How a Private Clinic Becomes an NHS Provider: The Route in Plain Steps

How a Private Clinic Becomes an NHS Provider: The Route in Plain Steps

A private clinic becomes an NHS provider through one of two routes: being commissioned directly by an integrated care board or NHS trust under the Provider Selection Regime, or subcontracting to an existing NHS provider who holds a prime contract. Both routes require CQC registration for the relevant regulated activities, NHS-standard policies, Data Security and Protection Toolkit compliance, appropriate indemnity cover, and a named registered manager on record.

The practical difference is that direct commissioning brings you into competitive selection processes where you submit a capability statement or tender response and are scored against other providers, while subcontracting usually involves commercial negotiation with the prime contractor and lighter evidence requirements. Most single-site clinics entering NHS-funded work for the first time choose subcontracting because it avoids procurement timelines and allows a controlled volume ramp-up.

What direct commissioning under the Provider Selection Regime requires

As of 2026-10-25, NHS commissioners use the Provider Selection Regime when procuring clinical services. The regime replaced previous procurement rules and gives commissioners three pathways: direct award to a single provider, a competitive process, or a framework call-off. When a competitive route is used, your submission is scored against published criteria.

Commissioners typically score providers on clinical quality, workforce capability, patient access, value for money, and social value. Clinical quality often carries 40 to 50 per cent of total marks and is evidenced through CQC ratings, clinical governance policies, incident reporting protocols, safeguarding arrangements, and clinical audit records. Workforce capability looks at clinician qualifications, workforce planning, training logs, and staff-to-patient ratios. Access covers appointment availability, waiting times, patient communication, and equality and diversity measures. Value for money assesses cost per episode of care, overheads, and efficiency, while social value now forms a mandatory element covering employment, local economic impact, and environmental sustainability.

The evaluation panel will cross-reference your CQC inspection reports, read your infection prevention and control policy, and check whether your registered manager has been in post long enough to demonstrate stability. If your CQC rating is Requires Improvement or Inadequate in any domain, you will not score competitively unless you can evidence a credible improvement plan already underway with measurable progress.

You need CQC registration for every regulated activity you intend to deliver under the NHS contract. If you currently hold registration only for treatment of disease, disorder or injury and the NHS contract requires diagnostic and screening procedures, you must vary your registration before contract award. Your statement of purpose must be up to date and reflect NHS-funded work if your current registration covers only private self-pay patients.

What the policy and compliance baseline looks like

NHS commissioners expect to see a policy set written to NHS standard, not adapted consumer-facing materials. The core set includes safeguarding children and adults, information governance and confidentiality, clinical records management, incident reporting and investigation, complaints handling, equality and diversity, infection prevention and control, medicines management if applicable, clinical supervision and audit, and consent. Policies must reference current NHS guidance, be version-controlled, include review dates within the last 12 months, and show evidence of staff training against them.

The Data Security and Protection Toolkit is mandatory for any organisation handling NHS patient data. Completion means working through roughly 100 assertions across 10 standards, uploading evidence, and achieving a Standards Met outcome. First-time completion typically takes 8 to 12 weeks of internal preparation if you start with basic information governance foundations. The toolkit requires a named Senior Information Risk Owner, a Data Protection Officer registered with the ICO, staff training records, an information asset register, and incident response procedures. If you outsource IT support or use cloud-based patient record systems, you need data processing agreements in place with those suppliers before you can demonstrate compliance.

Indemnity cover must explicitly include NHS-funded work. Standard private practice policies often exclude NHS contracts or cap liability below NHS England's minimum requirements. Commissioners ask for a certificate of insurance, not just confirmation of cover, and the certificate must show cover for clinical negligence, public liability, and employer's liability with limits appropriate to your service type. For most outpatient diagnostic or treatment services, clinical negligence cover of at least six million pounds per claim is expected, with an aggregate limit that reflects contract volume.

Your registered manager must be named on your CQC registration, in post for at least three months before you submit evidence to a commissioner, and able to demonstrate line management responsibility for clinical governance. If you are both the clinic owner and the registered manager, that is acceptable, but commissioners will look for separation of governance oversight and day-to-day operational delivery in your org chart.

How subcontracting to a prime provider works

Subcontracting avoids the procurement process because you contract directly with another provider who already holds an NHS contract. The prime contractor remains responsible to the commissioner for clinical quality, safeguarding, and contract performance, and will pass down those obligations to you through the subcontract.

You still need CQC registration, NHS-standard policies, DSPT completion, and appropriate indemnity. The prime contractor will conduct due diligence, usually including a site visit, a clinical governance review, a check of your CQC rating and inspection history, and a workforce capability assessment. They may ask for evidence of financial stability, particularly management accounts and a balance sheet, because they carry contract performance risk if you fail to deliver.

The commercial terms are negotiated directly. Pricing is typically cost-per-case or cost-per-pathway, with the prime contractor retaining a margin for contract management, clinical oversight, and performance risk. Payment terms vary, but 30 to 45 days from invoice is standard. The subcontract will include termination provisions linked to CQC rating changes, serious incidents, or failure to meet activity or quality KPIs.

Subcontracting works well for clinics testing NHS-funded work at controlled volumes, particularly when your CQC rating is Good but not yet Outstanding and you lack a track record of delivering to NHS commissioners. It also suits services where referral pathways and patient flow are managed by the prime contractor, reducing your administrative overhead.

