DBS checks for healthcare and NHS roles

“Works in a hospital” is not a DBS check level. The person who delivers healthcare, the porter who moves patients, the receptionist who speaks to them and the contractor who repairs equipment can have different legal routes, even on the same site. Some duties may be regulated activity and support an Enhanced check with a barred-list element. Others may support Enhanced without a list, Standard or only Basic. A recruitment policy still needs to decide whether and when a check is required.

The DBS healthcare eligibility leaflet, updated in September 2026, works through these differences. It says a role involved in providing health or care services with patient contact can be eligible for at least a Standard check. More detailed entitlement depends on activity, contact, setting and the relevant workforce. The leaflet's examples are guidance for assessing facts, not a job-title code that should be copied into an application.

Start with a written account of the work. Identify what the person does, whether they provide treatment or care, who directs or supervises it, whether they have contact with patients, which ages they serve, how often the contact occurs and where it happens. Then use the DBS eligibility collection and current healthcare leaflet to identify the legal route. A clinical title, professional registration or NHS employer name can be relevant evidence, but none replaces this role assessment.

When healthcare becomes regulated activity

The DBS adult barred-list guidance says providing healthcare to adults is regulated activity where it is done by a regulated healthcare professional or under the direction or supervision of one. A single instance can meet the adult activity condition. The healthcare leaflet gives examples of doctors, nurses and healthcare assistants, then explains what direction and supervision mean in practice.

Direction concerns specific instructions from a regulated professional about what treatment to provide and how. Supervision concerns the professional being in contact with the worker at the point treatment is provided. Do not infer that every general instruction, clinical protocol or line-management relationship is enough. The assessment is about the actual healthcare provided to a patient and the professional's role in it. The healthcare leaflet illustrates this with a phlebotomist who takes blood under instructions and a trainee nurse providing treatment under clinical supervision.

Where the criteria are met for adult healthcare, an Enhanced certificate with the Adults' Barred List can be available. Where the patient is a child, assess the child workforce and its own regulated-activity provisions. A clinician treating adults and children can have an entitlement in both workforces, but the application must reflect the actual duties. The DBS child and adult guides say mixed workforces need separate assessment.

Regulated activity is a legal category. It is not created by the word “clinical” in a title. A support worker may provide treatment under a professional's direction. A person with a clinical qualification may be hired into a role that does not provide healthcare. A manager needs to document the tasks of the present role, not presume the highest level from a qualification held in the past.

Patient contact can support a different route

Some healthcare roles support services and involve contact with patients without providing regulated healthcare. The DBS healthcare leaflet says certain administrators, medical secretaries and receptionists can be eligible for Standard where the employing organisation decides that their work enables health services and they have patient contact. The DBS Standard guide also lists work related to providing health services with patient contact. It warns that some roles can have an Enhanced route under other provisions.

Patient contact in the healthcare leaflet can occur in person, online or by telephone. That matters for remote booking teams and interpreters. A service should not classify a telephone role as “no contact” without examining what the worker actually says to patients. Equally, access to a building or a corporate email account is not patient contact by itself.

Enhanced without a barred-list element may be available for some patient-facing work that meets the relevant child or adult workforce conditions. Do not turn a frequency example into a universal rule across all health roles. Identify the particular child or adult provision and record the contact pattern. If neither Standard nor Enhanced eligibility is established, Basic remains available where a proportionate policy justifies a criminal-record check.

A role with no patient contact is not universally limited to Basic. A separate statutory role or other-workforce provision might support a higher level. The safer rule is to assess every potential legal route. For an ordinary administrative or commercial role with no patient contact and no other exception, the healthcare leaflet points to Basic, but a reviewer should not turn that example into a rule about every role in every NHS organisation.

This table is for questions to investigate. It does not decide an application. The check-level guide owns the full Basic, Standard and Enhanced comparison; the adult and child regulated-activity guides own the legal detail.

Hospitals, children's hospitals and hospices

The healthcare leaflet distinguishes a general hospital from a children's hospital. It sets out a setting-based route for certain work in a children's hospital where the person works there more than once, has the opportunity for contact with children through the job and works for the hospital's purpose. That can make an Enhanced child-workforce check available without a Children's Barred List element even when the worker does not provide regulated healthcare or personal care.

