What to set up and keep doing, from your first patient to NHS work and prescribing, for clinics in England.
This is a guide, not a complete list. It may not cover everything your clinic needs, and rules change. Check each item against its source and your contract, and get advice from a qualified professional, such as a solicitor or compliance adviser, before you rely on it. Last updated 20 October 2026.
63 itemsapply to your clinic
Show my checklist0%ready
0 of 54 set-up tasks done, 54 still to check.
Diagnosing ADHD or autism on its own is not a regulated activity today, so a diagnosis-only service does not need to register. Prescribing, medication titration and other treatment led or supervised by a doctor, nurse or other listed professional is regulated, and the whole service then needs registering. Clinical psychologists and occupational therapists are not on that list.
Watch out: Follow-up after diagnosis can count as treatment if a doctor or nurse leads or supervises it, so check post-diagnostic reviews as well as prescribing.
On 9 October 2026 the government asked CQC to regulate all ADHD and autism diagnostic assessments, for NHS-funded and self-funding patients alike, once new regulations are in place. No start date has been set. Working to CQC's fundamental standards now makes registering easier when it comes. If you hold an NHS contract, it already requires you to meet them.
Watch out: Right to Choose asks for CQC registration for the regulated activities relevant to your services. Ask your ICB whether it will contract with a diagnosis-only provider that is not registered.
Apply to CQC for the regulated activity "treatment of disease, disorder or injury". The application includes a statement of purpose: your aims, the services you offer, where you offer them, your regulated activities and who manages them. Organisations and partnerships need a registered manager, who applies to CQC separately and is interviewed, and organisations name a nominated individual. An individual applicant, and each partner, needs an enhanced DBS check issued in the last 12 months; the nominated individual and the manager need enhanced checks too. Directors must meet the fit and proper person requirements.
Watch out: Treating patients before you are registered is a criminal offence. CQC sends back applications with missing information, which restarts the wait.
Read our guide to what CQC registration involves and why it can take months.
Safeguarding, complaints, governance and record keeping, staffing and supervision, recruitment, duty of candour, and infection prevention and control if you see patients in person. Registered providers must meet these standards, and both forms of the NHS Standard Contract require them too, even if you only diagnose. For a private, diagnosis-only clinic they are good practice, and CQC is expected to regulate you.
NICE says ADHD should be diagnosed by a specialist psychiatrist, paediatrician or other appropriately qualified healthcare professional, and autism should be assessed by a multidisciplinary team. For children and young people, NICE says the autism assessment should start within 3 months of the referral to the autism team. NHS England's 2026/27 payment guidance asks ICBs to expect the same.
The Mental Capacity Act applies from age 16. Under 16, a child who understands can consent for themselves (Gillick competence); otherwise a person with parental responsibility consents. Tell parents, teachers and other informants how their answers are used. If you record consultations, or use a tool that captures audio, ask the patient or parent first and have a policy for how recordings are kept.
Set out how staff raise a concern about a child or adult, who they tell and how you refer to the local authority. Agree which cases count as complex or high risk. NHS contracts ask for named leads for children, adults, child sexual abuse and exploitation, and the Mental Capacity Act. The full-length contract also asks for a Prevent lead, Prevent awareness training and a yearly audit of safeguarding training.
Tell patients how to complain and what happens next, and log and answer every complaint. Since 19 June 2026 the law also asks every organisation to give people an easy way to complain about how their data is used, such as an online form, to acknowledge each of those complaints within 30 days and to reply without undue delay. For NHS patients the NHS complaints rules apply: name a responsible person and a complaints manager, acknowledge each complaint within 3 working days, display how to complain with details of local Healthwatch and the Parliamentary and Health Service Ombudsman, and send your commissioner a yearly report. The Ombudsman does not cover privately funded care, so private clinics often join the Independent Sector Complaints Adjudication Service.
When a notifiable safety incident happens, tell the person in person as soon as you reasonably can, apologise, and follow up in writing.
The duty is anticipatory: plan now for the needs of autistic and ADHD patients, such as quieter waiting areas, longer appointments, written information and flexible formats, rather than waiting to be asked. For NHS patients the Accessible Information Standard also applies: identify, record, flag, share, meet and review each patient's communication needs. The 2025 revision added the review step.
Many questionnaires and standardised assessments are copyrighted, and their publishers set terms for clinical use, for use by a paid service and for putting them on a digital platform. Check the terms for each tool before you build your pathway around it.
