Meet CQC Regulation 19 with tamper-proof, domain-verified references
Tamper-proof, domain-verified references for NHS trusts, care homes, and private providers. Meet CQC requirements with confidence.
In healthcare, a fabricated reference isn't just a hiring mistake. It's a patient safety risk.
The Care Quality Commission requires robust recruitment processes, and references are a core part of that. Regulation 19 (Fit and proper persons employed) specifically requires providers to obtain references. But a paper letter doesn't prove its own authenticity, and the CQC knows it.
Locum doctors and agency nurses move between trusts and providers regularly. Without portable references, each new placement starts the verification process from scratch. That means delays in onboarding, gaps in rotas, and pressure to cut corners.
A fabricated reference in healthcare can put vulnerable people at direct risk. This isn't theoretical. CQC enforcement actions regularly cite inadequate recruitment checks as contributing to patient harm.
Every reference is tied to the issuing trust or provider's domain. Independent confirmation without phone calls or email chains.
Clinicians carry verified references from placement to placement. Onboarding is faster, and there's no excuse to skip proper checks under time pressure.
If concerns arise after someone leaves, revoke their reference immediately. No paper trail to chase down.
A locum nurse applies for a placement at your trust via an agency. Normally you'd wait for the previous trust to respond to a reference request, adding days or weeks to onboarding. Instead, the nurse shares their RefPassport link. Your HR team verifies in seconds that the reference is genuine, tied to the issuing trust's domain, and unaltered. The nurse starts on time and patient care isn't disrupted.
When the CQC inspects your recruitment records under Regulation 19, they want to see that references were obtained and properly verified for every member of staff. With RefPassport, your records include a tamper-proof reference for each hire that links back to the issuing organisation's verified domain. No ambiguity about authenticity.
Occasionally, concerns emerge about a former employee after they've left. Maybe a disciplinary matter comes to light, or a clinical incident is investigated retrospectively. With RefPassport, you can revoke that person's reference immediately. Any future employer who tries to verify it will see that it's been withdrawn. Traditional paper references offer no such safeguard.
Regulation 19 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 is the cornerstone of safe recruitment in health and social care. It places a legal obligation on registered providers to ensure that every person they employ is of good character, has the qualifications, competence, skills, and experience necessary for the work they are to perform, and is physically and mentally fit to carry out their role. This is not guidance or best practice. It is a legal requirement, and the CQC has enforcement powers where providers fall short.
Critically, the regulation goes beyond simply requiring that staff are suitable. It requires that the provider can demonstrate their suitability through documented evidence. Schedule 3 of the regulations sets out the specific information that must be available in relation to each person employed. Among the items listed is:
“Satisfactory evidence of conduct in previous employment concerned with the provision of services relating to health or social care, or children or vulnerable adults.”
In practical terms, this means employment references in healthcare are not optional. They are a regulatory requirement. Providers must obtain references, and those references must relate to conduct in previous roles. A generic “to whom it may concern” letter or an informal verbal confirmation is unlikely to satisfy an inspector reviewing recruitment files.
During inspections, the CQC assesses providers against five key questions: safe, effective, caring, responsive, and well-led. Recruitment and staffing practices fall primarily under the “Well-led” key question, though failures in recruitment can also affect ratings under “Safe.” Inspectors routinely review a sample of recruitment files as part of their evidence gathering.
When inspectors open a recruitment file, they are checking several things in relation to references. First, they check that references were obtained before the person started work, not after. Second, they look for evidence that the references were verified, meaning someone confirmed they were genuine and came from the stated source. Third, they look for evidence that any concerns raised in a reference were followed up appropriately.
Common findings in CQC enforcement actions include statements such as:
“The provider had not always obtained references for staff before they started work.”
“References had been obtained but not verified as authentic.”
The distinction between “obtained” and “verified” is important. Having a reference letter on file is not the same as being able to prove that it is genuine. RefPassport addresses this directly. Every reference issued through the platform is cryptographically signed and tied to the issuing organisation's verified domain. When an inspector reviews your recruitment file and sees a RefPassport reference, they can independently confirm its authenticity in seconds. There is no ambiguity about whether the reference is genuine.
The scale of the NHS workforce makes reference verification a significant operational challenge. The NHS in England employs over 1.4 million people, making it one of the largest employers in the world. NHS Professionals, the NHS's own internal staffing service, processed over one million temporary staffing shifts in 2023. Each of those shifts involves a healthcare worker whose references should have been obtained and verified.
Agency and locum staff present particular difficulties. A locum doctor or agency nurse may work across multiple trusts and providers in a single month. Each new placement triggers a reference verification requirement, and each provider is independently responsible for ensuring that references are in place. In practice, this creates enormous duplication of effort. The same reference is requested, received, and checked repeatedly by different organisations for the same individual.
The Kark review, published in 2019, recommended strengthening fitness to practise checks across healthcare, including more robust verification of employment history. The review was commissioned in response to concerns about individuals who had been dismissed from one healthcare organisation for serious failings but were able to secure employment elsewhere because reference and background checking processes were inadequate.
RefPassport's model of portable, verified references addresses these challenges directly. A clinician whose reference has been verified once through RefPassport can carry that cryptographic proof to every subsequent placement. The receiving trust or agency does not need to re-contact the issuing organisation. They verify the reference independently against the issuer's domain in seconds. This eliminates duplication without compromising on rigour.
The consequences of inadequate reference checking in healthcare extend beyond regulatory non-compliance. CQC enforcement actions for recruitment failures can result in warning notices, conditions imposed on registration, or in the most serious cases, prosecution. Providers rated “Inadequate” for the Well-led key question often face mandatory improvement plans and increased inspection frequency.
Beyond regulatory risk, there are direct patient safety implications. The Francis Report, published in 2013 following the public inquiry into the Mid Staffordshire NHS Foundation Trust, identified recruitment and vetting failures as contributing factors in the scandal. The report found that staff had been employed without adequate checks on their suitability, and that this contributed to a systemic failure in care standards.
Robust reference verification is not bureaucracy for its own sake. It is a frontline safeguard for patients and service users. RefPassport gives healthcare providers the tools to meet this obligation efficiently and with confidence, turning what has traditionally been a slow, manual process into something that takes seconds and produces verifiable, auditable evidence of compliance.
Yes. CQC Regulation 19 (Fit and proper persons employed) requires healthcare providers to have robust recruitment procedures, including obtaining and verifying references. RefPassport provides tamper-proof, domain-verified references that give you independently confirmable proof of authenticity. This goes beyond what a traditional paper reference can offer and gives inspectors clear evidence that references were properly verified.
Locum doctors and agency nurses often move between trusts and providers. With RefPassport, their verified references travel with them. Instead of each new placement starting the reference process from scratch, the clinician shares their existing RefPassport references and the receiving organisation verifies them in seconds. This reduces onboarding delays without compromising on due diligence.
Yes. If concerns arise about a former employee after they have left, such as a clinical incident investigation or a retrospective disciplinary matter, you can revoke their reference immediately from your dashboard. Any future employer or agency that tries to verify it will see that it has been withdrawn.
Yes. RefPassport works with any organisation that has its own domain. NHS trusts, private healthcare providers, care homes, and staffing agencies can all register their domain and start issuing verified references. The free plan includes 5 references per month, which is enough for smaller providers to get started.
The employer writes the reference content, just as they would with a traditional reference letter. RefPassport then cryptographically signs it and ties it to the employer's domain. The reference can include dates of employment, role, and any other information the employer chooses to include. The content is fully controlled by the issuing organisation.
Tamper-proof references for NHS trusts, care homes, and private providers.