Do not assume every child-facing hospital worker is in regulated activity. The list element requires its own basis. Conversely, do not apply the children's-hospital setting route to every paediatric clinic or to any building that sometimes sees children. The leaflet also distinguishes children's hospices that carry out hospital functions from those providing day services only. Check the actual service and setting before applying a setting-based route.

The 1 September 2026 change to the supervision exemption for some child regulated activities can affect health and support roles. It does not remove the need to establish the activity and any remaining frequency or overnight condition. Review the DBS change guidance and the latest sector rules when an affected role has been assessed under an older framework.

For a mixed child and adult hospital, record both workforces where the person actually performs relevant work. A certificate for one workforce does not automatically cover the other. If the role changes from adult ward work to paediatric treatment, revisit the eligibility assessment and the old certificate before the new duties begin.

Porters and patient transport

A hospital porter is an unusually clear illustration of why titles fail. The DBS healthcare leaflet says a porter who moves waste and equipment through patient areas can, where the hospital considers the work part of health-service provision and the person has patient contact, be eligible for Standard. A porter who conveys adults to or between healthcare appointments may be in adult regulated activity and eligible for Enhanced with the Adults' Barred List. The decision turns on the assigned task, not the porter label.

The child position can differ. Moving a child within a general hospital does not necessarily amount to child regulated activity. If the worker is responsible for supervising the child and does so often enough, another child route may apply. The leaflet gives examples where the presence of nursing staff and the allocation of responsibility change the outcome. Record who supervises the patient during movement and the actual frequency. Do not copy the adult conveyance rule into a child application.

External patient transport can also involve separate adult regulated-activity criteria. This article stays with the healthcare provider's role assessment. The drivers and transport guide should own detailed transport services, escort duties and vehicle scenarios. The portability guide owns whether an earlier certificate can be relied on for a new placement.

Reception, call handlers and interpreters

A receptionist who enables care through appointments and has contact with patients may be eligible for Standard under the health-service support route. An internal finance worker with no patient contact may need a different assessment. A medical secretary who communicates with patients by phone can have contact even without a front-desk position. Do not use an “office versus ward” split as a shortcut for the legal question.

The DBS healthcare leaflet separates directory-style telephone operators from call handlers who provide advice. A worker who simply provides a service number or redirects a patient to a clinician may be in a Basic-only example. A worker giving advice or guidance may have a different Enhanced route without a barred-list element under child or adult guidance. A call handler who actually provides healthcare under direct instruction from a regulated professional can, depending on the facts, be in regulated activity. A 999 or 111 badge does not determine which of those functions the person performs.

An interpreter translating a clinician's diagnosis or treatment does not usually become the person who provides healthcare merely by repeating the words. The leaflet describes a Standard route where the translation supports health-service provision and involves patient contact. A children’s-hospital setting can create a different child route if its conditions are met. Ask what the interpreter does and where, not whether they belong to an agency or hold an “NHS interpreter” title.

These distinctions have practical value for remote care. Contact can be by telephone or online, but the content of the service still matters. Collect the script or service description, escalation path, clinician instructions and whether the worker is giving clinical treatment or only arranging it. A job description that says “supports patients” is too vague to choose a level.

Cleaners, maintenance teams and commercial visitors

The healthcare leaflet asks providers to assess contracted cleaners, technicians, plumbers and engineers individually. A person cleaning ward areas to protect patients and encountering them through the work may support health-service provision with patient contact. A person maintaining essential heating or electrical systems in occupied patient areas may have a similar Standard route. A person working only in offices or public areas without patient contact may have only Basic under the healthcare example.

Do not promise every ward cleaner an Enhanced certificate or a barred-list result. Cleaning is not automatically personal care or healthcare. A contractor may be in the building daily without supervising children or providing adult regulated activity. If the worker later assists with patient movement or treatment, review the new assignment rather than stretching the original decision.

The leaflet describes medical sales representatives who merely visit to sell supplies as a Basic example. A supplier who demonstrates equipment to patients or clinicians may do more than sell. The duties, patient contact and possible instruction have to be examined. A provider should describe what happens during the demonstration and use the current DBS guidance instead of saying that every supplier has the same level.

A healthcare provider and its contractor should agree who supplies the role description, who checks identity, who submits an application if one is appropriate and who makes the site access decision. An assurance spreadsheet that says “Enhanced DBS held” is not enough to demonstrate the level was lawful or that it fits the actual site assignment. The agency-worker guide owns the placement handoff in more detail.

