CQC and dental records: what the software has to make possible

What the regulation says

Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires systems or processes to be established and operated effectively to ensure compliance. Regulation 17(2)(c) is the records limb: a provider must 'maintain securely an accurate, complete and contemporaneous record in respect of each service user, including a record of the care and treatment provided to the service user and of decisions taken in relation to the care and treatment provided' (CQC, read 15 August 2026).

CQC's own guidance is specific about what fit for purpose means

• Records must be complete, legible, indelible, accurate and up to date, with no undue delays in adding and filing information as far as is reasonable. CQC's guidance names results of diagnostic tests, correspondence and changes to care plans following medical advice.
• They must include an accurate record of all decisions taken about care and treatment, with reference to discussions with the person using the service and those lawfully acting on their behalf. Consent records are named explicitly, including when consent changes, why it changed, and what alternatives were offered.
• They must be kept secure at all times and only accessed, amended or securely destroyed by authorised people.
• CQC states that both paper and electronic records can be held securely providing they meet the requirements of the Data Protection Act 2018.

That last point settles a question suppliers sometimes blur: no CQC regulation requires an electronic record system. A well-run paper practice can meet Regulation 17. What a system buys you is the audit of who saw what and when, which is much harder to evidence on paper.

Turning the regulation into demo questions

1. Write a clinical note, save it, then amend it. Ask to see who made the amendment, when, and what the record said before. Contemporaneous and accurate both imply you can show the history.
2. Record a consent, then change it, and ask where the reason for the change and the alternatives offered are stored.
3. Ask who in the practice can amend or delete a record, and how that permission is set and reviewed.
4. Ask what a subject access request looks like: which screens produce the record, in what format, and how long it takes.
5. Ask what happens on the day you stop being a customer: where the records go, in what format, and at what cost.

Where your data physically lives still matters

Three of the eight systems compared on this site are cloud (Dentally, CareStack and Cloud 4 Dentists), two more describe themselves as cloud hosted (DentalPlus and Chiral), and two are installed on a practice Windows server (Pearl and Systems for Dentists), with Exact not stating on the pages we read. That is not a compliance verdict either way: CQC requires records to be held securely and to meet the Data Protection Act 2018, and both models can do that. It does change who is responsible for backups, who holds the encryption keys, and what happens to the records if the practice loses its internet connection on a Monday morning.