Radiology Legislation

The employer, referrer, practitioner, and operator, each fulfilling distinct, statutory operational functions.

Clinical justification, formal authorisation, dose optimisation, diagnostic evaluation, quality assurance programmes, clinical audit, and mandatory training.

Staff entitlements, training matrices, referral documentation, authorisation logs, exposure parameters, clinical evaluations, and formal incident investigations.

Enforced under criminal law by national regulatory bodies. In England, regulatory compliance and enforcement are led by the Care Quality Commission.

The designated radiation employer and all occupationally exposed employees handling radioactive sources or radiation equipment.

Prior risk assessments, strict dose restriction, engineered safety controls, controlled or supervised areas, local rules, contingency planning, and comprehensive staff training.

Risk assessments, local safety rules, training logs, critical equipment testing, area monitoring surveys, individual dose assessments, and occupational health records.

Enforced primarily by the Health and Safety Executive (HSE) through formal prohibition/improvement notices and criminal prosecution.

The healthcare employer (Trust, Board, or private provider) and employees at all levels of the organisational hierarchy.

Ensuring, so far as is reasonably practicable, the health, safety, and welfare of all employees and non-employees affected by work activities, including safe plant and systems of work.

Health and safety policies, risk assessment documentation, safety committee minutes, accident/incident reporting logs (RIDDOR), and equipment maintenance records.

Enforced by the Health and Safety Executive (HSE) or local authorities, possessing powers to issue improvement/prohibition notices and prosecute corporate bodies or individuals.

The formal permit holder, typically represented by the NHS trust executive or corporate healthcare provider organisation.

Absolute compliance with environmental permit conditions governing radioactive source acquisition, secure accumulation, authorised disposal, and continuous environmental monitoring.

Active source inventories, waste disposal logs, environmental monitoring results, compliance verification audits, and mandatory regulatory returns.

Regulated and enforced by the Environment Agency in England and Natural Resources Wales within Wales.

The registered care provider, nominated individuals, and directors legally accountable for service quality and safety compliance.

Maintaining safe care and treatment (Regulation 12), robust governance systems (Regulation 17), proper staff vetting, cleanliness, and managing clinical safety incidents.

Audits, governance meeting minutes, incident investigation reports, duty of candour logs, staff competency records, and risk management portfolios.

Enforced by the Care Quality Commission (CQC) through compliance warnings, restriction of services, financial penalties, or cancellation of provider registration.

The healthcare data controller dictates processing purposes and means. External software or IT vendors act strictly as processors or independent controllers.

Adherence to principles of lawfulness, fairness, transparency, data minimisation, storage limitation, accuracy, security, and strict controls on cross-border disclosures.

Article 30 records of processing activities, transparent privacy notices, retention schedules, vendor data processing agreements, breach registers, and DPIAs.

The Information Commissioner's Office (ICO) possesses powers to investigate, serve enforcement notices, and issue severe administrative financial penalties.