NHS and CQC obligations sit alongside DBS eligibility

DBS eligibility sets the legal ceiling for a particular disclosure. NHS employment standards, CQC requirements and provider safeguarding procedures address broader recruitment assurance. Treat these as related but separate questions. A profession's registration check verifies professional status; a DBS certificate concerns criminal-record disclosure and any eligible barred-list element. References, identity, qualifications and employment history remain separate evidence.

CQC Regulation 19 guidance describes fit and proper persons employed and a broad scope that can include people engaged without an ordinary employment contract. Providers need robust processes to gather information relevant to good character and suitability. Do not summarise this as “CQC requires Enhanced for everyone.” The role's actual DBS entitlement still needs assessment.

NHS organisations should check the current NHS criminal record checks standard and their own recruitment rules. A DBS result does not itself verify right to work, professional registration or occupational health. Those topics have their own owners and should not be collapsed into this guide. Where an NHS organisation accepts a previous certificate, it should also apply the current standards on staff movement and the DBS guidance on accepting an earlier certificate.

For a worker supplied by an agency, record which entity has undertaken each check and which entity makes the role-specific decision. If a person moves from reception work to supervised treatment, the clinical work may change the eligibility route. An NHS badge or prior CQC inspection does not substitute for a new role assessment.

Four cases worth documenting

The phlebotomist. The worker takes blood from adult and child patients under treatment instructions from a regulated professional. The provider records the instructions, age groups and actual assignment, then checks the healthcare leaflet's direction example and both workforce guides. It assesses barred-list entitlement for each workforce and obtains the level the current duties support. The provider separately verifies competence and any required registration.

The hospital porter. One porter collects waste in ward areas. Another moves adult patients between treatments. A third is assigned responsibility for supervising children during transport. The employer should not use one check-level code for all three. It records tasks, who has responsibility for the patient, relevant frequency and the legal route. The second worker may have an adult conveyance route that the first does not.

The remote call handler. The worker either gives phone numbers, provides health advice, or delivers specific treatment instructions under a regulated clinician's direction. Those are three different functions. The team documents scripts, escalation rules and clinician oversight. It then compares the actual service with the DBS healthcare and child or adult guidance instead of assuming that all 111 staff have barred-list access.

The ward contractor. A maintenance engineer regularly repairs equipment in occupied patient areas. The provider decides whether the work supports health services and involves patient contact. If the same contractor later works only in an isolated plant room, the context has changed. The contract owner records site and assignment details, confirms the worker's identity and decides whether any existing certificate remains suitable.

These are illustrations of questions, not final legal determinations for a named occupation. Real job descriptions may include additional functions, locations or sector requirements. An uncertain case should be reviewed by the DBS lead or a specialist before a higher-level application.

Build a useful record without overstating the product

A healthcare recruiter can record the role version, actual duties, patient groups, location, contact pattern, regulated professional's direction or supervision where relevant, legal source, level chosen and person who approved it. If a barred-list element is requested, the record should explain the separate entitlement. If the organisation decides a check is required by NHS, CQC, safeguarding or contract policy, cite the rule or policy separately from DBS eligibility.

After issue, inspect the certificate and make a suitability decision under the provider's policy. A prior certificate has no official DBS expiry date. A change in duties, an incident, an Update Service result or a sector requirement may justify review. Limit who sees criminal-record information and keep only what current law and policy support. The record-keeping guide owns certificate retention and review controls.

Complys has generic worker-linked document records and configurable date reminders. Current product evidence does not verify structured DBS level, workforce or barred-list fields, professional-registration validation, Update Service integration or a legal eligibility engine. A provider can assess whether generic records help track its own decisions, subject to privacy and product review. Do not claim that Complys chooses the level or confirms NHS or CQC compliance.

A useful free tool would be a healthcare role-description worksheet. It could prompt the user for duties, patient contact, age groups, professional direction, setting, and the official guidance consulted. It should flag questions and route uncertain cases to an authorised reviewer. It should never announce “Enhanced required” solely from “nurse”, “porter” or “hospital cleaner”.

Take one real role and compare its daily tasks with the current DBS healthcare leaflet. Record the route, the organisation's separate recruitment requirement and the reviewer. Revisit that record when duties or service settings change.