1. Introduction
1.1 Background
1. Under the National Health Service Act 2006 (‘the NHS Act 2006’) and the Health and Social Care Act 2012 (‘the 2012 Act’), as amended by the new Health and Care Act 2022 (‘the 2022 Act’), NHS England has statutory accountability for oversight of both integrated care boards (ICBs) and providers of NHS services*. NHS Improvement (Monitor and the NHS Trust Development Authority) has been abolished and NHS England has assumed responsibility for the regulation of providers of NHS services, the exercise of provider enforcement powers, and producing and revising guidance on those powers.
* Note that persons providing primary medical services (GPs) or primary dental services only are currently outside the licensing and enforcement regime described in this guidance.
2. The 2022 Act amended the NHS Act 2006 by inserting a new section 14Z61 to give NHS England powers to direct ICBs when it is satisfied that an ICB (a) is failing or (b) is at risk of failing to discharge its functions.
3. It also introduced licensing for NHS trusts*. NHS trusts may now be subject to statutory enforcement action as described in this guidance, along with NHS foundation trusts, licensed independent providers and NHS controlled providers. This guidance should therefore be read in conjunction with the provider licence as updated from April 2023.
* The NHS provider licence was introduced in 2013 under the provisions of the Health and Care Act 2012 and is held by all NHS foundation trusts as well as independent sector providers that deliver more than £10 million of NHS services annually or are designated as commissioner requested services (excluding providers that exclusively provide primary medical or primary dental services, or NHS continuing healthcare and NHS-funded nursing care). The Health and Care Act 2022 applied the requirement to hold a licence to NHS trusts for the first time.
4. This guidance outlines how NHS England intends to exercise its enforcement powers for both ICBs and providers, by setting out how it would use these powers to direct an ICB and the licence enforcement mechanisms that apply to foundation trusts, NHS trusts, licensed independent providers of NHS services and licensed NHS controlled providers. It explains the regulatory and statutory processes in the event of enforcement action and the subsequent rights of appeal. The annex to this guidance applies to the enforcement of the patient choice requirements that apply to ICBs.
5. NHS England will use its enforcement powers in a measured and proportionate manner. Where the use of investigation and enforcement powers is being considered, the relevant NHS England committee will base their decision on the evidence.
6. NHS England’s enforcement guidance is published pursuant to NHS England’s duty under s108 of the 2012 Act to publish guidance about the use of its enforcement powers under that Act and its duty under s14Z51 of the NHS Act 2006 (as amended) to publish guidance about the exercise of ICB functions. In so far as this guidance sets out the procedures for entering into undertakings under the 2012 Act, the document is made pursuant to paragraph 9 of Schedule 11 to the 2012 Act. All references to legislation in this guidance should be read as amended by the 2022 Act.
1.2 Purpose and scope
7. The guidance applies to all ICBs and providers of NHS healthcare services in England subject to the provider licence (referred to in this guidance as ‘providers’). It describes NHS England’s intended approach to using its enforcement powers over ICBs and those providers. It explains:
i. when NHS England may decide to take action, and what action it can take
ii. how NHS England is likely to decide what kind of sanctions to impose using its powers under the Acts
iii. the high-level processes NHS England intends to follow when taking enforcement action, including the procedure for entering into undertakings, both in relation to providers under paragraph 9 of Schedule 11 to the 2012 Act and ICBs.
8. The NHS Oversight Framework details the overall principles, responsibilities and ways of working for oversight, including the key metrics and factors NHS England will consider when determining support needs, and the circumstances in which it considers formal regulatory intervention may be necessary to address particular issues. This guidance should therefore be read alongside the NHS Oversight Framework.
9. For licensed independent providers and certain NHS controlled providers*, the relevant framework that sets out NHS England’s approach to oversight is the Risk Assessment Framework and reporting manual for independent sector providers of NHS services, and not the NHS Oversight Framework. They should therefore read this guidance alongside the Risk Assessment Framework.
* NHS controlled providers are not trusts or foundation trusts but are ultimately controlled by one or more NHS trusts or foundation trusts. They may be overseen under either the NHS Oversight Framework or the Risk Assessment Framework and reporting manual for independent sector providers of NHS services. This will depend on factors such as the scope of the services provided, size of turnover and whether the provider is a wholly owned subsidiary or is jointly owned by a number of providers.
2. Legal framework
10. ICBs are expected to lead the day-to-day oversight of providers, working alongside NHS England. However, the legal remit for taking enforcement action at organisation level continues to sit with NHS England for both ICBs and providers. This guidance explains the processes in the event of enforcement action (as listed in paragraphs 11 and 12) and subsequent rights of appeal.
11. ICBs may be subject to:
a. directions – in addition, where an ICB fails to comply with a notice to provide information requested by NHS England in connection with its ‘regulatory functions’ (in particular, licence enforcement and pricing) under s104 of the 2012 Act, then it may be subject to statutory undertakings and discretionary requirements, in the same way as a provider.
b. undertakings
12. Providers may be subject to:
a. discretionary requirements
b. undertakings
c. additional governance licence conditions (foundation trusts only)
d. monetary penalties
e. revocation of licence
f. directions for NHS trusts (s27B NHS Act 2006).
13. The guidance sets out NHS England’s enforcement mechanisms. It is not intended to give legal advice to ICBs and providers that find themselves subject to enforcement action. In such circumstances, ICBs and providers may need to seek independent legal advice.
2.1 Legal requirements governing how NHS England works
14. In keeping with a system-led approach, NHS England will discharge its duties in collaboration with ICBs, asking the ICB to oversee and seek to resolve local issues before escalation. Where NHS England intervenes directly with individual providers, this will happen with the awareness of the relevant ICB.
15. NHS England’s regulatory work is conducted within the relevant legal framework, which is made up of the legal duties and powers given to it under the NHS Act 2006 and 2012 Act, and the terms of the NHS provider licence and general principles of public law.
16. As for any public body, NHS England must exercise its powers fairly, reasonably and rationally, using them only for their proper purposes. NHS England is also bound by laws to protect fundamental rights and interests, such as human rights, data protection and equality laws, to ensure that people are treated with dignity, basic freedoms are not overridden, personal information is not misused, and characteristics fundamental to everyone’s identity are respected and do not lead to unfair treatment. The enforcement procedures are designed to observe these laws and principles when NHS England deals with regulatory enforcement matters.