Watch out: Some publishers do not allow their tools on a third-party platform at all, and some free tools still need a licence or sub-licence for a paid service. Ask early, because permissions can take weeks.
By law, doctors, nurses and HCPC-registered professionals, such as psychologists, occupational therapists and speech and language therapists, must each have indemnity to practise. The clinic needs cover for the service it runs, including clinicians who work for it on a sessional basis. If you employ anyone, employers' liability cover of at least £5 million is compulsory from the first day, and you must display the certificate where staff can see it, which can be on your intranet. An NHS contract also asks for clinical negligence, professional negligence and public liability cover, and for your sub-contractors to hold it too.
Watch out: An NHS contract can ask for more cover than the tender or framework did. Read the contract's indemnity clause, not just the tender, and get a written quote early. You must show proof within 5 working days if your commissioner asks, and if you close, check you have cover for claims made later.
Assess the risks to staff and patients from your premises and the way you work, including for staff who work from home. Once you have 5 or more employees, write down your health and safety policy and the main findings of your risk assessment. If you have premises, the person responsible for them must also carry out a fire risk assessment, write it down whatever your size, put safety measures in place and plan for an emergency. If a landlord shares this duty, agree who does what.
You must not advertise in a way likely to lead to the use of a prescription-only medicine, so do not promote ADHD medication. Advertising also has to follow the Advertising Standards Authority's code.
Watch out: The Fonagy review proposes banning adverts for NHS-funded assessments aimed at the public. It is a proposal, not yet a rule.
Every organisation that handles personal data pays a yearly fee to the Information Commissioner's Office unless it is exempt, and a clinic is very unlikely to be exempt. Most small clinics are in tier 1, which covers a turnover of up to £632,000 or up to 10 staff.
Watch out: The renewal is easy to miss. Pay by Direct Debit so it renews on its own. The ICO became the Information Commission on 30 September 2026; the fee and the duty are unchanged.
A DPO is required when an organisation handles health data on a large scale. A clinic with several clinicians has to make a judgement and record it.
Watch out: You can buy in a DPO service, but your software supplier's DPO works for the supplier. As the organisation responsible for patient data, you need your own advice.
Keep a record of what data you process, why, who you share it with and how long you keep it. The exemption for organisations with fewer than 250 staff does not cover health data. Tell patients how you use their data, and tell the parents and teachers who fill in questionnaires too, because they give you data about the patient. If you DBS-check staff, you also need an appropriate policy document. Give people a copy of their records within one month of asking, free of charge.
A DPIA is needed when processing is likely to be high risk, and health data about vulnerable people, including children, usually is. The ICO gives a hospital processing patient data as an example that needs one, and an individual doctor as one that does not. It records the risks to patients' data and how you reduce them. Do one for the service and update it for each new system. NHS buyers ask to see it.
Watch out: The DPIA is yours, as the organisation responsible for the data. A supplier's DPIA helps you write it but does not replace it.
Your clinical system, video platform, email, transcription and storage suppliers process data for you. The law says what each contract must cover, including security, sub-processors, and deletion or return of data when the contract ends. If data leaves the UK, for example to a US-hosted tool, you also need a lawful transfer route, such as the UK-US data bridge or the ICO's international data transfer agreement. NHS contracts ask you to check each supplier before it handles patient data and to record the checks.
Watch out: Check where each supplier stores data, including the video platform. Commissioners ask whether patient data stays in the UK.
The Records Management Code has no ADHD or autism category, and its periods are minimums. Many providers use its mental health period, 20 years or 10 years after death; the general adult period is 8 years. Children's records are kept until their 25th birthday, or 26th if they were 17 when care ended. Choose your periods, write down why, and follow them.
Report a personal data breach that puts people at risk to the ICO within 72 hours of finding it, and tell the people affected if the risk is high. Keep a log of every breach, including ones you do not report. NHS providers report through the incident tool in the Data Security and Protection Toolkit, which passes reportable breaches to the ICO for you, so do not report twice. Tell your commissioner on or before the day you report.
Check doctors on the GMC register, nurses on the NMC register, and psychologists, speech and language therapists and occupational therapists on the HCPC register. "Psychologist" on its own is not a protected title: look for "practitioner psychologist" or "clinical psychologist". Track renewal dates too: doctors revalidate every 5 years through a designated body, nurses revalidate with the NMC every 3 years, and HCPC registrants renew every 2 years.
