In April 2016, the final version of an overarching whistleblowing policy which should be adopted by all NHS organisations was published by NHS Improvement in conjunction with NHS England. 

This ties in with work by Sir Robert Francis QC who recommended a 'standard integrated policy' as one of a number of recommendations arising from his Freedom to Speak Up Review.   

NHS organisations are expected to adopt the policy by 31 March 2017 as a minimum standard, and it is also hoped that the policy will be adopted by independent providers of NHS healthcare. The intention of the policy is to ensure an open and supportive culture which encourages staff to raise any issues or concerns with regards to "patient care, quality or safety" for the benefit of patients. This also ties in, of course, with the drive for candour, openness and transparency.

In this article, we focus on the key areas of the policy, as well as what NHS organisations will be required to do.

The policy outlines, amongst other key elements the following:-

Who can raise a concern?

  • Anyone who works (or has worked) in the NHS, or for an independent organisation that provides NHS Services. This includes not only employees, but also agency workers, temporary workers, students, volunteers and governors.

The policy provides that any individual will be safe in raising that concern in so far as their employment, and that neither harassment nor victimisation will be tolerated of anyone as a result. In addition, the policy also expressly indicates that no individual will be bullied into not raising a concern and provides reassurance that so long as the individual acts honestly it does not matter if those concerns turn out to be mistaken or if there was a reasonable explanation.

The policy endeavours to encourage individuals to raise their concerns openly, but should you want your identity to be kept confidential, this is what will happen unless there is a legal requirement for the organisation to disclose it. The policy also suggests that an individual can report a concern anonymously, although there could of course be more difficulty in investigating those issues as a result and providing feedback on any outcome.

With whom should a concern be raised?

Concerns can be raised in person, by phone or in writing (which includes by email), with as much information about the circumstances which give rise to the concern as possible.

  • The first step would be for an individual to raise their concern either formally or informally with their line manager, lead clinician or tutor unless it is inappropriate to do so. If this is the case, (or the line manager is unable to resolve matters), the individual should contact –
  • The Freedom to Speak Up Guardian – Organisations will need to appoint their own whistleblowing guardian as an impartial source of advice to staff at any stage of the process when raising concerns. This individual will have access to anyone in the organisation, or if necessary, outside the organisation. The individual's name and contact details should be identified within the policy. Further a new National Guardian can independently review how staff have been treated having raised concerns if NHS organisations fail to follow good practice, or fail to take action where needed (working with wider organisations as needed or necessary).
  • The Risk Management Team, whose contact details should be provided.
  • The NHS organisation's Executive or Non-Executive Director with responsibility for whistleblowing. These individuals should be identified within the policy.
  • If it is not possible to raise concerns internally, these should be raised with external bodies indicated within the policy, which include: NHS Improvement, the Care Quality Commission, NHS England, Health Education England, and NHS Protect for example. The type of concerns each organisation could individually consider are indicated.

There is a Whistleblowing Helpline for the NHS, and help and support may be sought from a professional body or Union.

What concerns can be raised?

The policy specifically:

  • Outlines that an individual can raise a concern about risk, malpractice or wrongdoing which that individual thinks is harming the service which is commissioned or delivered. It provides a non-exhaustive list of what type of issues may be raised.
  • Provides a reminder that a healthcare professional may in any event have a duty to report a concern. This for example, can tie in with legal responsibilities in connection with the duty of candour for example.
  • Indicates that this process is not for people who have concerns about their employment which affect only themselves, and that this should instead be taken up as an employment issue under separate channels.

How should the NHS Organisation respond to the Concern?

The policy indicates a vision as to how concerns raised about the NHS should be dealt with. This is outlined at Annex B of the policy document, which can be accessed via the link.

The suggested process for dealing with any concern raised is set out within the policy as follows:

  • On raising / receipt of the concern, it will be recorded and the individual should receive an acknowledgement within 2 working days. The central record should also capture the date that the concern was received, whether the individual has requested confidentiality, a summary of the concerns, and dates when updates or feedback will be provided to the individual.
  • The concerns should be discussed with the individual so that the NHS organisation is clear that it understands what the issues are.
  • Where the issues have been unable to be resolved quickly with a line manager, a proportionate investigation should be carried out. The person conducting that investigation must be suitably independent (usually from a different part of the organisation), appropriately trained and must reach a conclusion within an appropriate timescale. The individual must be notified of that timescale and kept up to date with progress.
  • Wherever possible the NHS organisation should carry out one single investigation, looking at wider concerns as part of that same investigation process whenever possible.
  • The investigation process is objective and evidence based, and a report should be produced focussing on the underlying issues (ie root causes), providing solutions to rectify any problems (recommendations and action plans), and should ensure appropriate lessons are learned as far as they need to be to prevent any reoccurrence.
  • The policy makes clear that where an investigation has identified improvements, these should be shared appropriately to ensure learning is maximised, and should be tracked to ensure that the changes have been made and that they are also working effectively.
  • Wherever possible the full investigation report should be shared with the person who raised the concerns, subject of course to the need to respect the confidentiality and personal data of others in line with the Data Protection Act 1998 and other legislation.
  • If it is more appropriate for the issues to be looked at via a different process then this should be discussed with the individual.
  • 'High level' staff concerns should also be fed through to the Board where appropriate as well as what steps are being undertaken to rectify problems. This information may also form part of an annual report.


Overall, it is intended that staff within any NHS organisation are encouraged to speak up, and that any concerns are either quickly resolved through line managers, escalated as appropriate and are appropriately investigated. The individual should also be kept fully informed of any outcomes, and organisational learning should occur by way of an action plan which is audited. High level findings should also be fed through to the NHS organisation's Board so that there is clear leadership and learning within the resolution process from the top of the organisation.

Most importantly, no individual should be victimised as a result of raising a concern, or bullied into not raising it with the aim of driving upwards patient care, quality standards and safety in a supportive organisational culture.

For further information on this or any of the points raised in this article, please contact Jane Bennett, Associate.

Our use of cookies

We use necessary cookies to make our site work. We'd also like to set optional analytics cookies to help us improve it. We won't set optional cookies unless you enable them. Using this tool will set a cookie on your device to remember your preferences. For more detailed information about the cookies we use, see our Cookies page.

Necessary cookies

Necessary cookies enable core functionality such as security, network management, and accessibility. You may disable these by changing your browser settings, but this may affect how the website functions.

Analytics cookies

We'd like to set Google Analytics cookies to help us to improve our website by collection and reporting information on how you use it. The cookies collect information in a way that does not directly identify anyone.
For more information on how these cookies work, please see our Cookies page.