There is a misunderstanding in many organisations that if a service is outsourced to a suitably qualified contractor, responsibility for what happens has been outsourced with it.
This is not necessarily the case.
A contract can allocate work, set standards, require insurance and provide rights of indemnity.
What it cannot necessarily do is extinguish a duty that the law regards as personal to the organisation that accepted responsibility for the safety or care of another person.
That distinction matters wherever organisations commission security, care, education, healthcare or physical-intervention services.
It matters when agency staff are brought into a care setting, when a school uses an external restraint-training provider, when a venue contracts door supervision to a security company and when a healthcare provider delivers treatment through self-employed practitioners.
The controversial and uncomfortable point is this:
Outsourcing may change who performs the work, but it does not always change who answers for it.
Hughes v Rattan: The Practice Owner Who Did Not Provide the Treatment
The modern importance of this principle can be seen in Hughes v Rattan [2022] EWCA Civ 107.
Mrs Hughes was a patient of a dental practice owned by Dr Rajendra Rattan.
Her treatment was performed by self-employed associate dentists rather than by Dr Rattan personally.
Mrs Hughes alleged that the treatment they provided was negligent.
Dr Rattan argued that he should not be liable for the clinical negligence of independent practitioners.
From a conventional perspective, this might initially appear persuasive.
The associates were not his employees and exercised their own professional judgment when treating patients.
The Court of Appeal nevertheless held that Dr Rattan would be legally responsible for any negligent acts or omissions of the associate dentists in treating Mrs Hughes because he owed her a non-delegable duty of care.
Several facts were important:
- Mrs Hughes had been accepted as a patient of their practice.
- Appointments and payments were administered centrally.
- Treatment plans were issued through the practice.
- From the patient’s perspective, she was receiving treatment from that practice and not entering the premises to find and privately engage a completely separate dental business.
Most importantly, Mrs Hughes had no meaningful control over how the dental practice chose to allocate the performance of its obligations.
The Court applied the five defining features identified by the Supreme Court in Woodland v Essex County Council [2013] UKSC 66.
These concern relationships in which:
- The claimant is particularly vulnerable or dependent on the defendant’s protection.
- An existing relationship places the claimant in the defendant’s custody, charge or care, from which a positive duty to protect them may be inferred.
- The claimant has no control over how the defendant chooses to perform that obligation.
- The defendant delegates an integral part of that positive duty to another person, who then exercises custody, charge or care on its behalf.
- The person to whom the function is delegated performs it negligently.
The result in Hughes was not based merely on poor contractor selection or some separate management failure by Dr Rattan.
The duty concerned the proper performance of the treatment itself.
It was a duty which, in law, remained with Dr Rattan even when other dentists carried out the work.
Non-delegable duty is not another name for vicarious liability
One of the most important aspects of Hughes is that the Court distinguished a non-delegable duty from vicarious liability.
Vicarious liability ordinarily makes one party liable for the wrongdoing of another because of the relationship between them; classically, the relationship between an employer and employee.
A non-delegable duty is different.
The defendant is liable because the law treats the relevant duty as the defendant’s own.
This distinction produced an important result.
Dr Rattan owed Mrs Hughes a non-delegable duty, but he was not vicariously liable for the associate dentists.
They were carrying on businesses of their own and were not in a relationship sufficiently akin to employment.
In other words, Dr Rattan was not vicariously liable merely because the associates worked at his practice.
He was potentially liable because the practice had undertaken to provide Mrs Hughes with dental treatment and could not avoid responsibility for its careful performance by allocating the work to self-employed associates.
This challenges the assumption that calling someone “self-employed”, “agency staff” or an “independent contractor” ends the legal analysis.
Labels matter far less than the substance of the relationship and the nature of the responsibility that has been assumed.
What does this mean for conflict management, restraint and physical-intervention training?
The potential implications for training are serious.
Schools, care providers, hospitals, local authorities, security businesses and venues frequently contract with external organisations to provide training or operational personnel.
Too often, procurement becomes a substitute for professional judgment:
- The provider has a certificate.
- The trainer has insurance.
- The agency supplied licensed staff.
- The course appears on an approved list.
- The contract says that the contractor accepts responsibility.
None of these facts, taken alone, establishes that the commissioning organisation has discharged every duty it owes.
Hughes does not decide that a school, care provider, hospital or security business automatically owes the same duty whenever it commissions physical-intervention training.
However, it demonstrates how a court may look beyond contractual labels and examine the responsibility the organisation assumed, the vulnerability of the person exposed to risk and that person’s lack of control over the arrangements.
Non-delegable duties remain exceptional and fact sensitive.
A court must examine the relationship, the vulnerability and dependence of the person exposed to risk(s), the degree of control they possessed, the function that was delegated and whether it formed an integral part of a positive duty already assumed by the defendant.
Nevertheless, the parallels can be powerful:
- A child does not choose the restraint system adopted by their school.