2.2 ICB enforcement legislation – the NHS Act 2006
17. The NHS Act 2006 was amended by the 2022 Act to establish ICBs and give NHS England powers to give directions to an ICB if it is satisfied that:
a. the ICB is failing or has failed to discharge any of its functions (properly or at all); or
b. there is a significant risk that the ICB will fail to do so.
18. Under the NHS Act 2006, a failure to discharge a function is:
a. a failure to discharge it properly
b. this includes a failure to discharge it consistently with what NHS England considers to be the interests of the health service.
19. This guidance aligns with the NHS Act 2006, which forms part of the oversight architecture for the NHS, provides the legal mechanism for any formal regulatory intervention and underpins mandated support at some of the most challenged ICBs. The guidance sets out the steps NHS England will follow when considering its ICB enforcement powers under the NHS Act 2006.
20. The NHS Act 2006 sets out the general duties that apply to an ICB in exercising its functions, including:
i. The duty to bring improvement in the quality of services.
ii. The duty to reduce inequality of access and outcomes.
iii. The duty to obtain appropriate advice.
iv. The duty to promote research and its use in health services.
v. The duty to have regard to the likely effect of decisions on health and wellbeing, quality of services, and efficiency and sustainability of resources (the ‘triple aim’).
vi. The duty to involve patients and the public in decisions that affect them.
vii. The duty to act with a view to enabling patients to make choices with respect to aspects of the health services provided to them.
21. ICBs are also subject to various financial duties and other duties relating to planning and contributing to wider local strategies.
22. NHS England expects ICBs to engage with it voluntarily to bring an ongoing failure to an end or to establish whether there has been a failure to discharge a function in the past.
23. Where this does not prove possible and the available evidence indicates that the legal test for intervention is met, NHS England will consider formal steps to ensure compliance. If NHS England is considering acting formally, it will review the information in its possession, consult the ICB and assess the range of available options to determine the most appropriate action, having regard to the legal framework described above.
24. In addition to its general powers, NHS England has specific powers to give directions to an ICB where it fails to comply with the rules of the NHS Payment Scheme (s114B of the 2012 Act).
2.3 NHS England’s ICB enforcement actions
25. NHS England’s general powers to apply directions to an ICB offer a number of options, including the power to:
i. Direct the ICB to discharge any of its functions, in such a manner and within such a period or periods as may be specified in the direction.
ii. Direct the ICB, or its chief executive, to cease to perform any functions for such a period or periods as may be specified in the direction. Where such a direction is given, NHS England may:
a. Exercise, on behalf of the ICB/chief executive (as the case may be), any of the functions that are the subject of the direction.
b. Direct another ICB (or in the case of a direction to a chief executive, the chief executive of another ICB) to perform any of those functions on behalf of the ICB/chief executive, in such a manner and within such a period or periods as may be specified in the direction. In the case of a direction to another ICB to perform the functions of the failing ICB, this may include provision prohibiting or restricting the failing ICB from making delegation arrangements (‘Delegation arrangements’ are arrangements made by a person for the exercise of a function by someone else) in relation to those functions.
iii. Terminate the appointment of the ICB’s chief executive and direct the chair of the board as to who to appoint as a replacement and on what terms.
26. Before directing another ICB to perform the required functions on behalf of an ICB or directing a chief executive of another ICB to perform those functions on behalf of the chief executive of the failing ICB, NHS England must consult the ICB in question.
27. Where a direction is given to the chief executive of the ICB to cease to perform any functions for a specified period, the ICB’s board must co-operate with any ICB chief executive NHS England has directed to perform those functions.
28. Where NHS England is exercising its specific powers to direct an ICB in respect of a failure to comply with the NHS Payment Scheme rules, NHS England may direct the ICB to take steps to secure that:
i. the failure does not continue or recur; or
ii. the position is as far as is practicable restored to what it would have been if the failure were not occurring or had not occurred.
29. Directions should only be issued to an ICB as a last resort or where other intervention or support measures have failed to adequately address the identified issue(s).
30. An ICB may be subject to statutory undertakings or discretionary requirements (sections 105 and 106 of the 2012 Act) where it refuses to respond to a formal information notice from NHS England relating to its regulatory functions (for example, provider licence enforcement or pricing). The relevant processes for provider enforcement set out in this guidance would then apply.
2.4 ICB undertakings
31. NHS England has introduced a two-tier intervention process for ICBs. This ensures parity with the provider enforcement regime by introducing undertakings as the first step of NHS England’s enforcement action for ICBs.
32. Where NHS England has reasonable grounds to suspect a potential failure or is concerned that an ICB is at risk of failing to discharge its function (or, in the case of pricing, has reasonable grounds to suspect that the ICB is failing or has failed to comply with the NHS Payment Scheme rules), it may accept undertakings from that ICB. If the undertaking is then breached, this may justify the use of directions. As with provider undertakings, an undertaking may be accepted on the basis of reasonable suspicion, rather than the higher threshold that applies for directions (where NHS England must be satisfied there is a failure or significant risk of failure).
33. As is the case with provider undertakings, ICB undertakings are agreed by NHS England and the ICB, and set out the remedial actions to be taken to address the specific challenges identified. By offering and agreeing undertakings, the ICB gives a commitment that it will comply and carry out the relevant actions. ICB undertakings should contain monitoring and reporting commitments to ensure progress.
34. As a minimum, ICB undertakings are expected to include a commitment that the specified failing, if ongoing, is brought to an end within the stipulated timescales and does not recur. Where an ICB does not bring the failing to an end within the agreed time, NHS England can impose directions.
2.5 Provider enforcement legislation – the licence and the 2012 Act
35. The NHS provider licence was introduced in 2013, under the provisions of the 2012 Act, and is held by all NHS foundation trusts as well as independent sector providers that deliver more than £10 million of NHS services annually or are designated as commissioner requested services (excluding providers that exclusively provide primary medical or primary dental services, or NHS continuing healthcare or NHS-funded nursing care)*. From 1 April 2023, NHS trusts are required to hold a licence (section 51 of the Health and Care Act 2022). Please refer to the NHS provider licence guidance as updated from April 2023 and the NHS controlled provider licence guidance.