Enhanced checks with the right barred list for clinicians. A standard check for admin staff who have contact with patients, including by phone or online, and a basic check for staff with no patient contact. The law sets no recheck interval: decide one by risk, or use the Update Service, and write down why. If you remove someone for harming a patient or putting one at risk, you must refer them to DBS.
Check before anyone starts. Since 1 October 2026 the checks also cover individual workers and self-employed sub-contractors, such as sessional clinicians paid directly, for engagements that start on or after that date. Clinicians you engage through their own limited company are not covered. If an agency supplies clinicians, get written terms that it does the checks.
Proof of identity, references, qualifications, registration, DBS, right to work, employment history with gaps explained, and a check that they are fit for the role on health grounds. CQC checks these files on inspection, and NHS contracts ask you to follow the NHS Employment Check Standards.
Every member of staff needs adult safeguarding training at the level for their role. For registered clinicians who see adults, level 3 is a suggested 8 hours over 3 years. Clinical staff who assess children and young people need level 3 children's safeguarding, and the children's document also puts adult mental health clinicians who see parents or carers at level 3. The 2025 intercollegiate document for children sets the competences and leaves it to providers to decide how long and how often training runs. NHS contracts also ask for Mental Capacity Act training.
Everyone does a 90-minute e-learning module, then the tier that fits their role: tier 1 adds an hour's live online session, and tier 2, which most assessing clinicians are likely to need, adds a day in person. Diagnosis-only clinics are not bound by the law today, but every NHS Standard Contract requires the training.
Staff need the supervision, training and appraisal to do their job safely. Appraisals also feed doctors' revalidation.
Name a Clinical Safety Officer, a registered clinician trained in clinical risk management, and keep a hazard log and safety case for how you use each health IT system: your patient record, assessment platform, video calls and any AI tools. Write down the procedures and training each system needs, such as a clinician reviewing every report, and record them as controls in the hazard log. Suppliers do the matching standard, DCB0129, for their product.
Watch out: DCB0160 is the clinic's job, not the supplier's. Ask each supplier for their DCB0129 safety case and hazard log, and which features you will use, so your assessment matches.
For each system that holds patient data, collect: DSPT status, the DCB0129 safety case, DTAC, Cyber Essentials, a penetration test less than 12 months old, the list of sub-processors and where data is stored. The DTAC belongs to the supplier: when a buyer asks for one, share the supplier's with a short note of your own checks. DTAC version 2.0 replaced the old form in April 2026.
Watch out: NHS buyers often send a cloud security questionnaire written for software companies, and send back answers without evidence attached. Ask your suppliers for their evidence pack before you need it.
Since July 2026 the MHRA says AI scribes used only to transcribe, summarise or draft, with a clinician reviewing, are not medical devices; tools that support a diagnosis are. A clinician must review every output and make every clinical decision, and the law strictly limits decisions about health made by automated means alone. Update your DPIA and clinical risk assessment for each tool.
For Right to Choose, you ask an ICB to assess you against four tests: CQC registration for the regulated activities you provide, an NHS provider licence unless you are exempt (most small providers are, as the exemption covers NHS income under £10 million a year), being able to meet the NHS Standard Contract, and indemnity. It has 6 weeks to decide, and your contract must be signed and in effect before you take a referral. Once you hold one, you must accept Right to Choose referrals from ICBs that are not party to it. Other services are bought by ICBs and NHS trusts through tenders, frameworks and direct awards under the Provider Selection Regime. When a trust sub-contracts work to you, your contract is with the trust and its duties pass down to you.
Check the indemnity clause, the reporting schedule and KPI definitions, the activity plan, the data protection schedule (which may make the buyer the controller of patient data and you its processor), the data you must submit, and how you will receive referrals and NHS numbers. Small providers usually get the shorter-form NHS Standard Contract, but the buyer decides.
Watch out: Requirements that were not in the tender or framework often appear once the contract is drawn up. Ask for the draft contract and the full list of mobilisation documents early. The contract also bars you from treating anything unrelated to the referral without the GP's agreement, such as adding an autism assessment to an ADHD referral.
The NHS's code for your organisation. You need it before the Data Security and Protection Toolkit, NHS email, smartcards, the e-Referral Service and national data submissions, so ask for it first. Search the ODS portal first in case you already have one, then request it through the National IT Customer Support Portal.
