top of page
Care learner by penta-06.png

Digital Social Care Record (DSCR) Compliance: What CQC Actually Expects

Writer: Manu Thomas ACP | Former CQC Specialist Advisor | NICE Associate
Manu Thomas ACP | Former CQC Specialist Advisor | NICE Associate
4 hours ago
6 min read

Many registered managers ask whether their service is “DSCR compliant”. The honest answer is that no such certificate exists. DSCR compliance is not a badge that comes with the software. It is a test of whether your records are accurate, secure, available and governed, however you keep them. This guide sets out what is genuinely required, what is only recommended, and what inspectors will ask to see.


DSCR Compliance

The short answer: what the rules actually say


A digital social care record (DSCR) is software that replaces paper for recording a person’s care information. It is sometimes called an electronic care plan or care management system. GOV.UK guidance notes that DSCRs do not normally include rostering or electronic medication administration records (eMAR), although some products offer them.


There is no separate DSCR law. The legal duty sits in Regulation 17 (Good governance) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. CQC explains that Regulation 17 sets the minimum records a provider must keep for each person using the service, for the employment of staff, and for the overall management of the regulated activity. It applies to paper and digital records alike, and records must be accurate, complete and up to date.


CQC also says it does not endorse any specific system. You must assure yourself that your system lets you meet people’s needs and the regulations.


What DSCR compliance means in practice


CQC’s guidance on digital record systems sets out four principles. Each one translates into evidence an inspector can ask for.


1. Person-centred. The system should help staff put people at the centre of their care. You should be able to show that staff were involved in setting it up and understand how it supports person-centred care. Care plans that record preferences and choices, rather than only tasks, are the clearest proof.


2. Availability. Everyone involved in a person’s care must be able to access the essential information they need, and staff must know how to operate the system. CQC also expects you to show that if the digital system is inaccessible, the safety and standard of care do not suffer. In practice, that means a tested downtime plan.


3. Security. CQC expects you to comply with the Data Security and Protection Toolkit (DSPT), or an equivalent, as a minimum. This applies even where you use a mix of digital and paper. Role-based access, individual logins and trained staff are what make this credible. Shared logins and unmanaged personal devices are the weaknesses most likely to undermine it.


4. Governance. Your records system should feed your quality assurance, not sit beside it. CQC expects the information to be accurate, complete and up to date, and, where digital and paper systems run side by side, the two must align.


If you want to strengthen the staff side of this, the General Data Protection Regulation (GDPR) and Information Governance courses cover the data protection duties behind the security principle, and Handling Information covers day-to-day practice.


Does an NHS assured system make you compliant?


Not on its own. This is the most common misunderstanding.


NHS England maintains an assured solutions list of DSCR products. According to GOV.UK guidance, every solution on the list offers essential features such as care planning, recording, reporting and audit trails, meets national standards for quality and security, helps you comply with CQC good governance regulations, and can connect with GP records. Solutions that stop meeting the standards may be removed.


The key phrase is “helps you comply”. Assurance covers what the product can do. Compliance depends on how your team uses it: who has access, whether entries are timely, whether audits happen, and whether staff are trained. Two services using the same assured product can receive very different inspection outcomes.


Using an assured product is also not a legal requirement for every provider. GOV.UK states that in-house systems do not currently have to be on the list, although it recommends they meet the same standards. There is one practical exception. To use GP Connect, which gives a restricted view of a person’s GP record, you must have an assured solution that integrates with it. You must also reach “standards met” on the DSPT and sign the National Data Sharing Agreement.


What about MODS?


You may have seen the Minimum Operational Data Standard (MODS) mentioned. It is an NHS England information standard for how direct care data is recorded. NHS England states that implementing it is a contractual requirement for all assured DSCR suppliers. It is the supplier’s obligation, not yours, but it is a fair question to put to your vendor when you review the contract. Ask whether they are on the assured list and where they stand on MODS.


What inspectors will look for


CQC has powers to access a provider’s records under section 63 of the Health and Social Care Act 2008. Inspectors will ask to see them, and they expect timely access that does not obstruct the inspection. Obstructing an inspection without reasonable excuse is a criminal offence. A forgotten password or a single person who “knows how to log in” is not a good position to be in.


A practical test for your service

  • Can a manager give an inspector appropriate, supervised access within minutes, on the day?

  • Does every member of staff have their own login, with access matched to their role?

  • Can you show an audit trail of who recorded or changed an entry, and when?

  • Do you have a tested plan for when the system is down, and does any paper backup align with the digital record?

  • Is your DSPT status current, and are staff trained in data handling?

  • Do your care plans and risk assessments show people’s own preferences, and are they reviewed on schedule?

  • Can you show that managers audit records and act on what they find?


Where these answers are weak, the gap is rarely the software. It is the process and the training around it. Record Keeping in Health and Social Care and Care Planning help teams write entries that are accurate and person-centred, while Cyber Security covers phishing, passwords and device safety.


Not sure whether your records would stand up on inspection day? Take the CQC Readiness Assessment to see where your evidence is strong and where it needs work.

Common pitfalls we see


  • Treating the purchase as the finish line. Implementation, training and audit are where compliance is won or lost.

  • Shared logins. They remove accountability and weaken the audit trail.

  • Running two systems without reconciling them. Hybrid paper and digital setups are acceptable, but the information must match.

  • Skipping the downtime plan. CQC expects safe care to continue if the system fails.

  • Leaving less confident staff behind. GOV.UK advises appointing digital champions, phasing the rollout and supporting staff who are less comfortable with technology.

  • Sending staff in without context on the framework. Inspectors use records as evidence across their assessment, so staff should understand CQC’s Single Assessment Framework and the confidentiality duties in Principles of Care and Confidentiality.


Key takeaways


  • There is no “DSCR compliance” certificate. The duty comes from Regulation 17 and applies to paper and digital records equally.

  • CQC’s four principles (person-centred, availability, security, governance) are the practical test.

  • An NHS assured product helps, but your use of it is what is inspected.

  • DSPT compliance, or an equivalent, is the minimum security expectation.

  • Be ready to give inspectors timely access to records on the day.


Frequently asked questions


Is it mandatory to use a digital social care record?

Regulation 17 applies to paper and digital records alike, and CQC states that digital records will increasingly replace paper. Whatever format you use, records must be accurate, complete and up to date. Check current Department of Health and Social Care guidance for any change in expectations.


Do I have to buy a system from the NHS assured solutions list?

Not in every case. In-house systems are not currently required to be on the list. However, the list gives assurance on core features, quality and security, and you need an assured, GP Connect-enabled solution if you want to use GP Connect.


What is the DSPT and do I need it?

The Data Security and Protection Toolkit is the NHS self-assessment for data security. CQC expects providers to comply with it, or an equivalent, as a minimum. You also need “standards met” status to use GP Connect.


What is MODS and does it affect my service?

MODS is a national standard for how core care data is recorded. It is a contractual requirement for assured DSCR suppliers, so it is mainly a supplier responsibility. Ask your vendor about it when reviewing your contract.


Can CQC inspectors access our digital records?

Yes. CQC has legal powers to access records, and you must not obstruct an inspection without reasonable excuse. Plan for timely, appropriate and supervised access.


Sources

 
 
 

Comments

bottom of page