The Policy Set an NHS Commissioner Expects From an Independent Clinic

The Policy Set an NHS Commissioner Expects From an Independent Clinic

NHS commissioners and CQC inspectors read your clinic policies not as documents but as evidence of how your organisation actually functions day to day. Generic templates downloaded from the internet or adapted from a hospital setting fail because they lack operational detail specific to your site, your staffing model and your actual clinical scope. The policy set must demonstrate consistent implementation across the organisation, not just articulate best practice in the abstract.

The expectation is clear. When a commissioner assesses your clinic under the Provider Selection Regime or evaluates your capability for an NHS P23 call-off, they want to see that your written policies align with what staff describe in interviews, what your records show and what your incident logs reveal. A well-written policy that cannot be evidenced in practice scores lower than a simpler document that staff can recite and follow.

The core policy themes

Your policy suite should cover safeguarding, clinical risk, information governance, workforce and operational continuity. Each policy must state who is responsible, how breaches are escalated, what training is mandatory and when the policy is reviewed. Commissioners look for named individuals, not job titles in the abstract, and for review dates that have been met.

Safeguarding adults and safeguarding children require separate policies even if your clinic treats only one cohort. The adult safeguarding policy must reference the six principles in the earlier Care Act 2014, name your designated safeguarding lead and include local authority referral routes. The children policy must address the statutory guidance in Working Together to Safeguard Children, explain how Gillick competence is assessed if you treat under-sixteens and describe your relationship with the local safeguarding children partnership. Both policies should state what staff must do if they have a concern, not what managers might consider doing later.

Infection prevention and control must describe your cleaning schedule, who checks it and how decontamination of reusable instruments is validated. Commissioners will compare your written procedures against staff knowledge and physical observation. If your policy says single-use instruments are opened in front of the patient but the treatment room layout makes this impractical, the policy fails.

Your complaints policy must be accessible to patients, state response timescales and explain the route to the Parliamentary and Health Service Ombudsman or the Independent Healthcare Sector Complaints Adjudication Service. Commissioners want to see complaints logs, how learning has been shared and evidence that themes drive training or process change.

Consent must address both written and verbal consent, how capacity is assessed, who can give consent for someone lacking capacity and what happens if a patient withdraws consent mid-procedure. The policy should reference the original Mental Capacity Act 2005 and describe how decisions are recorded contemporaneously in clinical notes. Inspectors will ask clinical staff to describe the consent conversation and compare it against what your policy mandates.

Medicines management covers prescribing, storage, administration, disposal and controlled drugs if you hold them. Describe fridge temperature monitoring, who reconciles stock and how discrepancies are investigated. If you do not hold or prescribe medicines, state that clearly and describe what arrangements exist for patients who attend on medication or require analgesia.

Incident reporting and duty of candour must be unified. Your policy should define what constitutes a reportable incident, who logs it on which system, how severity is graded, what triggers duty of candour and how you notify patients and commissioners. Inspectors cross-check incident logs against clinical records and staff accounts to identify unreported events. A policy that defines a near-miss but has no near-miss reports in twelve months signals underreporting, not safety.

Information governance and data protection require a suite: data protection policy, privacy notices, records management, subject access requests, breach notification and cyber security. Name your Data Protection Officer if you have appointed one or explain why you are not required to. Commissioners expect evidence of staff training, breach logs and a clear description of how patient identifiable information leaves the building, whether as paper, on a laptop or via email.

Recruitment and fit and proper persons must describe your pre-employment checks, what references you take, how gaps in employment are explored, DBS renewal cycles and how you assure fitness to practise for regulated professionals. The policy should state who in your organisation meets the fit and proper person requirement for directors and how that is evidenced. If you rely on agency staff, describe how you gain assurance over their clearances.

Whistleblowing must reference the earlier Public Interest Disclosure Act 1998, state how staff can raise concerns without fear of detriment and provide external routes such as CQC or NHS England. Commissioners want evidence that the policy is communicated to all staff, not just handed out at induction.

Business continuity covers loss of premises, loss of staff, loss of clinical equipment, IT failure, supply chain disruption and loss of utilities. Describe your alternative site arrangements, who holds emergency contact lists and how patients with booked appointments are notified. This policy is tested by asking: if your building were inaccessible tomorrow, how many hours until you could resume clinical activity and where would that take place?

How a policy is tested against practice

Commissioners and inspectors read the policy, then interview staff at different levels and compare answers. If your infection control policy mandates hand hygiene audits every month, they will ask the clinic manager when the last audit was completed, then ask a healthcare assistant what happens during an audit. Discrepancies signal that the policy describes aspiration, not operation.

Consider this worked example. A clinic submitted a safeguarding adults policy for a Provider Selection Regime assessment. The document was comprehensive, referenced the Care Act and local authority procedures, named the safeguarding lead and included a flowchart. It scored well on desktop review. During the site visit, an assessor asked a receptionist what she would do if a patient disclosed domestic abuse. She said she would tell the patient to contact the police and make a note in the clinical record. The safeguarding lead was on the other site that day, she was not sure of the local authority number and the policy had not been discussed since her induction eight months earlier. The policy scored 4 out of 10 on implementation because it was not embedded. The clinic remained compliant overall but lost the commercial advantage a strong safeguarding offer would have given in scoring.

The lesson is simple. A policy is only as strong as the least confident answer a frontline staff member gives when asked to describe it. Write shorter policies that staff can remember, train more frequently than your policy mandates and test knowledge through scenario discussion, not signature sheets.

Policies in the context of NHS P23 and the Provider Selection Regime

If you are tendering for work under RM6291 NHS P23 or being assessed through the Provider Selection Regime, your policies will be scrutinised at due diligence stage before any contract is awarded. Buyers expect policies to be current, tailored to your clinical scope and demonstrably followed. You will be asked to submit your full suite in advance, often within 48 hours of request.

The selection criteria under the Provider Selection Regime often include explicit scoring on governance, with policies forming part of the evidence base. If you cannot produce a policy when asked, or if it is visibly a template with placeholders unfilled, you fail that criterion. Commissioners are comparing you against other providers who have mature governance frameworks, so the standard is high.

For more on how the NHS frameworks operate and how to position your offer, see our guides to NHS framework specialists and NHS tender writing. Understanding how the Provider Selection Regime affects procurement routes will help you prepare the right evidence at the right time.

Frequently asked questions

Do I need separate policies for each service line or can one policy cover the whole clinic?

One policy per theme is sufficient if it describes how the principle applies across all your services. If clinical risk is materially different in one service, for example if you offer surgical day cases and also outpatient diagnostics, write a single clinical risk policy with service-specific annexes. Inspectors want clarity, not volume.

How often must policies be reviewed and does it matter if a review is overdue?

Most policies state a review cycle of one to three years. If the review date has passed and the policy has not been updated, inspectors will record that as a breach of your own procedure. Set realistic review intervals, diarise them and complete reviews on time even if the outcome is no change required.

Can I use a policy template from another clinic or a national body?

You can use a template as a starting structure but it must be adapted to your organisation with named staff, your specific processes and your operational context. A policy that refers to wards, porters or departments you do not have will be rejected as evidence. Write in the first person plural and describe what your clinic does, not what clinics in general should do.

Call 020 3668 5488

Glaxtons, 3 More London Place, London SE1 2RE