Send patient data only by a secure route. NHSmail is accredited; any other email service needs accreditation to the NHS secure email standard (DCB1596), which needs an ODS code and takes months. If you are commissioned locally, your commissioner should sponsor NHSmail accounts for the length of the contract; only providers delivering NHS care nationally apply directly, and either way you need an ODS code and a published toolkit. Agree with the buyer how referrals and patient letters will reach you, and who watches the inbox.
Watch out: Some buyers send referrals by ordinary email by default. Agree a secure route before go-live so patient data only goes where your DPIA says it does.
Create a Directory of Services entry for each service and location, with a named lead clinician. Services patients can choose must be visible to referrers across England. For mental health services the contract asks for reasonable endeavours to list them. Staff need an NHS Care Identity login to use it: a smartcard, or another approved method such as Windows Hello or a security key, issued through a Registration Authority your commissioner can point you to.
Put the patient's verified NHS number on records, letters and data submissions. You can look numbers up through the Personal Demographics Service once you have access, which needs an NHS Care Identity login.
Watch out: Ask your commissioner how you will get NHS numbers for referred patients. Your data submissions need them.
All providers of NHS-funded ADHD and autism services must submit data. Services commissioned as mental health submit to the Mental Health Services Data Set (MHSDS); services commissioned as community paediatrics submit to the Community Services Data Set (CSDS) and report assessment waiting times to the Community Health Services SitRep. If your service is led by a medical consultant, such as a consultant psychiatrist, you also send weekly waiting list data and a monthly referral to treatment return. Agree with your commissioner whether yours is.
Watch out: This is the item new providers most often miss. Ask your commissioner which data set applies and register before your first month of activity ends.
An Indicative Activity Plan sets how much activity the ICB expects to pay for in the contract year. If you cannot agree one, the ICB can set it, and if none is set the plan counts as zero. The ICB can then use an Activity Management Plan to limit activity. A plan set by your main ICB does not apply to patients from other ICBs.
Name an accountable emergency officer and write an incident response plan and a business continuity plan, so patients are looked after if systems, staff or premises fail. Test the plans with an exercise.
Ask NHS patients whether their experience was good, send the numbers to NHS England every month through the Strategic Data Collection Service, and share the results locally.
The Caldicott Guardian protects how patient information is used, the Senior Information Risk Owner owns information risk, and the information governance lead runs the day-to-day work. The Caldicott Guardian and SIRO should not normally be the same person. Give the names to your commissioner and record them in the toolkit.
Watch out: If you are very small, the guidance lets you ask your commissioner whether its Caldicott Guardian will advise you.
A yearly online self-assessment against the National Data Guardian's 10 data security standards. NHS buyers usually ask to see "Standards met" before go-live, and you need it to get NHS email and other systems. Small independent providers register as "Other" and answer the standard questions; an independent audit is only needed for operators of essential services and IT suppliers. The toolkit expects every member of staff to be trained in data security every year. Patients can opt out of their NHS data being used for research and planning, which does not affect their care. If you use patient data only for their care, say so in your privacy notice and the toolkit; otherwise check for opt-outs before using it for anything else.
Watch out: A toolkit submitted before you handled patient data, for example for a staffing or consultancy business, may not be accepted. Submit it again once you hold patient records.
A government-backed certificate for basic security: firewalls, secure settings, access control, malware protection and updates. The law, the NHS contract and the toolkit do not require it, but many NHS buyers ask for it.
Follow the Patient Safety Incident Response Framework, and report the death of any autistic patient or patient with a learning disability to LeDeR. The full-length contract also asks you to publish your incident response policy and plan, and to be able to record incidents on the Learn from Patient Safety Events service, which any organisation with an ODS code can use.
At least one Guardian, named on your website and given to your commissioner, plus a speak-up policy based on the national one. New Guardians complete foundation training, which NHS England has run since the National Guardian's Office closed in June 2026.
Methylphenidate, lisdexamfetamine and dexamfetamine are Schedule 2 controlled drugs, with extra rules on prescriptions and records. Atomoxetine and guanfacine are not controlled. Each clinician who writes private prescriptions for Schedule 2 or 3 drugs uses the FP10PCD form with their own private prescriber number. They apply through their regional NHS England controlled drugs team, who have the NHS Business Services Authority issue it.
