DBS Checks for UK Healthcare Workers: Records, Levels, and Renewal

Quick answer: UK healthcare and social care employers must carry out Disclosure and Barring Service (DBS) checks at the appropriate level before engagement — usually Enhanced with Barred Lists for direct-care roles with vulnerable adults or children. Records must evidence the check type, certificate number, date issued, and fit-to-engage decision. DBS certificates don't expire formally, but most NHS and local authority employers require a 3-yearly refresh via the DBS Update Service, or a fresh check, or annual verification.

DBS checks are the single most-documented aspect of healthcare recruitment. The records you keep prove the check was done, at the right level, before the first shift. Miss that — or have the wrong level — and a single incident becomes a career-defining CQC breach for the employer and a fitness-to-practise issue for the professional.

The four DBS check levels

1. Basic — unspent convictions only. £26. Rarely sufficient for healthcare roles.
2. Standard — spent and unspent convictions, cautions, reprimands, warnings. £26.50. Sometimes used for non-patient-facing roles.
3. Enhanced — Standard plus any police information judged relevant. £52.50. The default for patient-facing roles.
4. Enhanced with Barred Lists — Enhanced plus check against the Children's or Adults' Barred List. £52.50. Required for most direct-care roles.

Who needs which level

The check level depends on whether the role qualifies as "regulated activity" under the Safeguarding Vulnerable Groups Act 2006:

• Nurses and HCAs on wards or in community care — Enhanced with Adults' Barred List (and Children's Barred List if working with paediatric patients)
• GPs and practice staff — Enhanced with both Barred Lists
• Care home staff (residential and domiciliary) — Enhanced with Adults' Barred List
• Paediatric specialists — Enhanced with Children's Barred List
• Mental health and learning disability services — Enhanced with both Barred Lists
• Non-clinical NHS staff (finance, IT, porters) — Basic or Standard typically
• Volunteers in direct contact with service users — same level as paid equivalents, usually free

The DBS Update Service

Applicants can subscribe to the Update Service for £16/year. The employer then performs an online status check — is the certificate still current, or have changes been recorded? This is the basis for annual refresh in many NHS trusts.

The check is only valid with the applicant's consent and with the same level of certificate type on file. If an applicant was Enhanced with Barred Lists and you need a Standard check, you need a new certificate — not a status check.

What records the employer must keep

You must evidence:

• The role's risk assessment and the check level decision
• Applicant's consent to the check
• Certificate number, date issued, level of check
• The fit-to-engage decision (especially important if disclosure revealed anything)
• Risk assessment notes for any disclosed information
• Update Service status check results and dates
• Retention of the certificate itself — see below

Keeping the certificate — GDPR implications

The DBS Code of Practice is explicit: employers should not keep the physical certificate beyond 6 months after the fit-to-engage decision, except in specific circumstances. After 6 months, you retain the certificate number, date, and decision — but not the certificate itself.

Storing certificates indefinitely "just in case" is a GDPR breach and a DBS Code violation. Secure destruction with evidence is the standard.

Barred List implications

If an applicant is barred from working with children or vulnerable adults, they cannot legally work in regulated activity with that group. This is an absolute bar. Offering a regulated-activity role to a barred person is a criminal offence.

The Update Service only flags changes to Barred List status if the certificate was Enhanced with the relevant Barred List to begin with. A Standard check won't surface subsequent barring.

Renewal intervals

There is no statutory expiry. Employer policy drives the renewal cycle:

• Most NHS trusts: 3 years for fresh check, with annual Update Service checks in between
• Most local authorities: 3 years
• CQC guidance: 3 years is the de facto minimum expectation for ongoing regulated activity
• Agency staff: often checked more frequently

When a new check isn't needed

Portability is limited. You generally can't "port" a DBS check between employers — each employer must decide whether the original check meets their needs. However:

• Through the Update Service, an employer can verify an existing check online
• Within the same legal entity (e.g., NHS trust), internal moves may not require new checks
• Agency-to-client moves usually require a new or Update Service check

Disclosed information — risk assessing

If the check reveals information (convictions, cautions, other police information), the employer must conduct a documented risk assessment before making a fit-to-engage decision. This involves:

• Relevance to the role
• Time elapsed since the offence
• Age of the person at the time
• Pattern of offending (single event vs. series)
• Evidence of rehabilitation
• Applicant's explanation

The decision and its reasoning must be recorded. "We just didn't feel comfortable" won't survive an employment tribunal or fitness-to-practise hearing.

Specific healthcare scenarios

• Moving between UK nations: DBS (England/Wales), Disclosure Scotland, AccessNI — equivalent but not interchangeable
• Overseas-trained clinicians: DBS plus equivalent check from country of previous residence
• Students on clinical placement: university covers the DBS check; placement providers verify
• Self-employed locums: agency or engaging organisation covers the check

Common mistakes

1. Wrong check level — Standard when Enhanced with Barred Lists was required
2. Starting work before the certificate arrives, without a documented risk assessment
3. Keeping the physical certificate beyond 6 months
4. Update Service renewal missed, leaving a gap in cover
5. Disclosed information not risk-assessed in writing
6. Agency-provided check not re-verified when the worker joined permanently

FAQs

How long does a DBS check take?

Enhanced checks typically 2-4 weeks; sometimes longer for complex cases or overseas residents. Basic checks often return within a week. Plan recruitment around this.

Can an applicant start work before the certificate arrives?

Only under a documented risk-assessed arrangement, with supervision, and only where the role permits. Most NHS trusts and care providers require clearance before any direct-care shift.

What if the applicant refuses consent for the Update Service?

They're entitled to refuse. The employer can then require a fresh check on the employer's schedule and at the employer's expense.

Are DBS checks required for locums and agency staff?

Yes, at the appropriate level for the role. The agency typically holds the check; the engaging organisation verifies via Update Service or certificate sight.

Related guides

• NMC Revalidation for UK nurses
• CQC inspection records for UK care providers
• GMC appraisal and revalidation

Sources and further reading

• Disclosure and Barring Service
• DBS Update Service
• Safeguarding Vulnerable Groups Act 2006
• DBS Code of Practice

Last reviewed 2026-04-22 by Jamie Dawson, Editor. Corrections: corrections@logbook.co.uk