The short answer is yes. There is no law or regulation that requires care homes to use software from the NHS Assured Solutions List. The list exists to control access to government funding, not to define what software a care home is allowed to run. This article sets out exactly what is legally required, what is needed for funding, and what CQC actually looks at during inspections.
Connect with us about care home software · · Replies within 24 hours
The governing legislation for care records is Regulation 17 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. It requires providers to maintain records that are:
A bespoke system that produces records meeting these requirements is fully compliant with the law. There is no regulation that prohibits a care home from commissioning its own software.
The Assured Solutions List is a procurement framework run by NHS England under the Digitising Social Care (DiSC) programme. Software vendors apply to be included and are assessed against a set of core capabilities covering functionality, security, data interoperability, and clinical safety standards.
Its purpose is to control access to government funding. The NHS invested over £150 million to help care providers adopt digital social care records, distributed through Integrated Care Systems (ICSs) around the country. To receive that funding, a care home must choose a system from the Assured Solutions List. That is the only consequence of the list.
The Assured Solutions List is not mentioned in any statute or statutory instrument. No legislation requires care homes to use it. It is a quality mark and a funding gateway.
One thing: eligibility for NHS digitisation funding.
Your local ICS may be offering funding for the first year or two of a subscription system. Where that amount is significant, you must factor it into the comparison. A home that could receive £15,000 toward an off-the-shelf system is comparing a subsidised option against an unsubsidised one.
There is nothing else a care home loses by using bespoke software. There is no penalty, no compliance risk, no CQC consequence, and no legal exposure.
CQC inspectors assess the quality of the records, not the origin of the software. Their guidance states that they evaluate digital records "just like paper records" against the quality statements in the assessment framework.
During an inspection, CQC looks for evidence that:
None of these requirements specify what software produced the records. A bespoke system that generates complete, accurate, accessible records will satisfy an inspector in exactly the same way an off-the-shelf system does. The inspector does not ask what vendor you use.
Connect with us about care home software · · Replies within 24 hours
The Data Security and Protection Toolkit (DSPT) is an annual self-assessment that CQC increasingly expects care providers to complete. It covers 10 data security standards set by the National Data Guardian, including data governance, staff training, access controls, and incident reporting.
The DSPT assesses the care home as an organisation. It evaluates policies, procedures, and security practices. It does not assess or require specific software. A care home on bespoke software completes the DSPT in exactly the same way. The process does not differ from Person Centred Software, Birdie or any other platform. The toolkit's own guidance confirms it applies to "any information that care providers hold about any person, including paper records."
Two other acronyms come up in discussions about care home software regulation: MODS (Minimum Operational Data Standard) and PRSB (Professional Record Standards Body) standards.
MODS defines the essential data fields that digital social care records should capture. It is a requirement on software vendors who want to remain on the Assured Solutions List. The specification was published for assured suppliers to implement. It is not a direct legal obligation on care homes. A bespoke system could voluntarily align with the MODS data fields, but there is no legal requirement to do so.
PRSB standards (including the "About Me" standard and the Personalised Care and Support Plan standard) are conformance requirements for Assured Solutions List placement. Vendors must implement these standards to be listed. Again, there is no legislation requiring care home software in general to hold PRSB conformance. The standards are system-agnostic and could be implemented in a bespoke system voluntarily.
No pending or planned legislation was identified as of April 2026. Nothing would make the Assured Solutions List legally mandatory. Nothing would prohibit bespoke software or require a specific certification by law.
The government's approach to digital social care records has consistently been incentive-based: funding, support, the assured list, and public targets for adoption rates. It has not been mandate-based. The "Care Data Matters" roadmap sets out policy aspirations for data collection and digital maturity, but these are goals, not legislation.
CQC could, in theory, tighten its expectations around digital records in future assessment frameworks. But as of now, CQC still assesses records quality regardless of format and regardless of software origin.
| Question | Legal mandate? | Funding requirement? | CQC expectation? |
|---|---|---|---|
| Must use Assured Solutions List | No | Yes | No |
| Can use bespoke software | Yes (permitted) | Not for funding | Yes, if records meet standards |
| DSPT compliance | Practically expected | Required for funding | Yes, increasingly expected |
| MODS compliance | No | Yes (for assured vendors) | No |
| PRSB conformance | No | Yes (for assured vendors) | No |
| Digital records required at all | No (paper still legal) | N/A | Increasingly expected |
The law does not require an assured system. It does require you to keep good records and to protect personal data. A bespoke system therefore has to prove the same things, and the DSPT is where an assessor looks.
We build care systems on engage.re, which answers those obligations as properties rather than as a configuration exercise.
Our guide to the toolkit itself sits in DSPT for care homes. The proof-of-deletion question sits in can you prove you deleted someone's data.
The regulatory position is clear: any care home can use bespoke software. The practical question is whether it makes sense for your situation.
Bespoke is strongest when:
Off-the-shelf is strongest in three positions. NHS digitisation funding is available and significant. Standard workflows fit well enough. Speed of implementation is the priority.
The decision should be based on cost, fit, and control. Not on a mistaken belief that regulation requires you to use an assured vendor.
Our live care home demo opens without a login, and it covers the regulatory workflows in this article. Sign in as a nurse and run a medication round on eMAR with a full audit trail. Sign in as a family member to see the portal. It is a working system, not a screenshot.