*Section 81(1) of the 2012 Act and the National Health Service (Licence Exemptions, etc) Regulations 2013 (SI 2013/2677). For independent providers, guidance on how to apply for a licence is available on our website.
36. This enforcement guidance aligns with the updated provider licence, which reflects the requirement for NHS trusts to be licensed. The provider licence sets the conditions that providers must meet, including those relating to pricing, integrated care and patient choice. For some providers, the continuity of service (CoS) conditions will also apply. Specific conditions also apply to NHS trusts and foundation trusts relating to governance, co-operation, the ‘triple aim’ and digital.
37. As set out in the 2012 Act, breach or suspected breach of those conditions may provide the basis for formal regulatory intervention. In particular, NHS England may accept an undertaking from a provider to remedy suspected non-compliance where NHS England has reasonable grounds to suspect a breach; and NHS England may impose requirements on a provider, designed to remedy non-compliance, where NHS England is satisfied there is a breach (discretionary requirements).
38. The licence and related enforcement action underpins mandated support at some of the most challenged providers as set out in the NHS Oversight Framework. This guidance sets out the steps NHS England intends to follow when considering the use of its enforcement powers under the licence provisions of the 2012 Act.
39. As with ICBs, NHS England expects providers to engage with it voluntarily, in conjunction with the relevant ICB, to bring an ongoing breach to an end or to establish whether there has been a breach in the past. Where this does not prove possible and the available evidence indicates that the legal test for intervention is met, NHS England will consider formal steps to ensure compliance.
40. If NHS England is considering acting formally, it will review the information in its possession, consult as required including with the relevant ICB(s) and assess the range of available options to determine the most appropriate action, having regard to the legal framework described above.
41. To ensure compliance with the licensing regime, NHS England may:
a. require certain people or bodies to provide information to it in any requested format at any time (s104 of the 2012 Act)
b. accept undertakings to remedy a breach of the requirement to hold a licence; or a breach of a licence condition; or a failure to comply with a notice NHS England issues to provide information (s106 of the 2012 Act)
c. impose discretionary requirements to remedy a breach of the requirement to hold a licence; or a breach of a licence condition; or a failure to comply with a notice NHS England issues to provide information (s105 of the 2012 Act)
d. impose on a foundation trust (only) an additional licence condition relating to governance (s111(1) of the 2012 Act)
e. include or modify a special condition in a licence after consulting the licence holder (s95(1) of the 2012 Act)
f. revoke a licence for breach – although such action is likely to be rare and applied only in extreme circumstances (s89 of the 2012 Act. NHS England may also revoke at the licence holder’s request).
42. NHS England’s powers to impose discretionary requirements or accept undertakings for failure to comply with a section 104 formal notice requesting information in relation to provider enforcement apply to both providers and ICBs.
43. NHS England also has a general power to give directions to NHS trusts about the exercise of their functions, under s27B of the NHS Act 2006. This could include giving a direction to an individual NHS trust. Generally, NHS England intends to use the 2012 Act enforcement powers in relation to failures to comply with licence requirements, and to mandate support under the NHS Oversight Framework NHS England retains the discretion to use a direction in an appropriate case.
44. Sections 3 and 4 below provide details on:
a. how NHS England will assess whether enforcement action may be necessary
b. where NHS England believes that enforcement action is necessary, how it will select an appropriate and proportionate remedy.
2.6 Provider discretionary requirements
45. NHS England may impose various types of discretionary requirements on providers (as indicated at paragraph 42, these powers also apply to an ICB that fails to comply with an information notice under s104 of the 2012 Act)
46. For any provider, this may be a monetary penalty of an amount that NHS England determines, up to a maximum of 10% of the turnover in England of the party on whom it is imposed (s105(4) of the 2012 Act) (known as a variable monetary penalty)*
*s105(2)(a) of the 2012 Act. Part 2 section 3 of the National Health Service (Licensing and Pricing) Regulations 2013/2014. Pursuant to Schedule 11 to the 2012 Act, a monetary penalty may not be imposed unless notice is given to the provider within 5 years of the last day of the period in which the provider was in breach.
47. It may be a requirement to take steps within a certain period that NHS England specifies to ensure that the breach is terminated or does not recur – known as a compliance requirement (s105(2)(b) of the 2012 Act).
48. Or it may be a requirement to take steps within a certain period to ensure that to the extent possible the position is restored to what it would have been had the breach not occurred – known as a restoration requirement (s105(2)(c) of the 2012 Act).
49. NHS England may take a range of considerations into account to decide whether to impose a requirement and, if so, which one. These may include:
a. Seriousness of the breach – including its nature, scale, gravity, impact, duration and the extent to which it can be remedied or reversed. In broad terms, the more serious the breach, the greater the likelihood that a discretionary requirement would be an appropriate remedy.
b. Securing provider compliance – including whether the breach is a first occurrence or a repeat; whether non-compliance was deliberate and foreseeable, or accidental; and the extent to which any undertakings offered by the infringer may adequately remedy the breach.
c. Deterrence effect – including whether proportionate adjustments to the remedy may be necessary to deter future breaches by the infringer or by other providers in similar circumstances; how common breaches of the type under consideration are in the health and social care sector; and the effectiveness of previous remedies in deterring future breaches.
d. estoring the position to what it would have been without the breach – including the extent to which this is desirable (for instance, to ensure that the infringer does not financially or otherwise profit from the breach) and practicable (for instance, whether it could be readily achieved).
50. Any remedial action must be clear cut, readily implementable and proportionate to the breach. NHS England will balance the need to swiftly bring to an end and deter harmful conduct with the need to ensure the continued provision of healthcare services.
51. To ensure a proportionate outcome, NHS England will weigh the expected impact and burden of the requirement on the provider. Such factors would include the provider’s current and likely future financial position, and the cost of complying with a requirement including on quality and safety.
52. Currently, NHS England does not have a fixed monetary penalty scale. NHS England reserves its right to determine an appropriate penalty on a case-by-case basis in accordance with legislation. In doing so, NHS England will take into account relevant matters as set out in paragraph 49 and other factors such as the impact of a monetary penalty on the quality and safety of services provided by the licensee. Where relevant, NHS England may apply a discount for voluntary reporting of breaches in respect of which a penalty is imposed.
