Mandatory Training Records for UK Healthcare Staff: CSTF Complete Guide (2026)

Quick answer: UK healthcare and care sector employers must evidence that all staff are current on mandatory training. The Core Skills Training Framework (CSTF) defines 11 modules with specific refresher intervals. Records must show completion dates, expiry dates, and evidence of competence where assessed. Completion rates under 85% on any mandatory module are a CQC risk, an employment-law exposure, and a clinical governance failure.

Mandatory training is the most visible evidence of a safe workforce. The training matrix on your wall is the first thing a CQC inspector reviews, the first thing an NHS commissioner audits, and the first thing a coroner requests when something goes wrong.

The 11 CSTF modules

1. Equality, diversity and human rights — every 3 years
2. Conflict resolution — every 3 years (clinical and patient-facing roles)
3. Health, safety and welfare — every 3 years
4. Fire safety — annual
5. Infection prevention and control (Level 1 and 2) — annual
6. Moving and handling (Level 1 and 2) — annual for those doing manual handling
7. Preventing radicalisation — every 3 years
8. Safeguarding adults (Level 1, 2, 3) — 3-yearly; frontline clinical roles annual for higher levels
9. Safeguarding children (Level 1, 2, 3) — 3-yearly; frontline paediatric roles higher level more frequently
10. Information governance and data security — annual (the NHS Data Security and Protection Toolkit drives this)
11. Resuscitation (BLS, ILS, ALS, ALS Paediatric) — annual BLS, every 1-2 years for higher levels

Not in CSTF but often mandatory

Some training is mandatory under other statutory frameworks or employer policy:

• Mental Capacity Act and DoLS — annual or 3-yearly depending on role
• Dementia awareness — Tier 1 minimum for any direct-care role
• Complaints and Duty of Candour
• Medication management (for medication-administration roles)
• Oliver McGowan Mandatory Training on Learning Disability and Autism — phased rollout from 2024
• Sepsis awareness — frontline clinical
• Falls prevention — any inpatient or care home role

NHS Electronic Staff Record (ESR)

The NHS ESR is the workforce system used by 100% of NHS trusts in England. It records every mandatory training module, refresher dates, and completion. When a staff member moves between ESR-using employers, training records transfer automatically.

This is why moving between NHS trusts doesn't require starting all training over. Moving between NHS and a private provider usually does — private providers don't have ESR access.

The training matrix

A good training matrix shows, per staff member and per module: the training date, the refresher due date, the current status (current / within 30 days / overdue), the evidence type (certificate, attendance log, observed competence). Most employers colour-code:

• Green — current, more than 30 days to renewal
• Amber — within 30 days of renewal
• Red — expired

A matrix with more than 15% red on any mandatory module is not an administrative problem. It's a compliance failure.

The Care Certificate

For new HCAs and social care staff, the Care Certificate (15 standards) is the entry-level benchmark. Many employers map Care Certificate standards to CSTF modules so training doesn't duplicate:

• Care Certificate Standard 1 (Understand your role) → no direct CSTF equivalent
• Care Certificate Standard 10 (Safeguarding adults) → CSTF Safeguarding Adults Level 1
• Care Certificate Standard 12 (Basic life support) → CSTF Resuscitation BLS
• Care Certificate Standard 14 (Infection prevention) → CSTF IPC Level 1

Retention of training records

Training records form part of the employment record and generally follow NHS Records Management Code retention: 6 years after end of employment for most evidence. Safeguarding training records are often kept longer — up to 10 years after end of employment.

Oliver McGowan Mandatory Training

Introduced under the Health and Care Act 2022, this mandates training on learning disability and autism for all regulated professions. Rollout is phased; Tier 1 covers all staff, Tier 2 covers those providing direct care. Both tiers should now be in employer training matrices for 2026.

Data Security and Protection Toolkit (DSPT)

NHS and NHS-contracted providers must complete the DSPT annually. It includes evidence of information governance training completion rates — part of the CSTF IG module. A trust or provider with IG training under 95% completion usually cannot sign off its DSPT submission.

Common mistakes

1. Training matrix out of date — the first question any inspector asks
2. Overdue modules accepted as "in progress"
3. Safeguarding levels mismatched to role (Level 1 where Level 3 was required)
4. BLS refreshers missed because "it's the same content every year"
5. Private providers assuming NHS ESR records transfer — they don't
6. Bank and agency staff training not included in the main matrix

FAQs

Can e-learning replace face-to-face training?

For most CSTF modules, yes — provided the e-learning is quality-assured and the employer tracks completion. Some modules (BLS, manual handling Level 2) require practical assessment and cannot be fully online.

What happens during a CQC inspection when training is overdue?

It's flagged as evidence against the Safe and Well-led KLOEs. Persistent overdue training typically triggers a Requires Improvement rating on those questions.

Is mandatory training paid working time?

Generally yes under the Working Time Regulations — especially where attendance is mandated by the employer. Refusing to pay for mandatory training is an employment-law risk.

Do volunteers need mandatory training?

For any volunteer role with direct service-user contact, yes — at minimum safeguarding, IG, fire, infection prevention.

Related guides

• CQC inspection records
• DBS checks for UK healthcare workers
• NMC Revalidation for UK nurses

Sources and further reading

• Skills for Health: Core Skills Training Framework
• Skills for Care: Care Certificate
• Oliver McGowan Mandatory Training

Last reviewed 2026-04-22 by Jamie Dawson, Editor. Corrections: corrections@logbook.co.uk