Before you write NHS prescriptions, your commissioner completes a provider authorisation form. You then ask for a cost centre, register each prescriber, name an authorised signatory and order prescription forms. A cost centre can only be set up once at least one prescriber is added.
An independent hospital must appoint one and register them with CQC, unless fewer than 10 people work there or CQC grants an exemption. In law a hospital includes clinics and outpatient departments run in connection with one, so if 10 or more people work at your clinic, ask CQC whether this applies to you.
Before medication: height, weight, pulse, blood pressure and cardiovascular history, and the risk of misuse. An ECG is not routine; NICE sets out when one is needed. After starting: heart rate and blood pressure at each dose change and every 6 months, growth in children, and a specialist review every year.
Prescribers should not prescribe controlled drugs remotely without access to the patient's records, except in narrow cases, and should follow the joint principles the professional regulators published.
Register for Central Alerting System alerts by emailing the MHRA with your organisation's name, address and ODS code if you have one. Act on national patient safety alerts, and report suspected side effects through the Yellow Card scheme.
Jan
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct (this month)
Nov
Dec
1 Apr
2027
162 days left
30 Jun
2027
252 days left
30 Jun
2027
252 days left
These are the fixed national deadlines. Your other dates depend on when you registered and what your commissioner sets.
Apply to CQC for the regulated activity "treatment of disease, disorder or injury". The application includes a statement of purpose: your aims, the services you offer, where you offer them, your regulated activities and who manages them. Organisations and partnerships need a registered manager, who applies to CQC separately and is interviewed, and organisations name a nominated individual. An individual applicant, and each partner, needs an enhanced DBS check issued in the last 12 months; the nominated individual and the manager need enhanced checks too. Directors must meet the fit and proper person requirements.
Watch out: Treating patients before you are registered is a criminal offence. CQC sends back applications with missing information, which restarts the wait.
Read our guide to what CQC registration involves and why it can take months.
Keep a record of what data you process, why, who you share it with and how long you keep it. The exemption for organisations with fewer than 250 staff does not cover health data. Tell patients how you use their data, and tell the parents and teachers who fill in questionnaires too, because they give you data about the patient. If you DBS-check staff, you also need an appropriate policy document. Give people a copy of their records within one month of asking, free of charge.
A DPIA is needed when processing is likely to be high risk, and health data about vulnerable people, including children, usually is. The ICO gives a hospital processing patient data as an example that needs one, and an individual doctor as one that does not. It records the risks to patients' data and how you reduce them. Do one for the service and update it for each new system. NHS buyers ask to see it.
Watch out: The DPIA is yours, as the organisation responsible for the data. A supplier's DPIA helps you write it but does not replace it.
Report a personal data breach that puts people at risk to the ICO within 72 hours of finding it, and tell the people affected if the risk is high. Keep a log of every breach, including ones you do not report. NHS providers report through the incident tool in the Data Security and Protection Toolkit, which passes reportable breaches to the ICO for you, so do not report twice. Tell your commissioner on or before the day you report.
Tell patients how to complain and what happens next, and log and answer every complaint. Since 19 June 2026 the law also asks every organisation to give people an easy way to complain about how their data is used, such as an online form, to acknowledge each of those complaints within 30 days and to reply without undue delay. For NHS patients the NHS complaints rules apply: name a responsible person and a complaints manager, acknowledge each complaint within 3 working days, display how to complain with details of local Healthwatch and the Parliamentary and Health Service Ombudsman, and send your commissioner a yearly report. The Ombudsman does not cover privately funded care, so private clinics often join the Independent Sector Complaints Adjudication Service.
When a notifiable safety incident happens, tell the person in person as soon as you reasonably can, apologise, and follow up in writing.
You must not advertise in a way likely to lead to the use of a prescription-only medicine, so do not promote ADHD medication. Advertising also has to follow the Advertising Standards Authority's code.
Watch out: The Fonagy review proposes banning adverts for NHS-funded assessments aimed at the public. It is a proposal, not yet a rule.
Name a Clinical Safety Officer, a registered clinician trained in clinical risk management, and keep a hazard log and safety case for how you use each health IT system: your patient record, assessment platform, video calls and any AI tools. Write down the procedures and training each system needs, such as a clinician reviewing every report, and record them as controls in the hazard log. Suppliers do the matching standard, DCB0129, for their product.
