There is no single national checklist containing every policy that every GP practice must have. The policies a practice needs will depend on its legal obligations, NHS contractual requirements, the services it provides, its workforce, premises, clinical activities and local arrangements. In practice, however, a GP surgery will usually need policies covering core areas such as clinical governance, safeguarding, medicines, infection prevention and control, information governance, complaints, health and safety, workforce management and business continuity. The important point is not simply how many policies sit in the practice library. A good policy library should describe how the practice actually works, allocate responsibilities clearly and give staff reliable guidance when they need it. For practices in England, this also forms part of the wider evidence of effective governance that the Care Quality Commission may consider when assessing the service. CQC Regulation 17 requires providers to establish and operate effective systems and processes for good governance, including managing quality, safety and risk.
-
No single CQC checklist tells an established GP practice that it must hold a specified set of, for example, 50 or 100 policies.
CQC's approach is broader. It looks at whether the systems, processes and governance arrangements operating within the service are effective. Its own guidance on governance refers to areas such as risk assessments, policy reviews, significant events, patient feedback, prescribing and clinical audit, while making clear that its examples are not a definitive list.
That distinction matters.
It is easy for practices to approach policy management as a document-collection exercise. A template is downloaded, given a review date and placed in a folder. Technically, there is now a policy. Operationally, very little may have changed.
CQC guidance takes a more practical view. For example, its guidance on practice induction says practices should have clear, regularly reviewed policies and procedures and should be able to demonstrate that staff understand them, receive appropriate training and can access the information they need.
So the better question is not simply:
“Do we have the policy?”
It is:
“Do we have an appropriate system for managing this area of risk, and does our documentation accurately describe it?”
For GP practices outside England, the same broad governance principle applies, but the relevant regulator and national contractual requirements will differ.
What are the main policy areas a GP practice should cover?
Most GP practices will need a policy library covering several broad areas. The precise documents within each category should reflect what the practice actually does.
Clinical governance and patient safety
These policies and procedures describe how the practice manages clinical risk and delivers safe care.
Depending on the practice, this may include:
significant events and learning from incidents
patient safety alerts
management of test results and clinical correspondence
referrals
consent and mental capacity
chaperoning
emergency care and resuscitation
clinical audit and quality improvement
duty of candour
management of deteriorating patients
clinical record keeping.
Some of these areas may be better expressed as a procedure or protocol rather than a lengthy policy.
For example, CQC asks practices to demonstrate safe and effective systems for managing test results and clinical correspondence. It also expects practices to have systems for receiving, disseminating and acting on relevant patient safety alerts, with appropriate clinical oversight.
The documentation therefore needs to reflect the actual pathway. Who receives an abnormal result? Who acts on it? What happens when the responsible clinician is absent? How are outstanding results monitored?
Those operational details are often more important than several pages of background texts.
-
GP practices should have clear safeguarding arrangements for both children and adults at risk.
CQC guidance says practices should have designated safeguarding leads and staff should understand internal reporting arrangements and relevant local procedures. Its guidance specifically refers to the practice safeguarding adults policy and expects safeguarding to be integrated into practice systems and processes.
A useful safeguarding policy therefore needs to go beyond a generic description of abuse.
It should reflect local referral routes, named leads, escalation arrangements, record keeping and the action staff should take when a concern arises.
Contact information deserves particular attention. A beautifully written safeguarding policy is not much help if the telephone number or referral route it contains stopped being correct two years ago.
-
Practices need clear arrangements for medicines safety, although the documents required will depend on the services provided.
Relevant areas may include:
prescribing
repeat prescriptions
high-risk medicines
medicines reconciliation
controlled drugs
emergency medicines
vaccine storage and cold chain
prescription security
Patient Group Directions where used
medicines incidents
antimicrobial stewardship.