2.7 Giving notice of intention to impose provider discretionary requirement
53. Where NHS England proposes to impose a discretionary requirement, it is required to issue a notice of intent to the provider it considers has committed the breach (Paragraph 1 of Schedule 11 to the 2012 Act. This would also apply to a discretionary requirement proposed for an ICB in relation to a failure to comply with a s104 information notice). The notice will set out the nature, reasons for and effect of the requirement NHS England proposes to put in place. It will explain the effect of NHS England’s powers relating to undertakings and whether NHS England would consider accepting undertakings in lieu of requirements to remedy the breach. It will specify the deadline for submitting written representations to it on the proposed action* and, if appropriate, also set out the circumstances in which NHS England may not impose the proposed requirement.
* Pursuant to s1(3) of Schedule 11 to the 2012 Act, the consultation period must be at least 28 days, starting on the day after the notice is received. However, where the proposed action is to impose a compliance requirement or restoration requirement and NHS England considers that a shorter consultation is necessary – to prevent or minimise further potential breaches of the requirement to hold a licence or to comply with an information notice under s104 of the 2012 Act or to comply with licence conditions – NHS England may shorten the consultation period as appropriate subject to a minimum of 5 days starting on the day after the notice is received. See paragraph 1(4) of Schedule 11 to the 2012 Act.
54. NHS England may also invite the notice recipient to a meeting to make oral representations to supplement its written response to the notice. A recipient may choose to take up this invitation if it wishes to give further elucidation (representation)/evidence to its written response, for example. Equally, a recipient may request a meeting for these purposes.
55. Oral representations should not be regarded as an alternative to written observations and evidence, and NHS England will not draw any adverse inferences if a notice recipient chooses not to accept or request a meeting. Typically, the meeting should add further explanation and clarification to written observations and should not simply repeat arguments already made in writing.
56. NHS England may also invite interested third parties to comment on a non-confidential version of the proposal. The extent and duration of any third-party consultation will be assessed on the facts of each case, including whether the interests of patients would be better served by taking swift action or by obtaining views from a range of parties through a broader consultation exercise.
57. Alongside a confidential submission, third parties should provide a non-confidential version that clearly identifies any confidential information they wish to be redacted and explain how disclosure of that information would significantly harm the legitimate interests of the party or person to whom it relates.
58. NHS England will consider all representations made to it in relation to its proposed action prior to giving notice of its final decision. The notice will set out whether its final decision is to impose the requirement in its original form or with modifications; or whether NHS England has decided to impose any other requirement (paragraph 2(1) and 2(2) of Schedule 11 to the 2012 Act.). The notice will also set out the effect of the requirement; the reasons for imposing it; the consequences of non-compliance; and the right of appeal (paragraph 2(3) of Schedule 11 to the 2012 Act).
59. In the case of a variable monetary penalty, it will also specify how and by when payment should be made (pursuant to paragraph 2(4) of Schedule 11 to the 2012 Act, the minimum period for payment is 28 days starting on the day after that on which the final notice is received); and give details of any discount for early payment and the applicable interest rate for late payment (paragraph 2(3)(c) of Schedule 11 to the 2012 Act). Payment must be made within the payment period specified in the notice. Failure to pay on time may result in interest being payable and, in addition to any other action to recover the amounts due, NHS England may take action to collect the money, and any interest owed, through the civil courts as a civil debt.
60. In certain circumstances, NHS England may change a discretionary requirement after it has served a final notice. NHS England may withdraw the requirement entirely; or reduce the amount of a penalty; or extend the deadline for payment; or extend the deadline for putting in place a compliance or restoration requirement (paragraph 4 of Schedule 11 to the 2012 Act. This would also apply to a discretionary requirement proposed for an ICB in relation to a failure to comply with a s104 information notice). Generally, NHS England will publish on its website any changes that it makes after issuing a final notice together with the reasons for doing so.
61. Discretionary requirements may be appealed. Further details on how to appeal are set out in section 6.
2.8 Penalty for non-compliance with a provider discretionary requirement
62. If a provider fails to comply with a compliance or restoration requirement imposed on it by NHS England, NHS England may impose a financial penalty on it, known as a ‘non-compliance penalty’ (pursuant to paragraph 5 of Schedule 11 to the 2012 Act).
63. Prior to taking this action, NHS England will issue a non-compliance notice to the infringer that sets out key information about the penalty, unless NHS England considers that there are particular circumstances that would make it inappropriate to do so.
64. If all or any part of a non-compliance penalty is not paid by the deadline, NHS England may increase the penalty by up to 50% of its amount.
65. NHS England may by notice to the infringer reduce the penalty or extend the period for payment.
66. Both financial penalties and non-compliance financial penalties paid to NHS England are recoverable as civil debts and are transferred to the government Consolidated Fund.
67. A decision to impose a non-compliance penalty may be appealed. Further details on how to appeal are set out in section 6.
2.9 Provider undertakings
68. NHS England may also seek and accept undertakings from providers under s106 of the 2012 Act (as indicated at paragraph 43 of this guidance, such undertakings may also be accepted by an ICB which fails to comply with an information notice under s.104 of the 2012 Act). Following the introduction under the 2022 Act of the requirement for NHS trusts to hold a licence, this provision includes NHS trusts.
69. NHS England may propose and accept undertakings where it has reasonable grounds to suspect that there is or has been a breach. This means that the evidence must point to more than a suspicion but may be of a lesser degree of certainty than that required to impose a discretionary requirement.
70. As a minimum, an undertaking would be expected to include a commitment to take action that would mean that the breach, if ongoing, is brought to an end within the stipulated timescales and does not recur. A provider may also undertake to restore the position to what it would have been had the breach not occurred or take action to benefit another licence holder or party that has suffered harm because of the breach (including the payment of a sum of money).
71. By offering or agreeing undertakings, the provider demonstrates that it intends to comply with them voluntarily. Nevertheless, it is usual practice for undertakings to contain monitoring and reporting commitments to ensure progress. Failure to deliver on undertakings can lead to further and more serious enforcement action.
