Is infection control training a legal requirement in the UK?

Yes. Infection control training is a legal requirement for anyone working in health and social care, and a strong regulatory expectation in food handling, childcare, cleaning services and other environments where infection risk is foreseeable. It is not a stand-alone Act of Parliament with a single named clause. It is built from overlapping duties: the Health and Safety at Work etc. Act 1974, the Control of Substances Hazardous to Health Regulations 2002 (COSHH), the Management of Health and Safety at Work Regulations 1999, and, for CQC-registered providers, Regulation 12(2)(h) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. Together, these require employers to train staff on infection prevention, provide the right procedures and equipment, and evidence competence. Failing to do so is a breach of statutory duty, and CQC-registered providers can be issued warning notices, fined, or refused registration.

The legal framework in plain English

Infection control sits inside four separate legal instruments that all apply at once. Understanding which one bites in your setting matters, because the enforcement body changes with it.

Health and Safety at Work etc. Act 1974

Section 2 places a general duty on every employer to ensure, so far as is reasonably practicable, the health, safety and welfare at work of all employees. This is the foundation. Where infection is a foreseeable workplace hazard, whether from patients, colleagues, food, waste, or contaminated surfaces, training is one of the reasonable steps an employer must take. The Health and Safety Executive (HSE) enforces this Act in most workplaces outside health and social care.

COSHH Regulations 2002

The Control of Substances Hazardous to Health Regulations 2002 treat biological agents (including bacteria and viruses) as hazardous substances. Regulation 6 requires a suitable and sufficient risk assessment. Regulation 12 requires the employer to provide employees with information, instruction and training so they understand the risks and the control measures in place. In any workplace where staff may be exposed to blood, bodily fluids, food-borne pathogens or contaminated waste, COSHH training and infection control training overlap directly.

Management of Health and Safety at Work Regulations 1999

Regulation 3 requires a risk assessment of significant hazards, and Regulation 13 requires the employer to provide adequate health and safety training on recruitment and on exposure to new or changed risks. This is the regulation that captures induction and refresher training obligations. Regulation 13 is the reason "we assumed they knew" is not a defence.

Health and Social Care Act 2008 and Regulation 12(2)(h)

For any provider registered with the Care Quality Commission (CQC), including hospitals, care homes, GP practices, dental practices and community services, Regulation 12 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 sets a specific statutory duty. Regulation 12(2)(h) requires providers to assess the risk of, and prevent, detect and control, the spread of infections, including those that are healthcare-associated. The Code of Practice on the prevention and control of infections (the "Hygiene Code") is the practical standard CQC uses to judge compliance during inspections. For NHS providers, the operational rulebook is the National Infection Prevention and Control Manual for England.

Who must be trained?

The people who most obviously need infection control training are health and social care workers: nurses, healthcare assistants, care home staff, community carers, dental nurses, phlebotomists, midwives, ambulance crew and paramedics. But the scope is wider than that. Anyone whose job creates a foreseeable risk of transmitting infection to themselves, colleagues or the public should be trained. This includes:

• Food handlers, chefs and kitchen staff in hospitality, schools, care homes and food manufacturing.
• Cleaners, waste operatives and laundry workers, especially those handling clinical or contaminated waste.
• Beauticians, tattoo artists, piercers and body-modification practitioners.
• Nursery staff, childminders and early years practitioners.
• Personal care providers such as hairdressers, barbers and manicurists.
• Gym instructors, sports coaches and swimming pool staff.
• Facilities and maintenance teams in schools, offices, prisons and shared residential settings.

For CQC-registered providers, infection control competence is not optional and is not a one-off event. The Code of Practice expects providers to demonstrate that staff receive appropriate training at induction and refresh it regularly, with records available for inspection.

