Organisational Duty of Candour: non-statutory guidance - revised March 2025

5. Activating the Duty of Candour

A “responsible person” is subject to the organisational duty of candour as defined in section 25 of The Act. A responsible person can be an individual or organisation which provides a health, care, or social work service which has resulted in an incident.

Organisations (as responsible persons) must activate the duty of candour procedure as soon as reasonably practicable after becoming aware that:

• an unintended or unexpected incident occurred in the provision of the health, care or social work service provided by the organisation as the responsible person
• in the reasonable opinion of a registered health professional (as set out at paragraph 5.2) not involved in the incident:
  • that incident appears to have resulted in or could result in any of the outcomes mentioned in The Act
  • that outcome relates directly to the incident rather than to the natural course of the person’s illness or underlying condition

The Act sets out that the unintended or unexpected incident that appears to have resulted in or could result in the outcomes listed in The Act must occur in the provision of a health service, a care service or a social work service. However, organisations should consider that the incident may not be the harm or death that has occurred or could have occurred but could be the circumstances leading to it. This should be considered more broadly in the context of the unintended or unexpected nature of the incident.

Harm may not always be severe, but the duty should be considered in the following outcomes:

• an increase to a person’s treatment
• changes to the structures of their body
• the shortening of life expectancy
• an impairment of the sensory, motor or intellectual functions of the person which has lasted, or is likely to last, for a continuous period of at least 28 days
• the person is experiencing pain or psychological harm which has been, or is likely to be, experienced by the person for a continuous period of at least 28 days

If the organisation judges that the criteria have been met, as set out above, the organisational duty of candour procedure must be followed.

5.1 Healthcare-Associated Infections

Since the original guidance was published in 2018, we have experienced the COVID-19 pandemic. This placed substantial demands on care and health organisations in Scotland. COVID-19 raised questions about HAIs and COVID-19 transmission in health and care settings.

It is recognised that pressures increased on services during the COVID-19 pandemic and, as a result of that, the organisational duty of candour procedure may be activated a number of years after an incident as implications for delayed and cancelled procedures or care, such as cancelled surgeries or delayed diagnoses, emerge. If this is the case, organisations must follow the organisational duty of candour procedure process, and if an activation has happened over a month after the incident or event occurred, they must let the relevant person(s) know why. Further information can be found in this guidance at Section 6: Notification.

For HAI incidents, guidance on incident assessment, investigation, management and communication should be sought from the National Infection Prevention and Control Manual: Chapter 3 - Healthcare Infection Incidents, Outbreaks and Data Exceedance (scot.nhs.uk)^[10]. This is not guidance on organisational duty of candour but should be referred to in conjunction with the legislation and this guidance when an incident meets the required threshold.

HAIs may happen despite the application of good Standard Infection Control Precautions (SICPs). However, organisations should still consider whether to activate the organisational duty of candour procedure. Regardless of whether organisations decide that the procedure should be activated, the incident should be considered an opportunity to learn and improve processes to reduce the risk of recurrence.

Consideration should also be given to whether the HAI is itself the incident, the harm as a result of the incident or if it has resulted in other incidents to be considered as resulting in or could result in death or harm.

In terms of organisational duty of candour, it is important that relevant persons are treated as individuals. In a healthcare infection incident, every patient, member of staff or visitor involved in an incident must be reviewed separately to establish if they meet the case definition as determined by the Problem Assessment Group (PAG) or Incident Management Team (IMT). This is in line with the National Infection Prevention and Control Manual^[11] which states, “The IMT must ensure affected patients, and where appropriate their next of kin, have been informed of any actual or potential harm as a result of the HAI. Duty of Candour must be considered at each IMT”. Where the circumstances leading to an incident are the same in a number of cases, it would be reasonable for one review process to cover them all, but where they are different the case must be reviewed separately. For example, if during the investigation of a healthcare infection incident involving 12 cases, it is determined that the circumstances leading to one specific case is different from the other 11, then that case must be investigated and reviewed separately.

Communications with multiple relevant persons affected by the same incident must be taken forward on an individual basis.

Digital incidents, such as data breaches or confidential information being sent to the wrong person, could be grounds for activating the organisational duty of candour procedure. Data breaches or the misuse of health data through careless or inattentive conduct, rather than deliberate abuse, is overwhelmingly seen to be the cause of psychosocial and social harm/impact to individuals and their significant others^[12]. Psychological harm to a patient could increase the need for treatment, or there may be a requirement to consider actual or potential physical harm due to a wrong prescription of medication.