2.10 Entering into discussions about ICB and provider undertakings
72. An ICB or provider can approach NHS England about offering undertakings at any point after NHS England has indicated it has reasonable concerns that an ICB may be failing or is at risk of failing or a provider may be breach of its licence conditions.
73. Any proposal should be credible, with sufficient detail and explanation of how the undertakings would remedy NHS England’s concerns in practical terms.
74. Similarly, NHS England may initiate discussions with an ICB or provider and propose undertakings where it considers these would be a viable solution to any concerns about a failure by an ICB or suspected breach by a provider. These can also bring an end to an ongoing ICB concern or provider breach, and any associated harm, more swiftly than might otherwise be the case.
75. Any discussions regarding undertakings are expected to take place in good faith with the sole aim of finding a clear-cut and comprehensive solution to concerns relating to ICBs or a suspected breach by a provider. Where NHS England believes that an ICB or provider does not demonstrate this intent, NHS England will continue to investigate or consider the (suspected) failure or breach.
76. It may take a number of attempts to finalise suitable undertakings and the process is usually iterative. However, where NHS England believes that, notwithstanding serious efforts, a workable solution is unlikely to emerge in a timely manner, it may decide to draw the discussions to a close. Before doing so, NHS England will make any relevant considerations such as how far its enquiries have progressed, and the availability of further evidence that may satisfy it that there is an ongoing or has been a failure by an ICB or breach by a provider. This may enable NHS England to consider imposition of directions (ICB) or discretionary requirements (provider) as a remedy in the first instance.
2.11 Consulting other parties
77. Where NHS England determines that the proposed undertakings represent a comprehensive solution to the identified concerns and it is minded to accept them, NHS England may consult third parties with a material interest in the matter, such as the Care Quality Commission (CQC).
78. NHS England will consider the extent of any consultation having regard to the circumstances of the matter. Typically, relevant considerations include the best interests of patients (for instance, any risks to patient safety) and the benefits that testing the proposed undertakings may bring through wider engagement. NHS England will consider any responses to its consultation prior to deciding whether to modify, accept or reject the undertakings.
3. Gathering, handling and evaluating information
3.1 Ongoing monitoring
79. There are various ways in which a potential failure to discharge functions (this includes compliance with the rules of the NHS Payment Scheme) or licence breach (including a failure to hold a licence, for a provider) may come to the attention of NHS England. NHS England can investigate these circumstances on its own initiative or in response to third-party information.
80. By collaborating at the local level with ICBs, NHS England is able to identify any potential concerns at a particular organisation within the system. For independent providers, NHS England will gather information and monitor for risks to continuity of services using the approach set out in the Risk Assessment Framework and reporting manual.
81. For ICBs, NHS trusts and foundation trusts, and some NHS controlled providers*, NHS England will monitor and gather information about performance for each of the themes of the NHS Oversight Framework, using both quantitative data and qualitative information.
* NHS controlled providers are not trusts or foundation trusts but are ultimately controlled by one or more NHS trusts or foundation trusts. They are overseen under the NHS Oversight Framework or the Risk assessment framework and reporting manual for independent sector providers of NHS services. This will depend on factors such as the scope of the services provided, size of turnover and whether the provider is a wholly owned subsidiary or is jointly owned by a number of providers.
82. Guidance on performance monitoring and information gathering for independent providers is set out in the Risk Assessment Framework and reporting manual.
83. Should any material concerns emerge, ongoing oversight meetings will be complemented by focused engagement with the provider and/or ICB concerned, and there may also be a requirement to provide additional information to assist NHS England in deciding whether to take action.
84. NHS England may also receive information from other sources such as a third-party ICB or provider, or another third-party entity. This can be either voluntarily or in response to a notice NHS England issues under the licence or legislation to provide information to it (in relation to providers, see Licence General Condition 1, and s104 of the 2012 Act. For ICBs, NHS England has a power to require an ICB to provide information under s14Z60 of the NHS Act 2006). Individuals working in an ICB or provider can be a valuable source of information and NHS England encourages them to come forward in confidence with evidence of potential concerns (Freedom to Speak Up policy for the NHS).
3.2 Gathering information
85. NHS England prefers to give parties an opportunity to provide information voluntarily to assist its enquiries. However, in certain circumstances, it may be more appropriate for NHS England to exercise its formal information gathering powers – for instance, at the request of a party; or because it has concerns that all relevant evidence will not be handed over; or because it has concerns about the accuracy of the information it is given.
86. When considering compliance with licence requirements, NHS England may issue a formal notice for the provision of information to a licence applicant, a licence holder, a provider of NHS healthcare services that is exempt from the requirement to hold a licence, a provider of NHS healthcare services that is in breach of the requirement to hold a licence, or an ICB (s104 of the 2012 Act). Licence holders must also comply with requests for information under licence condition G1.
87. NHS England has a power to require ICBs to provide information to it (s14Z60 of the NHS Act 2006). Where NHS England reasonably suspects that an ICB has failed to comply with this requirement, it may accept undertakings from the infringing ICB to remedy the failure.
88. In practice, NHS England teams use a combination of informal (voluntary) information requests and formal information notices to gather evidence. Information gathering is typically an iterative process. The provision of information can often trigger a request or notice for further information, explanation or clarification. NHS England will look for evidence to establish the possibility a breach is occurring or has occurred.
3.3 How NHS England handles confidential and sensitive information
89. NHS England aims to be open and transparent in its work. As a public body, NHS England must comply with the Freedom of Information Act 2000, which requires it to disclose information unless an exemption can be applied. NHS England also publishes information about its enforcement activities.
90. In carrying out its regulatory and assurance functions, NHS England receives and handles a large amount of information. Some of this is confidential and sensitive, such as deceased and living personal data, disclosure of which may significantly harm the legitimate personal interests of the person to whom it relates (including to that person’s relatives and other close acquaintances). NHS England may disclose information it obtains in exercising its enforcement functions in the cases set out in s13Z3 of the NHS Act 2006. In addition, in relation to personal data, NHS England is bound by data protection legislation (the Data Protection Act 2018 and the UK General Data Protection Regulation (‘UK GDPR’) www.ico.org.uk) and has a designated data protection officer (NHS England as a data controller) who oversees compliance with the relevant legal provisions on data processing (guidance on applicable data protection rules is available at www.ico.org.uk). Further information on how NHS England protects personal data is set out in its privacy policy.
