Rules and ethics
Part of Healthcare reputation management: CQC and patient feedback rules
Healthcare reputation management: CQC and patient feedback rules
How CQC uses patient feedback and online reviews, what the UK data protection and advertising rules require, and how GP practices should reply.
What to take away
- The CQC treats patient feedback as evidence of how care is experienced, not as a marketing metric.
- A public reply that confirms the writer is a patient discloses health data, so keep replies generic.
- Regulation 16 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 covers complaints and comments.
- Patient quotes used in your own advertising count as testimonials under the CAP code.
Where the CQC sits in patient feedback
The Care Quality Commission registers, monitors and rates health and social care providers in England. Its published ratings of Outstanding, Good, Requires improvement and Inadequate are read by patients, commissioners and local authorities, so a review profile and a regulatory record are usually seen together.
How feedback reaches the CQC
- NHS patient survey programme
- Comments from people who use services
- Information published elsewhere
- CQC asks: is feedback gathered and acted on?
Feedback reaches the CQC by more than one route. It coordinates the NHS patient survey programme, receives comments from people who use services, and considers information published elsewhere. The question it asks is whether a provider gathers feedback and acts on it. A GP practice sees the same material in several places: the NHS website listing, Google, and any survey it runs itself.
Regulation 16 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires a system for receiving and responding to complaints and comments. A negative review that is answered nowhere and logged nowhere is a gap in that system. A dispute can pass through several desks, as the guide to UK review rules and compliance sets out.
Data protection rules for public replies
A review that describes a condition, a treatment or a date of care contains personal data, and health information is a special category of it. Holding that data needs a lawful basis, and the health element needs a condition from Article 9 as well. The ICO UK GDPR guidance covers lawful bases and the rights that follow.
Rules for a public reply
- Acknowledge the comment only
- Offer a private route
- Never confirm a patient relationship
- Keep notes factual and dated
- Answer a subject access request in one month
A public reply should do two things only: acknowledge the comment and offer a private route. A reply that apologises for painful treatment tells every reader that the writer is a patient.
Patients can also ask what you hold about them, and the UK GDPR allows one month to answer a subject access request. Keep review notes factual, dated and separate from clinical records.
Advertising, surveys and the codes
Patient stories and review quotes used in your own marketing are testimonials. The CAP Code advertising rules require them to be genuine, to reflect the person's actual opinion and to be held with permission. Editing a quote until it says the opposite of what was meant breaks that rule.
Comparative claims need evidence too. Calling a practice the highest rated in the county is a claim, and a star average is not evidence unless you can show where it came from and over what period.
The main feedback routes differ in who controls them and what a reply may contain.
| Feedback route | Who sets the rules | What it shows | Point to watch |
|---|---|---|---|
| CQC inspection and ratings | CQC | Regulatory judgement, published with the inspection report | Ratings rest on inspection evidence, not star averages |
| NHS patient survey programme | Coordinated by the CQC | Comparable experience data across services | Small samples at practice level need careful reading |
| Google or NHS website reviews | The platform | Public commentary from patients and visitors | Reply in generic terms and never confirm a patient relationship |
| Testimonials on your own site | You, under the CAP Code | Marketing claims about your service | Consent, accuracy and the source record must be held |
Handling one disputed review
A repeated sequence keeps the public reply, the complaint record and the marketing claim in step.
- Capture the review, its URL and its date before anything changes.
- Decide whether it contains personal data or an allegation you can check.
- Reply in one or two sentences, then offer a private channel.
- Log the case in the complaints system and record what happened.
- Report it to the platform only if it breaches that platform's own policy.
The steps for responding to negative Google reviews carry over to a clinical setting, with one addition: nothing that identifies a patient belongs in the reply.
Common questions
Does the CQC police online reviews?
No. The CQC assesses whether a service gathers, considers and acts on feedback. Platform rules decide what stays published, and any claim about defamation or data protection is a separate matter.
Can a practice ask a patient to remove a review?
You can ask, but the request must not read as pressure, and offering anything in return for removal is best avoided. Heavy-handed tactics sit badly against the CQC expectation of listening to people who use services.
How long should review records be kept?
There is no single retention period for review correspondence. Keep it only while you need it for the purpose you collected it, then delete it, and record that decision in a retention schedule.