CQC's medicines optimisation quality statement considers whether medicines are prescribed, supplied and managed safely and in accordance with legislation, national guidance and best available evidence. It also looks at issues such as controlled drugs, storage, prescribing and medicines governance.
The practice does not necessarily need a separate policy for every subsection. In some cases, a well-structured medicines management policy supported by specific protocols will be easier for staff to use.
-
This is one area where CQC guidance is particularly explicit.
CQC says general practices should have an effective infection prevention and control policy which is relevant to the practice, accessible to staff and regularly updated. Its guidance identifies areas including higher-risk procedures, training, personal protective equipment and responsibility for cleaning clinical equipment.
The policy should therefore match the services provided.
A practice carrying out minor surgery, coil fittings or other invasive procedures will have different requirements from one providing a more limited range of clinical services.
Associated documentation may include cleaning schedules, infection control audits, waste arrangements, sharps procedures and specimen handling.
-
A GP practice handles substantial quantities of confidential and special-category personal data, so its information governance arrangements should be proportionate to that risk.
Relevant documentation will commonly cover areas such as:
data protection
confidentiality
information security
records management
data breaches
access to records
subject access requests
information sharing
data retention
use of email and electronic systems
home and remote working where applicable.
The ICO states that accountability under UK GDPR means organisations must take responsibility for compliance and be able to demonstrate it. It identifies proportionate policies and procedures, records, training and monitoring as parts of that accountability approach.
Again, the existence of the policy is only part of the evidence.
A practice should be able to show that its information governance arrangements are implemented. That might include staff training, breach records, DPIAs, access controls, audits and documented decisions.
Policies should also be reviewed when legislation or authoritative guidance changes. The ICO has, for example, been updating parts of its guidance following the Data (Use and Access) Act 2025.
-
What health and safety and premises policies are needed?
GP practices are employers as well as healthcare providers, so general health and safety law applies alongside healthcare regulation.
Every employer must have arrangements for managing health and safety. Where an organisation has five or more employees, its health and safety policy must be recorded in writing. The HSE says the written policy should set out the organisation's approach, responsibilities and practical arrangements for managing health and safety.
Depending on the practice and premises, related documents may cover:
fire safety
lone working
display screen equipment
slips, trips and falls
manual handling
COSHH
sharps injuries
needlestick procedures
electrical safety
medical equipment
waste management
security
violence and aggression
legionella and water safety
emergency evacuation.
Not every one of these necessarily needs to be called a “policy”. Risk assessments, procedures, checklists and maintenance records may provide more useful evidence in some areas.
That is an important distinction when reviewing a large policy library. Sometimes the problem is not a missing policy. It is a missing operational control.
-
A GP practice should also have employment policies appropriate to its workforce and legal responsibilities.
These will commonly include matters such as:
recruitment and pre-employment checks
induction
equality, diversity and inclusion
dignity at work
disciplinary procedures
grievance procedures
sickness absence
flexible working
family-related leave
annual leave
performance and capability
training and development
whistleblowing or speaking up
use of social media and IT
professional registration checks.
The exact set will depend on the workforce, employment arrangements and services provided.
Practices should avoid confusing employment-policy requirements with CQC requirements. CQC is interested in whether staff are suitably qualified, competent, skilled and supported, but it does not prescribe a single definitive list of mandatory training for every member of a GP practice team.
The same principle applies more broadly to workforce documentation. Practices need systems that meet employment law, professional and regulatory requirements, rather than simply accumulating policies because another surgery happens to have them.
-
What patient-facing and administrative policies should be included?
A number of policies and procedures govern how patients interact with the practice.
These may include:
complaints
patient registration
access
reasonable adjustments
confidentiality
consent
chaperones
zero tolerance or unacceptable behaviour
removal of patients from the practice list
interpretation and communication support
equality and accessibility.
Complaints arrangements deserve particular attention. Regulation 16 requires complaints to be investigated and appropriate action taken when failures are identified. CQC guidance also says staff should know how to respond when they receive a complaint.