91. Significant harm may be caused to the legitimate commercial interests of an ICB or provider, or to NHS England’s ability to carry out its functions, if confidential information relating to the ICB or licensee or confidential regulatory information is disclosed. For these reasons, NHS England handles confidential and sensitive information with great care, ensuring that it is only used for appropriate purposes* and that it is shared within NHS England or more widely only to the extent strictly necessary for the intended purpose.
*Information NHS England demands under s104(1) of the 2012 Act may be used for any of its regulatory functions, namely its licensing, pricing and special administration functions, and certain functions relating to foundation trusts.
92. Pursuant to s109 and paragraph 10 of Schedule 11 to the 2012 Act, NHS England is not permitted to publish information that prejudices a person’s commercial or personal interests. This includes when publishing information in its annual report about its enforcement action against licenced providers, or an enforcement undertaking.
3.4 Information evaluation and analysis
93. In consultation with the ICB or provider in question and with the assistance of central specialist advisers as appropriate (such as medical, legal, financial and economic experts), NHS England will evaluate and analyse the gathered information to determine whether initial concerns about an ICB or a provider’s potential failure/breach are sufficient to warrant further investigation.
94. This may be done as part of NHS England’s ongoing considerations of an ICB or provider’s support needs, or as a standalone exercise.
95. During this exercise, frequent and ongoing dialogue is likely between the ICB with significant concerns, or provider suspected of committing a breach, and NHS England. There will also be engagement with relevant third parties, as appropriate, and other regulators, such as the CQC, so that NHS England can get as full a picture as possible.
96. NHS England will seek to test the veracity of the evidence in its possession to ascertain whether the legal threshold for enforcement action is met. Analysis is a fluid exercise tailored to the particular facts and circumstances of the matter in hand. Information provided in relation to one potential concern may shed light on another. Equally, early enquiries may suggest concerns of a broad nature but subsequently the focus may narrow or vice versa.
97. The time taken to complete this phase of work can vary considerably, depending on a range of factors including the scope and complexity of the matter; the number and co-operation of parties; the available resources; and the priority of the matter relative to NHS England’s other workstreams.
3.5 Investigations
98. In limited circumstances, it may be appropriate for the information gathering and analysis to be conducted in the context of a formal investigation. An investigation may be opened when NHS England considers a greater level of formality and governance needs to be adopted with respect to its enquiries and/or to ensure appropriate independence.
99. NHS England will keep the ICB or provider informed of any intent to open an investigation, the identity of the investigation team (who may be subject matter experts) and the terms of reference. NHS England will also inform the ICB or provider of the timescales and potential outcomes.
100. Once NHS England has decided to open an investigation, it may request information from the ICB or may use its power to require information.[45] It may also request information from third parties to assist with its investigation. NHS England will try to limit the burdens placed on ICBs and third parties and ensure that its information gathering is focused and proportionate.
101. At any point during an investigation, NHS England may close a case without further action if, for example, it considers that the evidence does not indicate a failure or likely failure to discharge duties or the matters under investigation have been resolved.
4. Outcomes
102. In the case of ICBs, NHS trusts and foundation trusts, the enforcement outcome may be closely connected to decisions about support needs based on the NHS Oversight Framework. Specifically, a decision about mandated support may be subject to formal enforcement action by NHS England as set out in this guidance (in the case of individual trusts this will happen in partnership with the ICB).
4.1 Potential outcomes – ICBs
103. NHS England’s enquiries or investigation may result in any of the following outcomes:
a. No action/informal action – NHS England may not pursue a formal enforcement where the evidence does not indicate a requirement for immediate action or there are other good reasons for not taking formal action (for example, because the issues are not of sufficient priority or the ICB is already taking effective remedial action). NHS England may agree informal action with the ICB, including providing guidance and support, and maintain dialogue and oversight of the ICB in relation to the areas of concern. Should further relevant information come to light suggesting that NHS England should revisit its decision, NHS England may do so at any point and will notify the ICB.
b. Acceptance of undertakings to remedy a potential failure – NHS England may accept undertakings from the ICB to remedy the failure where it reasonably suspects an ICB is failing or has failed to discharge its functions properly or at all;[46] or is concerned that an ICB is at risk of so failing; or reasonably suspects that there is a failure to comply with a requirement to provide information to it. Undertakings set out actions formally agreed between the ICB and NHS England to tackle any concerns identified. Further details on the process relating to undertakings is set out in paragraphs 72 to 75 and 113 to 124.
c. Direct the ICB – NHS England may issue directions where it is satisfied an ICB is failing or has failed to discharge its functions properly or at all; or is at risk of so failing; or that it has failed to comply with the rules of the NHS Payment Scheme. Paragraphs 25 to 29 and 34 set out NHS England’s powers in respect of issuing directions to ICBs.
104. NHS England also has the power to vary an ICB’s constitution/area and to abolish an ICB and merge it with another ICB. NHS England may consider use of these powers if it is satisfied that enforcement action would not adequately address the failure of an ICB that is failing or has failed, although this action is likely to be rare and only in extreme cases.
4.2 Potential outcomes – providers
105. NHS England’s enquiries or investigation may result in any of the following outcomes:
a. No action/informal action – NHS England may not pursue a formal enforcement where the evidence does not indicate a requirement for immediate action or where there are other good reasons for not taking formal action (for example, because the issues are not of sufficient priority or the provider is already taking effective remedial action). NHS England may agree informal action with the provider, including providing guidance and support, and maintain dialogue and oversight of the provider directly or through the relevant ICB in relation to the areas of concern. Should further relevant information come to light suggesting that NHS England should revisit its decision, NHS England may do so at any point and will notify the provider and relevant ICB.
b. Acceptance of undertakings to remedy a breach – NHS England may accept undertakings from the infringing provider to remedy the breach, in conjunction with the relevant ICB, where it reasonably suspects that either healthcare services have been or are being provided without a required licence; or that healthcare services have been or are being provided in breach of a licence condition; or that there has been a failure to comply with a requirement to provide information to it. Further details on the process relating to undertakings is set out in paragraphs 72 to 75 and 108 to 119 below.
