How to run a compliant healthcare staffing agency in the UK

Why compliance is non-negotiable in healthcare staffing

Running a healthcare staffing agency in the UK is not like placing candidates in other industries. Every locum nurse, allied health professional, or support worker you place is working with vulnerable people — in hospitals, care homes, and community settings. The consequences of placing a non-compliant candidate are severe: harm to patients, regulatory sanctions, loss of NHS framework contracts, and reputational damage that can end a business overnight.

The good news is that with the right processes — and the right technology — compliance becomes a competitive advantage rather than a burden. Agencies that can demonstrate fast, auditable compliance checking win more NHS contracts and retain better candidates.

The core compliance checklist

1. DBS checks

Every candidate working with children or vulnerable adults requires a Disclosure and Barring Service (DBS) check. The level of check required depends on the role:

• Enhanced DBS with barred list check — required for direct care roles (nurses, healthcare assistants, support workers)
• Enhanced DBS — roles involving regular contact with patients but not direct care
• Standard DBS — administrative or ancillary roles with supervised contact

Key compliance obligations:

• DBS certificates must be recent (most NHS trusts and care homes require certificates dated within 3 years, many within 12 months)
• The update service allows candidates to maintain a live DBS certificate — always check whether the candidate is subscribed
• You must maintain a copy of the certificate and record the date and disclosure level in your compliance system

Using LocumShift AI, DBS expiry dates are tracked automatically. Consultants receive alerts 60, 30, and 7 days before a certificate expires — so no candidate is ever placed with an out-of-date check.

2. Professional registration: NMC and HCPC

Registered nurses and midwives must hold a current NMC (Nursing and Midwifery Council) registration. Allied health professionals — physiotherapists, occupational therapists, radiographers, and others — must be registered with the HCPC (Health and Care Professions Council).

Both registers are publicly searchable. But checking manually for every shift placement is time-consuming and error-prone. The NMC and HCPC both provide sanctions alerts — it is essential to check these, not just the registration status.

Agencies should verify:

• Active registration status
• Expiry date of registration (NMC renews annually; HCPC biennially)
• Whether any conditions, cautions, or sanctions are active on the registration

Automated verification against the NMC and HCPC registers significantly reduces the risk of placing a sanctioned professional. LocumShift AI integrates directly with these registers for real-time status checks.

3. Right to work verification

Since 1 January 2021, EU/EEA nationals no longer have an automatic right to work in the UK. Agencies must check the UK Visas and Immigration (UKVI) online share code for any candidate who does not have a UK/Irish passport or settled status.

Common documents for right to work verification:

• UK or Irish passport (or certificate of naturalisation)
• Biometric Residence Permit (BRP)
• UKVI share code (for settled/pre-settled status or visas)

You must retain a copy of the right to work evidence and record when the check was completed. For time-limited permissions (e.g., a work visa expiring in 18 months), you must conduct a follow-up check before the permission expires.

4. Mandatory training

NHS frameworks and CQC registered providers require proof of up-to-date mandatory training before placement. The Core Skills Training Framework (CSTF) sets the standard for NHS providers. Typically required modules include:

• Moving and handling
• Fire safety awareness
• Infection prevention and control
• Basic life support (BLS/CPR)
• Safeguarding (adults and children, to the appropriate level)
• Equality, diversity and inclusion
• Information governance (NHS providers require this annually)
• Conflict resolution

Training certificates must be in-date. Most modules require annual renewal; BLS typically requires face-to-face renewal annually or biennial update. Agencies that allow expired training to lapse face NHS framework audits and potential suspension.

5. Occupational health clearances

Candidates must be fit to work with vulnerable patients. Standard pre-placement occupational health requirements include:

• Immunity to hepatitis B (or documented non-response)
• Immunity to tuberculosis (BCG vaccination or Mantoux test)
• Immunity to varicella (chickenpox)
• Immunity to measles, mumps, and rubella (MMR)
• Annual influenza vaccination (strongly encouraged; many NHS trusts now mandate it for direct care)
• Fit-to-work declaration and occupational health assessment for anyone with a declared health condition

6. References

Most NHS frameworks require a minimum of two professional references covering the last three years of employment, including all gaps. References must be from a line manager or clinical supervisor — not a colleague or personal contact. Agencies must validate that references are genuine.

7. IR35 and employment status

Post-April 2021 IR35 reforms mean that NHS trusts and large private healthcare organisations are responsible for determining the employment status of agency workers they engage. If a locum is deemed "inside IR35," PAYE and National Insurance must be deducted.

Agencies must work with clients to ensure compliant status determinations and avoid fines. Umbrella companies are commonly used to simplify payroll compliance for locums working on multiple assignments.

Building a compliance-first culture

Technology is necessary but not sufficient. Agencies that excel at compliance do the following:

Document everything. Every check, every renewal, every conversation with a candidate about outstanding requirements — it should all be logged with a timestamp and the name of the consultant who performed the check. Set expiry alerts early. Waiting until the day a certificate expires means last-minute scrambles and potential placement gaps. Setting alerts at 60, 30, and 7 days gives candidates and consultants time to act. Audit regularly. Run internal compliance audits quarterly. Any candidate who has been placed in the last 6 months but has not had their compliance reviewed is a risk. Train your consultants. Compliance requirements change. NMC guidance evolves, DBS policies update, and new NHS framework audit criteria are published. Consultants need ongoing training — not just a one-off induction.

How LocumShift AI helps

LocumShift AI was built specifically for UK healthcare staffing compliance. The platform provides:

• Automated DBS and professional registration checks with real-time alerts
• Compliance matrix showing every candidate's status across all required documents
• Expiry tracking with configurable alert thresholds
• Audit trail — every check, every update, every conversation is logged with timestamp and user
• NHS framework-ready reporting — generate compliance reports instantly for NHS audits

For agencies managing dozens or hundreds of active candidates, manual compliance tracking in spreadsheets is not scalable. LocumShift AI automates the routine and surfaces the exceptions — so your consultants can focus on building relationships and filling shifts.

Ready to see how LocumShift AI can reduce your compliance risk? Book a demo and we'll walk you through the compliance suite.