The Care Quality Commission (CQC) is England's independent regulator of health and adult social care. Providers must register by law before carrying out regulated activities, so CQC can apply to more than hospitals and care homes.
That distinction can be easy to miss. A hotel manager might see CQC mentioned in a newsletter because the building hosts a health service, then wonder whether ordinary accommodation or guest Wi-Fi also falls under the regulator. The practical answer depends on the activity being delivered, not on the organisation's name or sector alone.
A Quick Scenario and CQC Help
A manager at a hotel with a small clinic scans an industry newsletter and sees “CQC” again. They know the letters matter, but aren't sure what they stand for or whether the regulator covers the hotel, the clinic, or both.
CQC means Care Quality Commission. It's England's independent regulator of health and adult social care, established under the Health and Social Care Act 2008 and a legal body since 1 April 2009. Its creation brought together oversight that had previously been handled by three organisations: the Healthcare Commission, the Commission for Social Care Inspection, and the Mental Health Act Commission. The aim was a common regulatory system across NHS services, independent healthcare, and adult social care. The historical account of CQC's creation and role describes that consolidation and the introduction of NHS registration.
In everyday terms, CQC checks that services carrying out regulated care activities meet fundamental standards of quality and safety. It registers providers, monitors services, assesses and inspects them, and can take enforcement action when standards aren't met. Registration isn't a voluntary badge or a marketing certificate. For providers carrying out regulated activities in England, it's a legal requirement.
That doesn't mean CQC regulates every part of a hospital, care home, hotel, or campus. In our example, the clinic may carry out a regulated activity, while the hotel's rooms, restaurant, and ordinary guest services may fall outside CQC's remit. The manager's useful first question isn't “Is this a healthcare building?” but “What care activity is being delivered, and who delivers it?”
A simple way to say it: CQC regulates certain health and adult social care activities in England, and providers must register when the law requires it.
CQC is separate from NHS England, local authorities, and professional regulators. Each has its own responsibilities. Knowing what CQC stands for is a good start, but understanding the activity it oversees is what helps an organisation work out whether registration applies.
What CQC Actually Regulates and Why
CQC's scope follows the regulated activity, not a broad label such as “healthcare,” “education,” or “hospitality.” A GP surgery, private dentist, mental-health service, care home, home-care agency, or hospice may provide regulated services. A university or college can also fall within scope for particular care activities, while other parts of the institution remain outside it.
Think of the difference like a driving licence. The licence requirement applies when you drive on a public road, not just because you own a car or push a trolley in a supermarket car park. In the same way, CQC registration depends on the care activity being provided, not just the setting where it happens.
Map the service, not the sign on the door
A care home may provide accommodation alongside personal care. A home-care agency may send workers to support people in their own homes. In some education settings, CQC regulates personal care and accommodation-related care provided to students, but the accommodation itself may not be regulated by CQC. A hotel with an on-site clinic should therefore distinguish the clinic's services from ordinary accommodation and guest services.
A practical way to begin is to list what staff do for service users, patients, or residents. Then identify which activities may be regulated and who is responsible for delivering them. CQC's overview of the services it regulates can help clarify the scope, but organisations should assess their own activities rather than assume that a headline sector determines the answer.
For organisations that need to align operational systems with regulatory responsibilities, this guide to regulatory compliance services offers a related starting point. It doesn't replace checking the rules that apply to a specific service.
The same care is needed with the phrase “CQC compliant.” A provider may be registered for certain activities, but that doesn't mean every facility, commercial service, cybersecurity measure, or guest-experience process has been assessed by CQC. Ask what the provider is registered to do, which location delivers that activity, and which services sit outside the regulator's remit.
How CQC Inspections and Ratings Work
A CQC rating is a summary of a much wider assessment. The familiar labels, Outstanding, Good, Requires improvement, and Inadequate, are not produced by looking at a single document or one moment in a building. CQC can draw on on-site inspection, off-site information, and evidence from different sources.
Its single assessment framework was introduced in January 2024. Inspectors assess services through five key questions: safe, effective, caring, responsive, and well-led. These questions make the rating easier to understand. A service might have sound clinical procedures, for example, but still need attention if people's feedback suggests staff don't respond well to their needs.