Watch out: DCB0160 is the clinic's job, not the supplier's. Ask each supplier for their DCB0129 safety case and hazard log, and which features you will use, so your assessment matches.
The Caldicott Guardian protects how patient information is used, the Senior Information Risk Owner owns information risk, and the information governance lead runs the day-to-day work. The Caldicott Guardian and SIRO should not normally be the same person. Give the names to your commissioner and record them in the toolkit.
Watch out: If you are very small, the guidance lets you ask your commissioner whether its Caldicott Guardian will advise you.
Create a Directory of Services entry for each service and location, with a named lead clinician. Services patients can choose must be visible to referrers across England. For mental health services the contract asks for reasonable endeavours to list them. Staff need an NHS Care Identity login to use it: a smartcard, or another approved method such as Windows Hello or a security key, issued through a Registration Authority your commissioner can point you to.
When a local council asks for your help with a child's Education, Health and Care needs assessment, the contract asks you to use all reasonable endeavours to respond within 6 weeks.
Register for Central Alerting System alerts by emailing the MHRA with your organisation's name, address and ODS code if you have one. Act on national patient safety alerts, and report suspected side effects through the Yellow Card scheme.
Notify CQC without delay of deaths, serious injuries, abuse or allegations of abuse, police involvement and events that stop the service running safely. For NHS patients, copy the notification to your commissioner.
Show your latest rating on your website and at each of your premises, where people can see it, within 21 days of CQC publishing it. Link to the report on CQC's website.
The Mental Capacity Act applies from age 16. Under 16, a child who understands can consent for themselves (Gillick competence); otherwise a person with parental responsibility consents. Tell parents, teachers and other informants how their answers are used. If you record consultations, or use a tool that captures audio, ask the patient or parent first and have a policy for how recordings are kept.
The duty is anticipatory: plan now for the needs of autistic and ADHD patients, such as quieter waiting areas, longer appointments, written information and flexible formats, rather than waiting to be asked. For NHS patients the Accessible Information Standard also applies: identify, record, flag, share, meet and review each patient's communication needs. The 2025 revision added the review step.
Put the patient's verified NHS number on records, letters and data submissions. You can look numbers up through the Personal Demographics Service once you have access, which needs an NHS Care Identity login.
Watch out: Ask your commissioner how you will get NHS numbers for referred patients. Your data submissions need them.
Both forms of the contract require a discharge summary to the GP or referrer within the timescale in your local protocol. The full-length contract adds a structured clinic letter, sent electronically within 7 days, whenever the GP needs to act.
Prescribers should not prescribe controlled drugs remotely without access to the patient's records, except in narrow cases, and should follow the joint principles the professional regulators published.
Clear, complete and contemporaneous records of each patient's care, kept securely.
All providers of NHS-funded ADHD and autism services must submit data. Services commissioned as mental health submit to the Mental Health Services Data Set (MHSDS); services commissioned as community paediatrics submit to the Community Services Data Set (CSDS) and report assessment waiting times to the Community Health Services SitRep. If your service is led by a medical consultant, such as a consultant psychiatrist, you also send weekly waiting list data and a monthly referral to treatment return. Agree with your commissioner whether yours is.
Watch out: This is the item new providers most often miss. Ask your commissioner which data set applies and register before your first month of activity ends.
Send invoices with the data the contract asks for, through the NHS e-invoicing platform or another system that meets the PEPPOL standard. Commissioners do not have to pay late invoices, and NHS England's 2026/27 payment guidance tells ICBs to pay only when data and invoicing requirements are met. Under that guidance you invoice an assessment once the outcome report has gone to the referrer.
Ask NHS patients whether their experience was good, send the numbers to NHS England every month through the Strategic Data Collection Service, and share the results locally.
The shorter-form contract sets reports at least every quarter, and the full-length contract every month, plus any KPIs in your service specification, such as waiting times. A summary of complaints and patient safety incidents is due at least once a year.
Watch out: Ask for the reporting schedule and KPI definitions before go-live, not after the first report is due.
An independent hospital must appoint one and register them with CQC, unless fewer than 10 people work there or CQC grants an exemption. In law a hospital includes clinics and outpatient departments run in connection with one, so if 10 or more people work at your clinic, ask CQC whether this applies to you.
