The Hillsborough Law is about to clear its final Commons stages, and it is not just an NHS story. Private providers delivering NHS-commissioned care are caught too. Neil Rowe and Nina Vegad explains what it means for healthcare providers, NHS and independent sectors alike and what to do about it now.

MPs are set to give the Public Office (Accountability) Bill its final Commons approval this week and once it clears the Lords, public bodies and private providers across England and Wales will be operating under a fundamentally different accountability regime than the one they have known for decades. This is not a tidying-up exercise. It replaces a centuries-old common law offence with two new statutory offences, imposes a duty of candour with teeth, and reshapes how public bodies and private providers engage lawyers in the highest-stakes moments of their institutional life: inquiries and inquests.

This is not a regime that touches only the NHS and other public bodies. Private providers are caught directly wherever they deliver services on behalf of, or under contract with, a public authority, independent hospitals, care homes and outsourced clinical or custodial providers among them. They are brought within the scope of the duty of candour, the new offences and the inquiry and inquest provisions in the same way as NHS trusts and other public bodies. Independent sector organisations should not assume that their private or contractual status places them outside the new regime.

Here is what matters most, and what public bodies and private providers should be doing now, rather than waiting for Royal Assent.

The duty of candour is not a soft obligation, it is a live legal risk

The headline change is a statutory duty of candour and assistance will be owed by public authorities and officials in their dealings with inquiries and investigations. For these purposes, “inquiries” and “investigations” are not confined to statutory public inquiries under the Inquiries Act 2005 or to inquests heard before a jury; the duty extends to any formal inquiry, investigation or inquest into a death or serious harm, whatever its scale, and there is no minimum threshold in the Bill below which it stops applying. It is tempting to read this as an extension of existing transparency expectations, but it is far from it. This is a freestanding statutory duty, backed by criminal sanction, that applies across the public sector generally, and also private providers. 

The practical effect: the instinct to manage litigation risk by controlling disclosure (delaying, narrowing, or filtering what an inquiry sees) becomes a much higher-risk strategy than it already was. Legal teams advising will need to shift from “what are we obliged to disclose” thinking to “what does candour require us to volunteer,” which is a different and more demanding test.

Two new offences change the personal risk calculus for individuals

The bill abolishes the common law offence of misconduct in public office and replaces it with two statutory offences: a duty-to-prevent-death-or-serious-injury offence carrying up to 14 years, and a seriously improper conduct offence carrying up to 10 years. Both apply only in England and Wales, and both are aimed at senior decision-makers rather than junior staff.

In practice, this sharpens personal exposure for individuals in leadership positions in a way the old common law offence never quite managed. Behaviour at board and executive level is likely to shift well before a single prosecution is brought under the new provisions. Directors’ and officers’ liability considerations, indemnity arrangements, and personal legal advice budgets for senior public officials should all be reviewed against this now, not after the Act commences.

Codes of conduct will need to do more than exist, they’ll need to be defensible

The bill requires the adoption of codes of conduct built around the Nolan Principles, with disciplinary consequences for breaches and clear internal whistleblowing routes. Most public authorities and private providers already have something that could loosely be called a code of conduct. Very few would survive serious scrutiny in the aftermath of a major incident.

The organisations that get this right will treat their code of conduct as a piece of evidence-in-waiting, something that will be read line by line by an inquiry panel or a court at the worst possible moment. That means whistleblowing routes that are genuinely used and trusted, not just documented; disciplinary consequences that are specific rather than vague; and a clear paper trail showing the code is operative.

Hospital blur

The “necessary and proportionate” legal spend duty will change how lawyers are instructed

Less discussed than the criminal offences, but arguably just as significant for legal budgets, the bill introduces a duty to engage legal representation only where necessary and proportionate, alongside expanded non-means-tested legal aid for bereaved families at inquests. This is a direct legislative response to the “inequality of arms” criticism where it was highlighted public bodies presented at inquests with significant legal firepower against unrepresented or under-represented families.