Read the evidence behind the headline
The process is a little like a school report that considers more than exam results. Inspectors may observe how a service operates, interview staff and people who use the service, review care records and policies, and consider feedback. The rating brings these strands together, but the published report gives readers more context about what inspectors saw and why they reached their conclusions.
If you're comparing services, check the date, location, and regulated activity covered by the rating. A provider's rating for one service or location doesn't automatically describe another. And because the assessment framework has changed, ratings produced under different frameworks may not be directly comparable.
For a family looking at dementia support, a headline rating is only one part of the decision. It's also useful to understand the type of care offered, the needs the service can support, and the evidence behind its approach. A dementia care facilities guide can help readers think through those practical questions alongside regulatory information.
A rating is a useful signal, not a substitute for reading the report and checking whether it describes the service you're considering.
The same principle applies to providers reviewing their own assessment. A strong rating matters, but the evidence behind it can help staff see what works consistently and where practice needs to improve. The five questions offer a way to examine day-to-day care, not just prepare for an inspection.
What CQC Activity Looks Like in Practice
CQC doesn't operate only through scheduled inspections. Its work includes assessment reports, formal warnings, regulatory notices, urgent enforcement, and inspections in local areas. That makes it more like a council team balancing routine checks, follow-up on concerns, and urgent call-outs than a single inspector visiting every provider on a fixed timetable.
During 2024/25, CQC published 3,825 health and social care assessment reports, compared with 6,230 in 2023/24 and 10,356 in 2022/23. In 2024/25, it also issued 494 Warning Notices, served 2,387 notices, including Notices of Proposal and Notices of Decision, and undertook 82 urgent enforcement actions. It carried out 28 full inspections in local areas across England, compared with 26 the previous year. CQC's annual performance analysis sets out these distinct types of activity.
Why fewer reports don't tell the whole story
The fall in published assessment reports shouldn't be read as a direct measure of how important CQC is or how much regulatory pressure providers face. CQC has been changing its assessment model and approach, while identifying improvements needed in assessment delivery, provider guidance, and registration backlogs. A lower number of reports can sit alongside formal notices, urgent interventions, and other forms of regulatory work.
For a provider, the practical lesson is to avoid treating an inspection date as the only moment that matters. Monitoring, evidence, and response procedures need to work as part of normal operations. A care home, for instance, should be able to show how it responds to concerns and maintains safe services, rather than relying on a last-minute folder of paperwork.
That includes the physical environment. Teams reviewing safety risks can use this overview of hazards in nursing homes as a prompt to consider how everyday hazards are identified and managed. It's one piece of operational thinking, not a substitute for understanding the provider's regulatory duties.
CQC, Guest Wi-Fi and Captive Portal Authentication
In a care home or healthcare facility, guest Wi-Fi can share a building with clinical, staff, or resident networks. That makes network access a governance concern, even though a captive portal by itself doesn't make an organisation CQC-compliant. The useful question is whether the organisation can explain who gets access, how it's controlled, and how the guest network is kept separate from sensitive systems.
Start by separating two layers. Wireless encryption, such as WPA2-Personal or IPSK, protects the connection between a device and the access point. Captive portal authentication happens after that connection, controlling whether the user can access network services. It's like a locked front door followed by a reception desk that checks a visitor's pass before they enter a meeting room.
Match the sign-in flow to the visitor
Cisco Meraki captive portals can use click-through or sign-on workflows. Click-through lets a guest accept terms or continue without entering credentials. Sign-on can use Meraki Authentication, an external RADIUS server, or LDAP. A Meraki splash-page flow can redirect a guest to a branded page, collect an approved form of authentication, and then send the user to the requested destination. Depending on the setup, that may include social login or SMS-based sign-in. Cisco Meraki's captive portal guide explains these authentication and redirect options.
The same idea works across sectors. A campus may give students and staff different access rules. A retailer may offer guest Wi-Fi with a social WiFi login. A corporate BYOD network can distinguish employee-owned devices from visitors and contractors.