c. Imposition of one or more discretionary requirements to remedy a breach – NHS England may require that the infringing party fulfils certain requirements to remedy the breach where it is satisfied that either healthcare services have been or are being provided without a required licence; or that healthcare services have been or are being provided in breach of a licence condition; or that there has been a failure to comply with a requirement to provide information to it. These requirements include one or a combination of the following measures:
i. A compliance requirement that obliges the provider to take specified actions within a specified period to end the breach and ensure that it does not recur. The principal focus of this measure is to ensure swift and comprehensive compliance.
ii. A restoration requirement that obliges the provider to take specified actions within a specified period to restore the situation to what it would have been but for the breach. This measure may be used to compensate any affected party, including healthcare service users and other providers. For instance, an infringing provider may be required to give up any gains it has made from the breach and restore the position of those who have suffered harm as a consequence of the breach.
iii. A requirement on the provider to pay a monetary penalty determined by NHS England of no more than 10% of its turnover in England.
106. NHS England also has the power to impose an additional governance licence condition under s111 of the 2012 Act on foundation trusts (only) or revoke a licence if it is satisfied that the licence holder has failed to comply with a licence condition (s89 of the 2012 Act. In legal terms, NHS England’s power to revoke is distinct from its enforcement powers as on revocation the licence ceases to exist). NHS England can also direct an NHS trust – see paragraph 43.
107. To note, the statutory powers to accept undertakings and impose the discretionary requirements set out above may be applied to an ICB, where it refuses to comply with a formal notice to provide information in relation to NHS England’s regulatory functions – including investigation or enforcement of a (potential) licence breach by a provider (Notices issued under s104 of the 2012 Act).
108. Further details on licence revocation are set out in paragraphs 125 to 127 below.
NHS England’s findings
4.3 Who decides the appropriate outcome for ICB and provider enforcement?
109. For ICBs, NHS trusts and foundation trusts, and certain NHS controlled providers, NHS England’s regional teams take the lead in progressing enforcement matters. Teams are responsible for making recommendations on whether, and if so what, enforcement action is necessary based on the evidence.
110. For certain NHS controlled providers and licensed independent providers of NHS services, the national independent provider team is responsible for ongoing monitoring and also takes the lead in licence enforcement matters, including opening and conducting any necessary investigations.
111. NHS England’s regional or national committees (depending on the type of enforcement action or, in specific circumstances, the geography of the provider) decide whether or not to take enforcement action. The committee consider the recommendations in detail before deciding the outcome, and the regional team then communicate the outcome to the relevant party. In the case of ICBs, NHS trusts and foundation trusts, those decisions are often made alongside support needs decisions based on the NHS Oversight Framework.
4.4 Relationship between undertakings and discretionary requirements/directions
112. Undertakings can be accepted if NHS England has reasonable grounds to suspect a relevant breach or failure. Discretionary requirements (providers) and directions (ICBs), on the other hand, can be imposed only where NHS England is satisfied (in accordance with s14Z61 of the 2022 Act). there is a relevant breach or failure – that is, in the case of an ICB, NHS England must be satisfied that the ICB is failing or has failed to discharge its functions, or that there is a significant risk it will do so.
113. In the case of a provider, NHS England must be satisfied there is a breach of the licence. For these types of enforcement actions, the evidence must provide a degree of certainty of a failure or breach that is higher than reasonable grounds for suspicion.
114. For both ICBs and providers, even where the higher evidence threshold is met – that is, NHS England is satisfied there is a failure/breach– NHS England may opt to accept undertakings rather than impose directions or requirements if it believes that undertakings would represent a viable and appropriate remedial option. Equally, NHS England may consider undertakings in the first instance but later decide based on the circumstances that imposing directions or requirements would be preferable so long as the higher threshold of certainty is met.
115. If NHS England has accepted undertakings in respect of a particular failure or breach, it will not then impose a direction or discretionary requirement (for providers, this is required by s106(4) of the 2012 Act; for ICBs, NHS England will apply the same approach as a matter of policy) in respect of that failure or breach, provided the ICB or provider has complied or may yet comply with the undertaking. NHS England will also not impose a direction or discretionary requirement on more than one occasion in relation to the same breach (for providers, this is required by s105(3) of the 2012 Act; for ICBs, NHS England will apply the same approach as a matter of policy).
4.5 Accepting ICB and provider undertakings
116. The relevant committee of NHS England will take the formal decision to accept undertakings. The undertakings may be agreed in principle, then confirmed with the committee. In other cases, the relevant committee may agree a proposal to seek undertakings, or an outline proposal for undertakings, while authorising that an officer of NHS England approves the final undertakings. Similarly, the ICB or provider will need to confirm its agreement to the undertakings, and this is typically done by way of a board decision.
117. A non-confidential version* will be published shortly after the undertakings have been accepted (publication is required by paragraph 10(1) of Schedule 11 to the 2012 Act in the case of s106 provider undertakings. As a matter of policy, the same approach is to be adopted for other ICB undertakings). The ICB or provider should identify any confidential information it wishes to be redacted prior to publication and provide an explanation as to why disclosure would significantly harm the interests of the person or business to whom or which it relates. NHS England will not accept blanket redactions.
*In the case of provider undertakings, s109 of the 2012 Act prohibits NHS England from publishing commercial information, disclosure of which would or might significantly harm the legitimate business interests of the person to whom it relates, and information relating to the private affairs of an individual, disclosure of which would or might significantly harm that person’s interests.
118. Once undertakings are agreed and in place, NHS England will notify certain stakeholders of the action that has been taken. For ICBs this will depend on the relevant issues. Stakeholders may include:
a. the relevant integrated care partnership
b. NHS bodies within the system
c. other relevant regulators, such as the CQC.
119. In the case of provider undertakings, the notification is a statutory requirement. The listed stakeholders (s110 of the 2012 Act) are:
a. the relevant ICB(s)
b. other relevant regulators, such as the CQC.
120. By agreement with the ICB or provider, NHS England may vary undertakings that have been accepted, including terms relating to action to be taken and the period within which such action must be taken. The new undertakings will be published following the same procedure on confidentiality set out in paragraph 113.