For general counsel and legal teams, this changes the default. The old instinct where leading counsel would be instructed as standard practice for any inquest where reputational risk exists, will need to be justified against a statutory proportionality test. This is likely to generate its own satellite disputes: what counts as proportionate will be tested, and early case law on this point will matter a great deal to how organisations budget for, and staff, inquest representation going forward. Our own view is that leading counsel will remain justified for the small number of the most significant, high-profile inquiries and inquests, but for the great majority of matters a single instructed solicitor, or a solicitor supported by junior counsel, is likely to satisfy the new proportionality standard. Organisations should move away from instructing leading counsel as a default and instead build a documented, case-by-case assessment of what representation the issues genuinely require. For instance, a single instructed solicitor may be appropriate for an inquest into a routine clinical death with no Article 2 engagement and no criticism of the organisation on the evidence.

The intelligence services carve-out shows how contested this still is

It is worth noting, this bill nearly collapsed more than once over whether the intelligence services would be brought within scope of the duty of candour. The compromise that emerged, surrounding additional safeguards rather than a clean exemption, was contentious among the bill’s own backers and was only resolved in the days immediately before the final vote.

Where legislation is the product of a hard-fought late compromise rather than a clean policy position, it tends to produce interpretive disputes down the line. Any organisation whose work intersects with national security functions, even at arm’s length, should assume this is an area where the boundaries of the duty will be tested in litigation before they are settled in practice.

Advice to clients 

  1. Audit codes of conduct against the Nolan Principles now, rather than waiting for statutory guidance. The gap between “have a code” and “have a defensible code” is where the risk sits.
  2. Review indemnity and D&O arrangements for senior officials in light of the new personal-liability offences.
  3. Reassess default legal instruction practices for inquiries and inquests against a proportionality standard and start building the internal record that shows that reasoning.
  4. Stress-test disclosure practices against a candour standard rather than a strict-disclosure-obligation standard. The two are not the same test, and the gap between them is exactly where the criminal offences bite.

Healthcare blurred

What we are advising healthcare clients to do now

  1. Map the new statutory duty against your existing Regulation 20 compliance
    The CQC’s duty of candour has applied to health and care providers since 2014, but the new Act’s duty of candour and assistance is broader in scope and carries new criminal offences, rather than regulatory sanctions alone. A trust or private provider that is “Regulation 20 compliant” is not automatically compliant with the new Act and the two regimes need to be checked against each other, not assumed to overlap.
  2. Review how Prevention of Future Deaths reports and inquest disclosure are handled internally
    This is where clinical negligence and inquest practice will feel the new duty most directly. Trusts and private providers should revisit how internal incident investigations are prepared and disclosed to coroners, given the shift from a disclosure-obligation mindset to a candour mindset.
  3. Reassess legal instruction practices at inquests involving bereaved families
    With expanded non-means-tested legal aid for families at inquests where a public authority is an interested person, NHS trusts and private providers should expect better-represented families as standard, not the exception. Instructing counsel “as usual” for every inquest will need to be justified against the new proportionality duty, and decisions on this should be documented contemporaneously.
  4. Revisit indemnity cover for individual clinicians and senior managers
    The new personal-liability offences sit alongside existing GMC/NMC fitness-to-practise exposure, and trusts, MDU/MPS-covered clinicians, and private providers should check indemnity arrangements now rather than after a serious incident, when it is too late to adjust cover.
  5. Train clinical and clinical governance teams on the distinction between the two candour duties
    Professional duty of candour (GMC/NMC), the existing statutory duty (Regulation 20), and the new Act’s duty of candour and assistance are three related but legally distinct obligations. Confusing them in how staff are trained is a real risk once the new criminal offences are in force.

The detail that will matter most, how the new statutory duty is interpreted against existing Regulation 20 obligations, will not be settled by the text of the Act itself but by how the first cases involving it are handled. Trusts and private providers who get their internal processes right now will be far better placed than those waiting to see how the courts read it.

Conclusion

On balance, this is a welcome development. Too many past failures, Hillsborough foremost among them, were compounded by institutional defensiveness and delayed disclosure, and a statutory duty of candour backed by criminal sanction is a proportionate response to that history. The challenge now shifts to public bodies and private providers themselves: given the severity of the sanctions attached to getting it wrong, the organisations that start preparing their codes of conduct, disclosure practices and legal instruction policies now, well ahead of commencement, will be far better placed than those that wait.

Neil Rowe is Director of Healthcare Legal Services and Nina Vegad is Director of Partnerships and Investigation Services at Maulin Group.