A shared wireless password can be difficult to manage: if it spreads beyond the intended users, the organisation may need to change it for everyone. Meraki's IPSK and EasyPSK approach uses identity-based pre-shared keys tied to an endpoint, group, or device policy. EasyPSK is supported on MR firmware version 32.1.3 and newer, and Meraki configures it through Wireless > Configure > Access control by selecting Identity PSK with RADIUS and an access-management service. Meraki's IPSK documentation describes the model.
RADIUS can connect authentication to policy decisions, including session duration, bandwidth settings, and whether internet access is allowed. Cisco Spaces documentation recommends RADIUS for captive portals and makes it mandatory for certain provisioning and policy needs. Its captive portal rule guide outlines those controls.
For the network manager's wider view of how these pieces fit together, this captive portal guide provides additional context. In a care setting, keep the records proportionate: capture useful authentication and administrator activity, define retention and deletion rules, and avoid exposing sensitive care information through a guest network.
What a CQC Rating Does and Does Not Tell You
A Good or Outstanding rating can be reassuring, but it isn't a guarantee that care is instantly available or that every person will have the same experience. A rating reflects evidence gathered for a particular service and location. It isn't a live dashboard of capacity, staffing, or current waiting times.
That matters because the ratings system includes assessments under different frameworks. As of 1 August 2025, CQC reported 3,062 adult-social-care ratings published under its single assessment framework, alongside 20,467 services still carrying current ratings from earlier frameworks. Those figures appear in CQC's State of Care charts. When comparing two services, a reader may be looking at evidence assembled in different ways.
Treat the rating as one useful clue
Wider system pressures also shape what a rating can tell you. In 2024/25, adult-social-care requests for support rose 4% year over year and 8% compared with 2019/20. During that year, 1,809,000 people waited more than 12 hours in A&E, 10% more than the previous year. Care-home occupancy rose from 78% in 2021/22 to 84% in 2024/25, while beds per 100,000 people aged 65 and over fell nearly 2%. These measures describe the wider context, not the performance of any one provider.
A restaurant review is a useful analogy. A strong review tells you how the meal went when the reviewer visited, but it can't promise what tonight's service will be like. In the same way, a CQC rating is a valuable signal, not a real-time guarantee of availability, responsiveness, or personal experience.
Before relying on a rating, check:
- The date and framework: Find out when the rating was published and which assessment framework applied.
- The location and activity: Confirm that it covers the service you're considering.
- The inspection evidence: Read the report and check for recent enforcement notices.
- Current capacity: Ask about availability and whether the service can meet the person's needs.
For additional perspectives on aged-care reviews and the kinds of practical questions families may ask, see these care insights on aged-care reviews in Queensland. For senior-living operators thinking about how technology supports residents and staff, this senior-living technology overview offers related context.
A captive portal can't confer CQC compliance. Its authentication logs, role-based access controls, and documented operating procedures can, however, contribute structured evidence of how connectivity is managed when considered alongside wider policies and care records.
Mapping Your Own Activity-Level Compliance
Start with the service, not the organisation's branding. A hospital, hotel, campus, or senior-living community may deliver several kinds of service, and only some may be regulated activities. Make a simple map of what staff do, who delivers each activity, and which location is responsible.
Then review the systems that support safe, consistent operations. For guest Wi-Fi, document the access-control policy, keep auditable records of administrator activity, separate guest traffic from clinical or resident networks where relevant, and set clear retention and deletion rules for portal data. Support procedures should show reliable, person-centred service without exposing sensitive records.
Cisco Meraki captive portals, paired with IPSK or EasyPSK and RADIUS-backed authentication, can help create structured evidence of how network access is managed. That evidence belongs alongside broader service policies, not in place of them. Organisations unsure whether an activity requires registration should confirm the rules for that activity and seek appropriate regulatory guidance. For practical work on improving healthcare processes, these healthcare quality improvement steps can help teams think about how to review and strengthen their approach.
If you're mapping connectivity within a healthcare environment, this healthcare management solution overview offers further context on technology in that setting.
Splash Access provides Cisco Meraki guest Wi-Fi captive portals, including WPA2 and IPSK authentication, customizable sign-in pages, and integrations for healthcare, education, retail, and corporate BYOD. Explore Splash Access to see how its tools can support clearly managed guest connectivity alongside your wider governance policies.
