Care homes and regulation 17

What regulation 17 is

Regulation 17 is the good governance regulation in the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. The Care Quality Commission's guidance page, last updated 16 May 2025, says its intention is to make sure providers have the systems and processes that let them meet the other requirements in that part of the Regulations, regulations 4 to 20A. The text of 17(1) is: "Systems or processes must be established and operated effectively to ensure compliance with the requirements in this Part."

Paragraph 17(2) says those systems or processes must enable the registered person, in particular, to:

• "assess, monitor and improve the quality and safety of the services provided in the carrying on of the regulated activity";
• "assess, monitor and mitigate the risks relating to the health, safety and welfare of service users and others who may be at risk which arise from the carrying on of the regulated activity";
• "maintain securely an accurate, complete and contemporaneous record in respect of each service user";

and, in sub-paragraphs (d) to (f), to keep records on staff and management, to seek and act on feedback, and to evaluate and improve how that information is handled.

Where risk and continuity sit

The part that reaches continuity is 17(2)(b). The CQC guidance on it says providers must have systems and processes that let them identify and assess risks to the health, safety and welfare of people who use the service; where risks are identified, must introduce measures to reduce or remove them within a timescale that reflects the level of risk and its impact; and must keep monitoring them and act where a risk has increased. The guidance adds that "others" means anyone who may be put at risk by the regulated activity, such as staff, visitors, tradespeople or students.

That is as far as the regulation goes. Neither the regulation nor the CQC page names business continuity, emergency planning, power cuts, flooding or evacuation. It requires a system that assesses, monitors and mitigates risk; it does not prescribe a continuity plan by name. A provider working out how a prolonged power cut or a loss of water would affect residents is working within 17(2)(b), and the guidance on records says that records of the management of the regulated activity may include policies and procedures, service and maintenance records, audits and "action plans in response to risk and incidents".

Board-level responsibility and reports

The guidance on 17(1) says the system must include scrutiny and overall responsibility at board level or equivalent. Under 17(3), when requested, the registered person must send CQC within 28 days a written report on how and to what extent paragraphs (2)(a) and (b) are being complied with, and any plans for improving the service. CQC says it can prosecute for a breach of 17(3) without first serving a warning notice.

What that looks like in practice

The sources that describe the practical side are not CQC's. The Cabinet Office continuity toolkit lists loss of utilities, staff and premises among the risks any organisation should assess. Be Ready says that anyone who uses medical equipment that needs power should have a plan made with their care provider or clinical team setting out what happens in a power cut and who to contact. The Priority Services Register gives people who are medically dependent on electricity, gas or water priority help during an interruption, and a care home can check that eligible residents are registered. See utilities failure at work and writing a continuity plan.