Organisations should consider whether an incident has or is likely to result in psychological harm to the relevant person for at least 28 days. The reported experience of relevant persons should always be the primary determining factor of whether they experienced changes in the way they think, act, or feel following an incident. Changes can be new or a re-emergence of previously experienced problematic ways of thinking, acting, or feeling. It could be distressing for them and may have affected:

• their ability to perform daily activities and routines
• the nature and quality of their relationships
• other important aspects relating to their quality of life

Determining psychological harm does not require specialist assessment or evidence that the psychological distress has crossed a threshold that might be required for the diagnosis of a mental disorder. Responsible persons may find it helpful to seek the views of a suitably qualified person, such as a clinical psychologist or psychiatrist, for advice on the general principles that can be applied when considering whether a relevant person has experienced or could have experienced psychological harm as required by the legislation.

5.2 How to activate the duty

Implementing the organisational duty of candour procedure should begin with the responsible person recording the date when the organisation decided to activate the procedure and the basis for activation.

An organisation may decide to activate the procedure before a review process has been implemented. Activation of the procedure makes it clear to relevant persons what to expect and what their rights are. This approach recognises the obligations placed on organisations when an unexpected or unintended incident appears to have resulted in death or harm, even if a subsequent review process takes the view that this is not the case.

Organisations should ensure there are no delays in activating the organisational duty of candour procedure because other review processes are underway. The existence of other reviews should not determine whether it is then necessary to activate the duty. Such an approach risks criticism that the organisation has not considered the experience of the relevant person and may result in opportunities being missed for taking actions required by the procedure, such as meeting with relevant persons or inviting questions.

5.3 The view of the registered health professional

A ‘registered health professional’ is a member of a profession as defined under section 60(2) of the Health Act 1999^[13]

For an incident to activate the organisational duty of candour procedure, a registered health professional must give their view on the incident, its relationship to the possible future occurrence or actual occurrence of death or harm and how the incident does not relate to the natural course of the illness or underlying conditions. The registered health professional should also detail if any additional framework is being used to support the activation of the procedure.

The organisation (‘the responsible person’) must ensure that the registered health professional who gives their opinion following an unintended or unexpected incident is not someone who was involved in the incident.

It is for the organisation to determine the most appropriate way of obtaining the views of the registered health professional not involved in the incident. The registered health professional may require the organisation to provide them with the following core information in the first instance:

Things to consider:

What was the unexpected or unintended incident?

• what are the outcomes considered in determining whether to activate the organisational duty of candour procedure?
• what illnesses and underlying condition did/does the person have?
• based on the background information provided, does it appear that this incident resulted in or could result in the death or harm described? (See Section 21(4) of The Act ^[14] for a detailed list of outcomes.)
• does the natural course of the person’s illness or underlying condition directly relate to the death or harm described?

In cases where there is not a registered health professional working within the organisation where the incident occurred (for instance, a small care at home service or some social work services), registered health professionals with an existing involvement with the relevant person, or are aware of the relevant person’s medical and clinical history should be contacted, where possible, for example the patient’s GP.

Local health services can aid in identifying a registered health professional who would be able to provide the required view in such circumstances.

Organisations who have difficulties in identifying a registered health professional can contact the Care Inspectorate (enquiries@careinspectorate.gov.scot) or Healthcare Improvement Scotland (his.comments@nhs.scot) for advice.

5.4 Procedure start date

The Act states that organisations must act as soon as reasonably practicable after becoming aware of the incident. The 2018 Regulations provide for a “procedure start date” – this is the date that the organisation receives confirmation from a registered health professional that, in their reasonable opinion, an unintended or unexpected incident appears to have resulted in, or could result in, harm (the list of outcomes can be found in section 21(4) of The Act¹⁴). The harm must relate directly to the incident rather than to the natural course of the relevant person’s illness or underlying condition.

If there is any indication that such an incident may have occurred, the relevant person must be contacted to inform them that the incident is currently being reviewed and they will be contacted upon completion of said review.

5.5 What ‘could result’ means and how that decision is made

If the registered health professional’s reasonable opinion is that it is likely the incident could result in harm, then the organisational duty of candour procedure must be activated. If this is not known at the start of the review process then the organisational duty of candour procedure should be activated at the point where it is thought death or harm has, may have or could occur as a result of the incident.

An incident must have occurred for the organisational duty of candour procedure to be activated. If there was no incident, even if theoretically one could have occurred, the organisational duty of candour would not be activated. It is vital that organisations carefully consider whether something not occurring, such as the cancellation of an appointment, may be an incident in itself. Where an incident has taken place, consideration must be given to the outcome of the incident. Where harm has occurred or could still occur as a result of the incident, the duty must be activated. This is applicable to the outcome for the relevant person, as outlined in section 21(4) of The Act, as opposed to the incident itself.