Worked example: single-site diagnostic imaging clinic preparing for first NHS contract

Consider a single-site clinic currently registered with CQC for diagnostic and screening procedures, providing private MRI and ultrasound scans. The clinic holds a Good rating across all domains, employs two radiographers and contracts with three radiologists on a sessional basis, and operates five days per week with evening availability. The registered manager has been in post for 18 months. The clinic owner is exploring subcontracting to a national provider who holds contracts with several integrated care boards for community diagnostic services.

Week one to four: the clinic completes a gap analysis against NHS policy requirements, updates its safeguarding and information governance policies to reference current NHS guidance, and begins DSPT preparation. IT systems are reviewed, data processing agreements are chased from the PACS supplier, and an information asset register is drafted.

Week five to eight: staff complete mandatory training modules for safeguarding, information governance, and equality and diversity. The clinic uploads evidence to the DSPT and submits for self-assessment. Insurance broker confirms current indemnity excludes NHS work and provides a quote for extended cover. Clinic accepts and obtains a new certificate naming NHS-funded diagnostic imaging.

Week nine to twelve: the prime contractor conducts due diligence, including a site visit and a clinical governance interview with the registered manager. They review training logs, clinical audit records, incident logs for the previous 12 months, and patient feedback data. The clinic provides references from two referring consultants and its CQC inspection report. DSPT achieves Standards Met status.

Week thirteen to sixteen: commercial terms are negotiated and the subcontract is signed. The prime contractor provides referral protocols, patient information templates, and reporting standards. The clinic agrees to deliver 15 MRI scans per week initially, rising to 30 per week over six months. The registered manager attends the prime contractor's clinical governance meeting and is added to their serious incident reporting route.

This timeline is illustrative and assumes no significant compliance gaps at the start. If CQC registration needs to be varied, add 12 to 16 weeks for the variation application. If policies need complete rewrites rather than updates, add four to six weeks.

How evaluators score provider capability in competitive processes

When a commissioner runs a competitive selection under the Provider Selection Regime, the evaluation panel scores written submissions and may conduct site visits or presentation interviews. Quality criteria are published in the selection documentation, but the evaluation guidance used by scorers is not.

Evaluators look for specificity and evidence. A statement that your clinic has robust safeguarding procedures scores poorly. A paragraph explaining that your safeguarding lead is a named nurse who completed level 3 training in June 2026, that all clinical staff complete annual refresher training with records held in a training matrix, that you use the NHS safeguarding app for threshold guidance, and that you reported two safeguarding concerns to the local authority in the previous 12 months with documented outcomes scores well.

Evaluators cross-reference your narrative with your CQC report. If you claim outstanding patient feedback but your CQC report notes that you did not demonstrate a systematic approach to gathering and acting on feedback, the evaluator will score the claim as unsupported. If your workforce plan states you employ four full-time clinicians but your CQC statement of purpose lists two, the inconsistency will cost marks.

Case studies and examples improve scores when they demonstrate outcomes, not just activity. Describing how you reduced did-not-attend rates from 12 per cent to 5 per cent over six months by introducing text reminders and a courtesy call protocol, supported by data, is stronger than stating that you have a cancellation policy.

Site visits focus on observable evidence: training records on display or readily accessible, clinical waste segregation, hand hygiene facilities, equipment calibration stickers with in-date certification, patient information in accessible formats, and staff able to articulate policies when asked. A registered manager who can discuss the last clinical audit, describe how learning from incidents is shared, and explain how equality impact is considered in service changes will score well in interview.

Frequently asked questions

Do I need an Outstanding CQC rating to win NHS contracts?

No. A Good rating is sufficient for most commissioners, and many NHS providers hold Good ratings across some or all domains. Outstanding ratings help in competitive scoring, particularly in quality-weighted evaluations, but are not a threshold requirement. Requires Improvement or Inadequate ratings in any domain will make you uncompetitive unless you can evidence measurable progress under an improvement plan already accepted by CQC, and even then you face significant scoring disadvantage.

Can I register with CQC and start the DSPT at the same time as pursuing an NHS contract opportunity?

No. CQC registration takes a minimum of four months from application to decision, assuming no concerns are raised during assessment, and you cannot contract with the NHS without active registration for the relevant activities. DSPT completion requires 8 to 12 weeks if starting from a reasonable baseline. Both must be complete before you can be awarded a contract, so they sit on the critical path. If you are exploring NHS work seriously, begin CQC registration and DSPT preparation before a specific opportunity appears, not in response to a tender deadline.

Does working as a subcontractor limit my ability to bid for direct contracts later?

No. Subcontracting builds a track record of delivering NHS-funded work, which strengthens future bids for direct contracts. Commissioners value demonstrated NHS delivery experience, and subcontract performance, particularly evidence of meeting quality and activity KPIs, contributes to that. Many providers use subcontracting as a route to test demand, refine operational processes, and build contract management capability before pursuing direct awards. The subcontract itself should not include restrictive covenants preventing you from bidding for other NHS work, and if it does, negotiate their removal or limitation to a defined geography or service line.

We work with private healthcare providers preparing for NHS-funded work, including Provider Selection Regime competitive submissions and subcontract commercial negotiation. Our focus is on clinics and small provider groups entering NHS commissioning for the first time or scaling beyond a single subcontract relationship. We charge success fees tied to call-off contract wins, not framework awards or application submissions, so our commercial interest aligns with yours through the full selection cycle. If you are preparing to respond to an NHS opportunity or negotiating a subcontract and want a senior review of your compliance position and submission approach, we can usually provide that within a week of instruction.

Call 020 3668 5488

Glaxtons, 3 More London Place, London SE1 2RE