- A care-home resident usually has no control over which agency worker responds to their distress.
- A patient cannot realistically investigate the origins of every physical technique taught to hospital staff.
- A member of the public being restrained by contracted security officers has no say in the commissioning arrangements behind those officers.
Where an organisation has accepted responsibility for a person who is vulnerable, dependent or placed within their care or control, saying “the contractor did it” may provide an explanation.
But it is not necessarily a defence.
Accreditation is evidence but not absolution
Here is where the issue becomes controversial.
Commissioners are often encouraged to treat accreditation as if it transfers responsibility to an accrediting body or training provider.
It does not.
Accreditation may provide valuable evidence of quality assurance, competence and compliance with specified standards.
In some sectors and for certain roles, certified training is expressly required.
But accreditation does not, by itself, demonstrate that a training programme is suitable and sufficient for every organisation, workforce, environment or service-user population.
A technically approved method may still be inappropriate for a particular setting.
A generic course may fail to address staffing levels, known behavioural risks, medical vulnerabilities, the physical environment or the availability of immediate clinical assistance.
Competence demonstrated in a training room may deteriorate without proper supervision, refresher training, incident review and regular practice.
An organisation that purchases a recognised badge without examining the actual system of work is not exercising due diligence.
It is buying reassurance.
The law is unlikely to be impressed by a logo if the risk assessment was inadequate, the training did not match operational reality, or repeated warning signs were ignored.
The duty extends beyond choosing a reputable supplier
A responsible commissioner should be able to demonstrate why the selected service was suitable and not merely why the supplier appeared respectable.
That requires questions such as:
- What foreseeable situations may require physical intervention?
- Who may be subjected to it, and what individual vulnerabilities are known?
- Are the methods being taught lawful, necessary and appropriate to the setting?
- Do staffing levels allow those methods to be used as trained?
- Could a technique compromise breathing, circulation, communication or the identification of medical distress?
- Are prevention and de-escalation treated as core competencies rather than a short preamble before physical skills?
- How are incidents recorded, reviewed and converted into organisational learning?
- Does refresher training respond to actual incidents and identified deterioration in competence?
- Who has authority to suspend a technique or provider when evidence of risk emerges?
This approach is consistent with wider regulatory expectations.
The Care Quality Commission’s position on restrictive practices emphasises person-centred planning, incident analysis, senior-level oversight and the active reduction of restrictive practices.
The Security Industry Authority’s guidance on reducing risk during physical intervention similarly stresses last resort, minimum force, dynamic risk assessment and the avoidance of methods that threaten breathing, circulation, the neck or the spine.
These are consistent with the Health and Safety Executive’s position that putting a service out to tender is not a mechanism for transferring all health-and-safety risks and responsibilities to a contractor.
Those statutory responsibilities are legally distinct from the common-law doctrine considered in Hughes, but both undermine the assumption that outsourcing automatically removes accountability.
Accountability should follow control and assumed responsibility
Some will argue that this places an unfair burden on commissioning organisations.
If an independent specialist is engaged precisely because they have greater expertise, why should the purchaser answer for the specialist’s negligence?
The person exposed to the risk rarely designed that commercial arrangement.
The organisation selected the provider, shaped the service, controlled the environment and decided how the work would be integrated into its operations.
The vulnerable child, patient, resident or member of the public did none of those things.
It would be legally and ethically troubling if greater outsourcing resulted in less protection for those exposed to risk.
An organisation should not be able to enjoy the operational and financial benefits of a service while placing its human consequences beyond its responsibility.
Equally, non-delegable duty should not be carelessly presented as universal strict liability.
Hughes does not establish that every customer of an independent contractor guarantees everything that contractor does.
The doctrine depends on the precise duty assumed and the Woodland features.
Direct negligence, statutory health-and-safety duties, contractual liability and vicarious liability must also be analysed separately.
Professional debate is weakened when these distinct legal principles are collapsed into the slogan that “a duty of care can never be delegated”.
The performance of many tasks can clearly be delegated.
The real question is whether responsibility for the careful performance of a particular function remains with the defendant.
The question every organisation should answer
An NFPS earlier article on non-delegable duty of care [2103] warned that commissioning organisations cannot assume that contracts will insulate them from responsibility.
Hughes v Rattan gives that warning renewed force.
The challenge for leaders is not simply:
“Did we appoint a qualified contractor?”
It is:
“Can we demonstrate that the service we commissioned was suitable, safe, properly implemented, effectively monitored and regularly reviewed for the people whose safety and welfare were entrusted to us?”
If the answer depends entirely on the contractor’s certificate, the organisation may have delegated the work but not discharged its duty.
When something goes seriously wrong, a carefully drafted contract cannot prevent a claimant, regulator or court from examining the reality behind it.
Learn more about NFPS BTEC Trainer Award courses.
This article provides general information and does not constitute legal advice.
Organisations should obtain professional advice concerning their contractual, regulatory and operational arrangements.