5.6 Decision-making process diagram

The diagram below sets out the decision-making process in more detail. This does not preclude organisations from including additional steps in their review process that follow their local guidelines.

If an unexpected or unintended incident occurs, and in the reasonable opinion of a registered health professional, that incident resulted in harm or death, the Organisational Duty of Candour must be activated.

Similarly, where an unexpected or unintended incident occurs, and in the reasonable opinion of a registered health professional, the incident theoretically could have resulted in harm or death, the Organisational Duty of Candour must be activated.

However, if an unexpected or unintended incident occurs, but in the in the reasonable opinion of a registered health professional, the incident did not, and was unlikely to, result in harm or death, the Organisational Duty of Candour does not need to be activated.

In “a near miss” situation where an incident did not happen, but theoretically could have, the Organisational Duty of Candour does not need to be activated.

5.7 Example cases for activating the duty of candour

The following examples have been provided as illustrative examples only and this is not an exhaustive list.

Example A: (Care Home)

An occupational therapist completed an assessment with a care home resident whose mobility was deteriorating. They advised that grab rails were needed in his bathroom before it was safe for him to use the bath, and that in the meantime staff should assist him with a wash each morning. The manager failed to update the man’s care plan or inform the care staff of this change, so staff supported him to take a bath the following morning as usual. He slipped when getting out of the bath and broke his arm. The arm was put in a plaster cast and the man needed full assistance for all aspects of his care for six weeks until the cast was removed. He made a full recovery.

Example B: (Mental Health)

A patient with mental health problems was receiving therapeutic interventions during a mealtime. The staff member who was delivering the interventions became distracted by an incident between two other patients that required immediate attention. When she left the patient’s side to call for help at the door, the patient self-harmed with the cutlery provided with the meal. Although the circumstances were understandable, the expected process was not followed, resulting in harm.

Example C: (Biopsy)

During an endoscopy, biopsies were taken for diagnostic purposes to decide a course of treatment for a patient. Three biopsies were taken from different suspicious areas identified. When the clinician was looking for the results, one of the specimens did not turn up in the lab. Despite searching the endoscopy suite, the specimen did not turn up. The clinician therefore could not rule out any problems with this area and the patient was required to be re-scoped.

Example D: (National Programme)

An error is made by a cytologist in one of the two nationally commissioned cervical screening laboratories which leads to a delayed diagnosis of cervical cancer in an individual resident in another health board. In this case the territorial board which hosts the cervical screening lab holds organisational duty of candour responsibility and should activate the procedure. Because the service in this case is nationally commissioned, it is important that the national programme alongside the board of residence works closely with the board hosting the laboratory to ensure consistent information provision.

Example E: (Large Scale Adverse Event)

Following kneecap replacement surgery, a patient was informed by the lead surgeon that the procedure had been a success. However, years later, it was discovered that the surgeon had used a novel device as part of the operation which was found to be failing. Following an investigation of this surgeon’s work, more than 100 other patients were identified as having been subjected to incorrect or harmful procedures. Organisational duty of candour would be activated to establish the scope of the adverse event and identify all relevant persons, regardless of when they were operated on by this surgeon.

Example F: (Data Breach)

Sophisticated malware was covertly installed on a hospital computer system. It stole sensitive patient data and went unnoticed for six months. Patients were informed as soon as the malware was identified and purged from the IT system, but due to the late discovery, this was six months after their data was stolen. The data breach caused significant operational setbacks, with managerial, administrative, and IT staff working overtime to mitigate the damage and impact to the hospital. The shift of attention resulted in delayed appointments, procedures and surgeries. In this situation, the Organisation Duty of Candour would be activated as soon as the data breach was discovered.

Example G: (Healthcare-Associated Infection)

An Endoscopy unit had a system of removing used scopes at the end of each case to be sent for decontamination and only when the next patient was in the room was a clean scope brought in. During a busy clinic, staff changed over between patients and a used scope was not removed from the room. The new member of staff assumed that someone had brought in a clean scope ready for the next patient. After the scope was used, it was recognised to be one used previously as the barcode had already been scanned. Although the first patient was not known to have a blood borne virus the risk of cross contamination had to be investigated. Both patients were informed of the error and that the risk of cross infection was low. Both patients required to have blood taken for analysis. While there was no indication that any cross infection occurred, there was psychological harm as both patients were very concerned waiting for the results which took six weeks, and both patients had an increase in treatment to determine if any cross infection had occurred.