What good infection control training covers

A competent infection control course teaches the chain of infection (source, transmission, host) and then works through the practical controls that break the chain at each point. Expect the following core content:

• Understanding infection. Sources, modes of transmission, susceptible hosts, and the difference between colonisation and infection.
• Hand hygiene. The World Health Organization five moments, correct technique, when to wash versus when to sanitise, and glove use.
• Standard precautions. Assuming any bodily fluid may be infectious, the use of personal protective equipment, and safe handling of sharps and waste.
• Healthcare-associated infections (HAIs). Common organisms including MRSA, Clostridioides difficile, E. coli, norovirus, and the practical steps that reduce transmission.
• Isolation and cohorting. When and how to isolate a service user, signage, entry rules, and safe de-isolation.
• Cleaning and decontamination. Colour-coded equipment, dilution rates, terminal cleans and the difference between cleaning, disinfection and sterilisation.
• Outbreak management. Recognising the signs of an outbreak, reporting duties, and the role of local Health Protection Teams.
• Record keeping. Incident logs, RIDDOR reporting where applicable, and evidence for CQC or HSE inspection.

Content is only half the picture. Good training is scenario-driven, uses realistic UK settings, and assesses understanding rather than attendance. A tick-box PowerPoint delivered once a year is not defensible in a serious incident review.

Why healthcare-associated infections still matter

The most recent UK Point Prevalence Survey on healthcare-associated infections (UKHSA, 2023) found that 7.6% of hospital inpatients had at least one HAI at the time of survey, up from 6.6% in 2016. In acute NHS trusts the figure was 8.0%. UKHSA's annual epidemiological commentary shows that MRSA bacteraemia rates rose 29.5% between 2018/19 and 2024/25, and E. coli bloodstream infections have been trending upwards for a decade.

The financial cost is significant. Modelling by Guest and colleagues in BMJ Open estimates that HAIs cost NHS hospitals in England around £2.7 billion a year, account for 7.1 million occupied bed days (21% of all NHS bed days in England) and are associated with 28,500 patient deaths. The human cost, in avoidable deaths and long recoveries, is higher still. Every one of those infections is a preventable transmission that infection control training addresses.

How often should training be refreshed?

The Code of Practice does not set a single fixed refresh interval, but the CQC and NHS both expect annual refresher training in health and social care settings as a minimum. For food handlers, refresher training every two to three years is standard practice under the Food Standards Agency guidance. Higher-risk roles or roles that have seen an outbreak should refresh sooner. Keep a training matrix that logs the date completed, the certificate reference and the next due date; this is the single most useful document you can produce during a CQC or HSE inspection.

What happens if you do not train staff?

Enforcement action depends on the sector. In non-healthcare workplaces, the HSE and local authority environmental health officers can issue Improvement Notices (which set a remedial deadline) and Prohibition Notices (which stop the activity immediately). Prosecution under the Health and Safety at Work Act 1974 carries unlimited fines and, in the most serious cases, custodial sentences for senior managers.

In CQC-registered health and social care providers, the consequences are more direct. CQC can issue a warning notice, impose conditions on registration, suspend registration, or cancel it entirely. A poor rating under the "Safe" and "Well-led" domains often traces directly back to gaps in infection prevention training and documentation. Serious outbreaks with fatalities can trigger a Corporate Manslaughter investigation.

Choosing an infection control course

When choosing a course, check three things. First, the accreditation: for CPD portfolios, CPD-accredited providers meet the standard most UK employers expect. Second, the content: does it map to the WHO five moments of hand hygiene, cover healthcare-associated infections in UK terminology, and address both clinical and non-clinical settings appropriate to your role? Third, the certificate: instant issue on completion, verifiable online, and accepted by CQC and HSE inspectors as evidence of training.

learndirect's Infection Control Training is CPD accredited, delivered fully online with no fixed timetable, and issues an instant certificate on successful completion of the final assessment. The seven-lesson course typically takes 60 to 90 minutes to complete and costs £25 per learner. It covers the chain of infection, hand hygiene, standard precautions, MRSA and other healthcare-associated infections, isolation procedures, safe handling of sharps and clinical waste, and cleaning and decontamination standards. The interactive scenarios and skill checks assess understanding, not just attendance, which is what CQC and HSE inspectors look for during audits.