Before medication: height, weight, pulse, blood pressure and cardiovascular history, and the risk of misuse. An ECG is not routine; NICE sets out when one is needed. After starting: heart rate and blood pressure at each dose change and every 6 months, growth in children, and a specialist review every year.
Safeguarding, complaints, governance and record keeping, staffing and supervision, recruitment, duty of candour, and infection prevention and control if you see patients in person. Registered providers must meet these standards, and both forms of the NHS Standard Contract require them too, even if you only diagnose. For a private, diagnosis-only clinic they are good practice, and CQC is expected to regulate you.
By law, doctors, nurses and HCPC-registered professionals, such as psychologists, occupational therapists and speech and language therapists, must each have indemnity to practise. The clinic needs cover for the service it runs, including clinicians who work for it on a sessional basis. If you employ anyone, employers' liability cover of at least £5 million is compulsory from the first day, and you must display the certificate where staff can see it, which can be on your intranet. An NHS contract also asks for clinical negligence, professional negligence and public liability cover, and for your sub-contractors to hold it too.
Watch out: An NHS contract can ask for more cover than the tender or framework did. Read the contract's indemnity clause, not just the tender, and get a written quote early. You must show proof within 5 working days if your commissioner asks, and if you close, check you have cover for claims made later.
Every organisation that handles personal data pays a yearly fee to the Information Commissioner's Office unless it is exempt, and a clinic is very unlikely to be exempt. Most small clinics are in tier 1, which covers a turnover of up to £632,000 or up to 10 staff.
Watch out: The renewal is easy to miss. Pay by Direct Debit so it renews on its own. The ICO became the Information Commission on 30 September 2026; the fee and the duty are unchanged.
A DPO is required when an organisation handles health data on a large scale. A clinic with several clinicians has to make a judgement and record it.
Watch out: You can buy in a DPO service, but your software supplier's DPO works for the supplier. As the organisation responsible for patient data, you need your own advice.
The Records Management Code has no ADHD or autism category, and its periods are minimums. Many providers use its mental health period, 20 years or 10 years after death; the general adult period is 8 years. Children's records are kept until their 25th birthday, or 26th if they were 17 when care ended. Choose your periods, write down why, and follow them.
Staff need the supervision, training and appraisal to do their job safely. Appraisals also feed doctors' revalidation.
Set out how staff raise a concern about a child or adult, who they tell and how you refer to the local authority. Agree which cases count as complex or high risk. NHS contracts ask for named leads for children, adults, child sexual abuse and exploitation, and the Mental Capacity Act. The full-length contract also asks for a Prevent lead, Prevent awareness training and a yearly audit of safeguarding training.
Assess the risks to staff and patients from your premises and the way you work, including for staff who work from home. Once you have 5 or more employees, write down your health and safety policy and the main findings of your risk assessment. If you have premises, the person responsible for them must also carry out a fire risk assessment, write it down whatever your size, put safety measures in place and plan for an emergency. If a landlord shares this duty, agree who does what.
For each system that holds patient data, collect: DSPT status, the DCB0129 safety case, DTAC, Cyber Essentials, a penetration test less than 12 months old, the list of sub-processors and where data is stored. The DTAC belongs to the supplier: when a buyer asks for one, share the supplier's with a short note of your own checks. DTAC version 2.0 replaced the old form in April 2026.
Watch out: NHS buyers often send a cloud security questionnaire written for software companies, and send back answers without evidence attached. Ask your suppliers for their evidence pack before you need it.
A yearly online self-assessment against the National Data Guardian's 10 data security standards. NHS buyers usually ask to see "Standards met" before go-live, and you need it to get NHS email and other systems. Small independent providers register as "Other" and answer the standard questions; an independent audit is only needed for operators of essential services and IT suppliers. The toolkit expects every member of staff to be trained in data security every year. Patients can opt out of their NHS data being used for research and planning, which does not affect their care. If you use patient data only for their care, say so in your privacy notice and the toolkit; otherwise check for opt-outs before using it for anything else.
Watch out: A toolkit submitted before you handled patient data, for example for a staffing or consultancy business, may not be accepted. Submit it again once you hold patient records.
A government-backed certificate for basic security: firewalls, secure settings, access control, malware protection and updates. The law, the NHS contract and the toolkit do not require it, but many NHS buyers ask for it.