A complaints policy sitting on the shared drive is therefore insufficient if reception staff are unsure what to do when a patient raises a concern at the desk.
Patient registration is another example where national requirements and local processes need to align. CQC guidance reflects NHS contractual expectations around registration and makes clear that practices cannot impose inappropriate documentation requirements on patients seeking to register.
-
Practices should have documented business continuity arrangements so essential services can continue or recover during significant disruption.
The document may be called a business continuity plan rather than a policy, which is usually more accurate.
CQC guidance identifies scenarios such as loss of premises, IT disruption, staffing shortages and supplier failure. It recommends identifying essential functions, responsible individuals, recovery arrangements, communication routes and access to up-to-date plans.
A useful business continuity plan should be practical enough to use during an incident.
If the internet connection fails at 8.15 on Monday morning, staff need to know what to do next. A 40-page document describing the theory of business continuity is unlikely to be much help.
-
No. A core library may be similar between practices, but the final set should reflect the services, workforce, premises and risks of that particular practice.
For example, additional arrangements may be required for practices providing:
minor surgery
contraceptive procedures
travel health services
anticoagulation monitoring
enhanced services
dispensing services
research
training placements
specialist clinics.
CQC's assessment framework reflects this risk-based approach. Its quality statements consider areas such as safeguarding, infection prevention, medicines optimisation, safe staffing and safe systems, rather than measuring the number of policies held by the provider.
This is why simply copying another practice's library is rarely a satisfactory solution.
The other practice may provide different services, operate from different premises, use different clinical systems or follow different local pathways.
-
Practice Managers often inherit policy libraries rather than create them from scratch.
Over several years, documents can accumulate from different providers, managers, websites and template libraries. It is then quite possible to find three versions of the same policy, different review dates and no obvious way of knowing which document staff should be following.
Common problems include:
policies copied from templates but never properly personalised
old and current versions available in the same folder
review dates that have expired
documents naming staff who have left
references to systems the practice no longer uses
outdated external links
procedures that do not match what staff actually do
unclear policy ownership
policies stored across several locations
staff being expected to read large numbers of documents regardless of relevance to their role.
A recent review date does not by itself prove that a policy is current. Someone needs to check the content.
Potential PolicyEase insight: this would be a useful point at which to add future anonymised evidence from policy reviews, such as the types of outdated references, duplicate documents or personalisation problems most commonly identified. No figures should be added until there is sufficient first-party data to support them.
-
A sensible starting point is to audit the library by risk and function rather than attempting to read every document alphabetically.
Check:
Coverage
Are the main clinical, safeguarding, medicines, IPC, information governance, health and safety, workforce, patient-facing and business continuity areas covered?Relevance
Does each document apply to the services the practice actually provides?Personalisation
Are named roles, systems, locations, referral pathways and contact details correct?Ownership
Is someone responsible for each important policy or policy group?Review status
Is the review date appropriate, and has the content genuinely been checked rather than simply re-dated?Version control
Can staff easily identify the current version?Accessibility
Can staff find the document quickly when they need it?Implementation
Does practice activity match what the policy says?Communication
Have important changes been communicated to the staff affected?Evidence
Where appropriate, is there evidence such as training records, audits, risk assessments, logs, meeting minutes or read-and-understood records showing that the arrangements operate in practice?
-
If the policy library has become difficult to manage, do not begin by rewriting everything.
Start by producing a complete inventory.
Identify the policies dealing with the highest risks first, particularly safeguarding, medicines, infection prevention, clinical safety, information governance, health and safety and emergency arrangements.
Remove or archive duplicate and superseded documents so staff have one clear source of truth.
Then assign ownership and review dates.
Finally, compare what each important policy says with what actually happens in the practice.
That last step is often the most revealing. A policy library should not describe an idealised version of the surgery. It should document a safe, lawful and workable version of the surgery that staff recognise.
