The short answer is yes. There is no law or regulation that requires care homes to use software from the NHS Assured Solutions List. The list exists to control access to government funding, not to define what software a care home is allowed to run. This article sets out exactly what is legally required, what is needed for funding, and what CQC actually looks at during inspections.
Speak to us about care home software · +44 7494 618 651 · Mon to Fri, 9am to 6pm
The governing legislation for care records is Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. It requires providers to maintain records that are:
A bespoke system that produces records meeting these requirements is fully compliant with the law. There is no regulation that prohibits a care home from commissioning its own software.
The Assured Solutions List is a procurement framework run by NHS England under the Digitising Social Care (DiSC) programme. Software vendors apply to be included and are assessed against a set of core capabilities covering functionality, security, data interoperability, and clinical safety standards.
Its purpose is to control access to government funding. The NHS invested over £150 million to help care providers adopt digital social care records, distributed through Integrated Care Systems (ICSs) around the country. To receive that funding, a care home must choose a system from the Assured Solutions List. That is the only consequence of the list.
The Assured Solutions List is not mentioned in any statute or statutory instrument. No legislation requires care homes to use it. It is a quality mark and a funding gateway.
One thing: eligibility for NHS digitisation funding.
If your local ICS is offering funding to subsidise the first year or two of a subscription system, and that funding represents a significant amount, you need to factor it into the comparison. A home that could receive £15,000 toward an off-the-shelf system is comparing a subsidised option against an unsubsidised one.
There is nothing else a care home loses by using bespoke software. There is no penalty, no compliance risk, no CQC consequence, and no legal exposure.
CQC inspectors assess the quality of the records, not the origin of the software. Their guidance states that they evaluate digital records "just like paper records" against the quality statements in the assessment framework.
During an inspection, CQC looks for evidence that:
None of these requirements specify what software produced the records. A bespoke system that generates complete, accurate, accessible records will satisfy an inspector in exactly the same way an off-the-shelf system does. The inspector does not ask what vendor you use.
Speak to us about care home software · +44 7494 618 651 · Mon to Fri, 9am to 6pm
The Data Security and Protection Toolkit (DSPT) is an annual self-assessment that CQC increasingly expects care providers to complete. It covers 10 data security standards set by the National Data Guardian, including data governance, staff training, access controls, and incident reporting.
The DSPT assesses the care home as an organisation. It evaluates policies, procedures, and security practices. It does not assess or require specific software. A care home using bespoke software can complete the DSPT in exactly the same way as one using Person Centred Software, Birdie, or any other platform. The toolkit's own guidance confirms it applies to "any information that care providers hold about any person, including paper records."
Two other acronyms come up in discussions about care home software regulation: MODS (Minimum Operational Data Standard) and PRSB (Professional Record Standards Body) standards.
MODS defines the essential data fields that digital social care records should capture. It is a requirement on software vendors who want to remain on the Assured Solutions List. The specification was published for assured suppliers to implement. It is not a direct legal obligation on care homes. A bespoke system could voluntarily align with the MODS data fields, but there is no legal requirement to do so.
PRSB standards (including the "About Me" standard and the Personalised Care and Support Plan standard) are conformance requirements for Assured Solutions List placement. Vendors must implement these standards to be listed. Again, there is no legislation requiring care home software in general to hold PRSB conformance. The standards are system-agnostic and could be implemented in a bespoke system voluntarily.
As of April 2026, no pending or planned legislation has been identified that would make the Assured Solutions List legally mandatory, prohibit bespoke software, or require specific certifications by law.
The government's approach to digital social care records has consistently been incentive-based: funding, support, the assured list, and public targets for adoption rates. It has not been mandate-based. The "Care Data Matters" roadmap sets out policy aspirations for data collection and digital maturity, but these are goals, not legislation.
CQC could, in theory, tighten its expectations around digital records in future assessment frameworks. But as of now, CQC still assesses records quality regardless of format and regardless of software origin.
| Question | Legal mandate? | Funding requirement? | CQC expectation? |
|---|---|---|---|
| Must use Assured Solutions List | No | Yes | No |
| Can use bespoke software | Yes (permitted) | Not for funding | Yes, if records meet standards |
| DSPT compliance | Practically expected | Required for funding | Yes, increasingly expected |
| MODS compliance | No | Yes (for assured vendors) | No |
| PRSB conformance | No | Yes (for assured vendors) | No |
| Digital records required at all | No (paper still legal) | N/A | Increasingly expected |
The regulatory position is clear: any care home can use bespoke software. The practical question is whether it makes sense for your situation.
Bespoke is strongest when:
Off-the-shelf is strongest when NHS digitisation funding is available and significant, when standard workflows fit well enough, and when speed of implementation is the priority.
The decision should be based on cost, fit, and control. Not on a mistaken belief that regulation requires you to use an assured vendor.