An Indicative Activity Plan sets how much activity the ICB expects to pay for in the contract year. If you cannot agree one, the ICB can set it, and if none is set the plan counts as zero. The ICB can then use an Activity Management Plan to limit activity. A plan set by your main ICB does not apply to patients from other ICBs.
Follow the Patient Safety Incident Response Framework, and report the death of any autistic patient or patient with a learning disability to LeDeR. The full-length contract also asks you to publish your incident response policy and plan, and to be able to record incidents on the Learn from Patient Safety Events service, which any organisation with an ODS code can use.
Name an accountable emergency officer and write an incident response plan and a business continuity plan, so patients are looked after if systems, staff or premises fail. Test the plans with an exercise.
A yearly report on the quality of your NHS services. You are exempt only if, on 1 April, you had both 50 or fewer full-time equivalent staff and £130,000 or less of NHS income for the year. Send a draft to your commissioner and local Healthwatch within 30 days of 1 April, before you publish.
Watch out: NHS England's own Quality Accounts page can read as if meeting one of the two conditions is enough. The regulations need both.
ADHD and autism clinics are in CQC's "community healthcare services" fee band, charged by how many locations you have. The fee covers registration itself; there is no separate application fee.
Check doctors on the GMC register, nurses on the NMC register, and psychologists, speech and language therapists and occupational therapists on the HCPC register. "Psychologist" on its own is not a protected title: look for "practitioner psychologist" or "clinical psychologist". Track renewal dates too: doctors revalidate every 5 years through a designated body, nurses revalidate with the NMC every 3 years, and HCPC registrants renew every 2 years.
Enhanced checks with the right barred list for clinicians. A standard check for admin staff who have contact with patients, including by phone or online, and a basic check for staff with no patient contact. The law sets no recheck interval: decide one by risk, or use the Update Service, and write down why. If you remove someone for harming a patient or putting one at risk, you must refer them to DBS.
Every member of staff needs adult safeguarding training at the level for their role. For registered clinicians who see adults, level 3 is a suggested 8 hours over 3 years. Clinical staff who assess children and young people need level 3 children's safeguarding, and the children's document also puts adult mental health clinicians who see parents or carers at level 3. The 2025 intercollegiate document for children sets the competences and leaves it to providers to decide how long and how often training runs. NHS contracts also ask for Mental Capacity Act training.
Everyone does a 90-minute e-learning module, then the tier that fits their role: tier 1 adds an hour's live online session, and tier 2, which most assessing clinicians are likely to need, adds a day in person. Diagnosis-only clinics are not bound by the law today, but every NHS Standard Contract requires the training.
Showing everything. Answer the questions at the top to leave out what does not apply to you.
ADHD and autism assessment clinics in England: clinics opening, clinics taking on their first NHS contract, and clinics adding a site, a service, prescribing or a new system.
Not today. CQC says diagnosing ADHD or autism is not treatment, so a service that only diagnoses does not need to register. On 9 October 2026 the government asked CQC to regulate all ADHD and autism diagnostic assessments once new regulations are in place, with no date set. Our guide to what CQC regulation of diagnosis-only assessments will mean covers who is affected and how to prepare.
The Fonagy review, published on 9 October 2026, proposes CQC registration for every ADHD and autism assessment, a ban on advertising NHS-funded assessments to the public, and data submission as a condition of NHS funding, including for Right to Choose. The government has committed to CQC regulation and national prices; the rest are proposals. Our summary of the Fonagy review for providers sets out what each change would mean.
No to both. It is a guide to what the law, CQC, NHS England and NHS contracts ask for, with a link to the official source for each item, and it may not cover everything your clinic needs. Your services, your contract and your own circumstances decide what applies to you, and rules change. Check each item against its source, ask your commissioner or the regulator about anything you are unsure of, and get advice from a qualified professional, such as a solicitor or compliance adviser, before you rely on it.
We check every item against its source and show the date of the last check at the top of the page. If a rule changes, we update the item and the date.
Not yet. Each nation has its own regulator: Healthcare Improvement Scotland, Healthcare Inspectorate Wales and the RQIA in Northern Ireland. None of them uses Right to Choose or the NHS Standard Contract.
Our free NHS ADHD and autism opportunity finder lists every NHS ADHD and autism contract on Find a Tender in the last 2 years, and emails you when a buyer in your areas publishes a new one.
Yes. Cerebric makes the checklist for ADHD and autism providers, and you do not need an account. Your answers and ticks stay in your browser.