew about.

The Solution: Centralised Regulatory Monitoring

You need visibility across all four regulators from a single point. The alternative — manually tracking CQC guidance updates, ICO enforcement decisions, HSE industry alerts, and FWA guidance — requires dedicated resource most healthcare SMBs don't have.

Not sure if your business is compliant? Take our free 3-minute Compliance Score quiz — instant results, no sign-up required: compliancealert.co.uk/compliance-score

---

Key Checklist: Are You Ready for All Four?

CQC

• Current rating reviewed and action plan in place if below Good
• Familiar with the new Single Assessment Framework evidence categories
• Safeguarding training records up to date for all staff
• Medication management audit completed in last 12 months

ICO

• ROPA documented and reviewed in last 12 months
• All staff completed GDPR training (records kept)
• Written breach response plan in place with 72-hour clock
• DPIA completed for any new patient-facing system

HSE

• Moving and handling risk assessments reviewed
• COSHH assessments up to date
• Lone worker policy documented and communicated
• Stress/wellbeing policy in place (not just existing, but current)

Fair Work Agency

• NLW/NMW confirmed at £12.71/hour from April 1, 2026
• SSP process updated for day-one entitlement
• Holiday records maintained for all workers (target: 6 years from April 6)
• Zero-hours contracts reviewed — 12-week qualifying period checked

---

Frequently Asked Questions

Does the FWA replace CQC? No. The Fair Work Agency enforces employment and wage law — it has no overlap with CQC's care quality remit. The FWA and CQC can both inspect the same organisation for entirely different reasons.

Can a care home be inspected by all four regulators in the same year? Yes. There is no coordination between the four bodies. A care home could receive a CQC inspection in February, an ICO data breach investigation in June, an HSE improvement notice in September, and an FWA audit in November.

What's the biggest immediate risk in 2026? For most healthcare businesses, the Fair Work Agency represents the highest immediate risk because it's new, proactive, and targets sectors with historically high wage non-compliance. The combination of the NLW rate change and new SSP rules means many payroll processes are non-compliant today without the employer realising.

---

Summary: What to Do Now

1. Check your NLW rate today — it's £12.71/hour from April 1
2. Update your SSP process — day one from April 6
3. Start keeping 6-year holiday records — FWA can check from April 6
4. Review zero-hours contracts — 12-week qualifying period for guaranteed hours from April 7
5. Run a GDPR training audit — all staff, all records
6. Book a CQC readiness review — new Single Assessment Framework is live

ComplianceAlert monitors all four regulators and sends you plain-English alerts when guidance changes. You don't need a compliance team — you need one dashboard.

Start your free 7-day trial — no credit card required: compliancealert.co.uk/healthcare

---