121. Where NHS England is satisfied that an ICB or provider has complied with an enforcement undertaking, it will issue a compliance certificate to that effect. Typically, NHS England will voluntarily propose a compliance certificate when it is satisfied that there is sufficient evidence of compliance. However, the ICB or provider may apply to NHS England at any time for a certificate and NHS England will give its decision within 14 days*.
*A response within 14 days (starting on the day after the day on which the application is received) is required by paragraph 12(4) of Schedule 11 to the 2012 Act (in the case of provider undertakings). ICB undertakings are not subject to these statutory requirements, but as a matter of policy NHS England will take the same approach
122. Should NHS England refuse an application for a compliance certificate in relation to a provider undertaking (this would include an ICB undertaking accepted where it was in breach of a requirement to provide information by a notice under s104 of the 2012 Act) its refusal decision may be appealed on the grounds that it was based on a factual error; was wrong in law; or was unfair or unreasonable (paragraph 13 of Schedule 11 to the 2012 Act (provider undertakings)). See section 6 on how to appeal.
123. After accepting an undertaking, if information comes to NHS England’s attention that indicates the ICB or provider has supplied it with inaccurate, misleading or incomplete information relating to matters relevant to the undertakings, NHS England may treat the ICB or provider as having failed to comply with the undertakings. In that case, after giving notice, NHS England may revoke any compliance certificate it may have previously issued to the ICB or provider.
4.6 Imposing additional provider licence conditions and removing, suspending or disqualifying directors or governors (NHS trusts and foundation trusts only)
124. Section 111 of the 2012 Act gives NHS England specific powers to take action where the governance of a foundation trust is such that it is failing, or will fail, to comply with one or more conditions of its licence. In those circumstances, NHS England may impose an additional governance licence condition and, if that condition is breached, can remove directors or governors.
125. Before imposing an additional licence condition on a foundation trust, NHS England will follow a similar process to that set out above for undertakings or discretionary requirements. That is, NHS England will gather information to determine whether there is evidence of governance failure and, if the appropriate threshold is met, it will set out the case for imposing the additional condition.
126. NHS England will explain to the foundation trust any action it proposes to take by issuing a notice of intention to impose an additional licence condition and will give the trust an opportunity to submit representations on its proposal before it makes a final decision. The decision will be made by the relevant NHS England committee.
127. Where an additional condition is in place, NHS England’s regional team will monitor compliance with the condition and if NHS England is satisfied that the governance risk has been mitigated, it will remove the additional condition from the foundation trust’s licence.
128. On the other hand, if the foundation trust has failed to comply and action for breaching the condition is a potential outcome, NHS England will engage with the foundation trust and advise on the process to be followed. That outcome may be the removal of directors or governors and/or a requirement to appoint new temporary directors or governors determined by NHS England.
4.7 Revocation of a provider licence
129. NHS England may revoke a provider’s licence if it is satisfied that the licence has been breached and that enforcement action would not adequately address the breach. Such action is however likely to be rare and applied only in extreme circumstances.
130. Revocation would mean that the provider could not lawfully provide NHS services. As such, NHS England considers that this remedy would only be used exceptionally after careful consideration. In making its decision, NHS England will have regard to factors such as the seriousness of the breach; ensuring provider compliance; deterring similar breaches; and whether taking away the licence would be proportionate to the breach. If revocation for breach is a possibility, NHS England will engage the provider and advise on the process to be followed.
131. There may be reasons for revoking a licence other than licence breach. Licensed independent providers and NHS controlled providers wishing to revoke their licence should refer to NHS England’s guidance on how to apply to revoke their licence.
5. How to appeal certain enforcement decisions
132. A decision by NHS England to impose a discretionary requirement; or a non-compliance penalty; or to refuse to issue a compliance certificate in relation to a provider enforcement undertaking under s106 of the 2012 Act, may be appealed to the First-tier Tribunal.
133. In the case of a discretionary requirement, the grounds for an appeal are that (Paragraph 3 of Schedule 11 to the 2012 Act):
i. the decision was based on an error of fact;
ii. the decision was wrong in law;
iii. in the case of a variable monetary penalty, the amount of the penalty is unreasonable;
iv. in the case of a compliance requirement or restoration requirement, the nature of the requirement is unreasonable; or
v. that the decision is unreasonable for any other reason.
134. In the other cases, the grounds for an appeal are that the decision was (paragraphs 6 and 13 of Schedule 11 to the 2012 Act):
i. based on an error of fact;
ii. wrong in law; or
iii. unfair or unreasonable.
135. The tribunal may confirm NHS England’s decision or direct that it is not to have effect.
136. In the case of an appeal against a provider discretionary requirement, the requirement is suspended pending the appeal outcome (paragraph 3(3) of Schedule 11 to the 2012 Act). The tribunal may confirm, vary or withdraw the discretionary requirement; take such steps as NHS England could take in relation to the breach; or remit to NHS England the decision whether to confirm the requirement, or any matter relating to the decision (paragraph 3(4) of Schedule 11 to the 2012 Act).
137. In the case of appeal against a non-compliance penalty, the penalty is suspended pending the appeal outcome (paragraph 6(3) of Schedule 11 to the 2012 Act). The tribunal may confirm, vary or withdraw the non-compliance penalty, or remit to NHS England the decision whether to confirm the penalty, or any matter relating to that decision (paragraph 6(4) of Schedule 11 to the 2012 Act).
138. In the case of an appeal against a decision to refuse an application for a compliance certificate, the tribunal may confirm the decision or direct that it is not to have effect (paragraph 13(2) of Schedule 11 to the 2012 Act).
139. A decision of NHS England to refuse to issue a licence or to revoke a licence may also be appealed to the tribunal (s92(1) and (2) of the 2012 Act. The grounds for appeal are that the decision is based on an error of fact; or is wrong in law; or is unreasonable). The tribunal may uphold the decision; or direct that the decision is not to have effect; or remit the decision to NHS England (s92(3) of the 2012 Act).
140. Guidance is available on how to make an application to the tribunal.
141. The right of appeal does not apply to a decision by NHS England to give a direction to an ICB, or to refuse to issue a compliance certificate in relation to an ICB enforcement undertaking.