University welfare outsourced to external provider

Short answer

Outsourcing counselling or welfare support to an outside company does not, on its own, transfer legal responsibility away from the university. The university remains the body with the primary relationship to the student, and it generally cannot contract out of its own duties by hiring a third party to deliver the service. Depending on what went wrong, legal responsibility may rest with the university, with the external provider, or with both, and each may be liable on a different legal basis.

The university’s own responsibility

A university in England and Wales has a recognised general duty of care to deliver its educational and pastoral services to the standard of an ordinarily competent institution, and to act reasonably to protect the health, safety and welfare of its students. This flows from the law of negligence, which is accepted to apply to the provider–student relationship even though the precise scope of the duty has not been extensively tested in the courts.

Where a university chooses to provide counselling or welfare support and then arranges for a contractor to deliver it, the university continues to owe its own duties in several ways:

The contract between the student and the university. Most universities promise, in their student contract, prospectus or published policies, that certain wellbeing or counselling services will be available. If they have made such promises, they can be contractually responsible for the service being provided competently, regardless of who actually delivers it. Consumer protection law (the Consumer Rights Act 2015) also requires services within its scope to be performed with reasonable care and skill.

Selecting and overseeing the contractor. Even where the day-to-day delivery is outsourced, the university can be directly liable in negligence for failing to select a reasonably competent provider, failing to put in place adequate arrangements, systems and safeguarding, or failing to monitor and supervise the service properly. This is the university’s own breach, not the contractor’s.

Non-delegable duties. In some situations the law treats a duty as non-delegable, meaning the university stays legally responsible for the careless performance of an independent contractor as if it were the university’s own. This typically arises where a vulnerable person has been entrusted to the institution’s care and the institution has assumed responsibility for protecting them from harm. Whether such a duty exists for university counselling is fact-sensitive and not firmly settled, but the possibility is real, particularly where a student is vulnerable and the university has taken positive charge of their welfare.

Assumption of responsibility. The point at which a duty crystallises often turns on whether the university (or provider) has assumed responsibility to keep the student safe. In the Abrahart litigation the court’s analysis turned on whether the institution had offered to keep the student safe; a duty grounded purely in assumption of responsibility was not established on the particular facts there, although the university was found liable under disability discrimination law. This illustrates that the existence of a duty depends closely on what the institution actually undertook to do.

Statutory and regulatory obligations. The Equality Act 2010 duties, including the duty to make reasonable adjustments for disabled students, sit on the university and cannot be outsourced away. Health and safety duties under the Health and Safety at Work etc. Act 1974 also fall on the institution.

The external company’s responsibility

The outside company is not immune simply because it is a contractor rather than the university. A person or organisation that undertakes work owes a duty to take reasonable care to those who can foreseeably be injured if the work is done carelessly, and this does not depend on any contract between them and the injured person. So the provider can owe the student a direct duty of care in negligence for the way it actually delivers counselling or welfare support.

In addition:

Professional standards. Individual counsellors or therapists are expected to work to recognised professional and ethical standards (for example those of the BACP or UKCP where applicable). Negligent or substandard practice by the provider’s staff can found a claim against the provider, which is generally vicariously liable for its own employees.

The contract between the university and the provider. This governs the allocation of risk between the two organisations, including indemnities, insurance requirements and service standards. It does not bind the student, but it determines who ultimately bears the cost as between the university and the company.

Data protection and confidentiality

Counselling and welfare records are highly sensitive personal data. Under the UK GDPR and the Data Protection Act 2018, the university is likely to be the data controller, with the outside company acting as a data processor under a written data processing agreement, though the company may be a controller in its own right depending on the arrangement. The controller carries the primary accountability for lawful processing and security. Complaints about mishandling of confidential counselling information can be made to the Information Commissioner’s Office, and a breach may give rise to a claim.

How the answer changes with the facts

Who is responsible, and under what heading, depends heavily on what actually went wrong and what the university had promised. Key factual questions include:

1. What exactly failed. Poor clinical advice by a counsellor points primarily at the provider (with possible non-delegable liability on the university). A failure to make a service available, to refer, to communicate risk information internally, or to make reasonable adjustments points at the university.

2. What the university held out. If the university’s own materials described the service as its service, or promised availability and standards, its contractual and assumed responsibilities are stronger.

3. The contractual structure. Whether the company is a subcontractor delivering a service the university is responsible for, or an independent service the student engages directly, affects both routes to liability and enforceability. In subcontracting arrangements more generally, the lead body typically retains responsibility for meeting its obligations even where delivery is subcontracted.

4. The student’s vulnerability and what was known. Known risk, disability, or a request for adjustments strengthens both the negligence and Equality Act analysis.

5. Whether harm was caused. Negligence and breach of contract claims for anything beyond nominal loss require proof that the breach caused compensable harm, which in psychiatric injury cases can be legally and evidentially demanding.

Practical steps

1. Gather the documents. Collect the university’s counselling and wellbeing policies, the student contract and prospectus wording, any leaflets or webpages describing the service, and any emails or records of what you were told and what happened.

2. Identify precisely what went wrong and when. Note dates, names, what was said or not done, and any harm that followed. This determines whether the complaint is really about the university’s arrangements or the provider’s delivery, or both.

3. Use the university’s internal complaints procedure first. Complain to the university even though the service was outsourced, because the university remains the body accountable to you and is expected to investigate and respond. Ask specifically how responsibility is allocated between the university and its contractor.

4. Consider the Office of the Independent Adjudicator for Higher Education. Once you have a Completion of Procedures letter from the university, most students can bring a complaint to the OIA, which reviews whether the provider acted reasonably and in line with its own policies. This is free and far less risky than litigation.

5. Data protection route. If the concern is confidentiality or records, raise it with the university’s data protection officer and, if unresolved, the Information Commissioner’s Office.

6. Equality Act concerns. If the issue involves disability and reasonable adjustments, that is a strong and distinct route, and there are specific time limits for any county court claim under the Equality Act, so act promptly.

7. Only then consider court action. A negligence or breach of contract claim against the university, the provider, or both is possible, but think about cost, delay, the difficulty of proving causation of harm, and enforceability before going down that path.

Key point to take away

Outsourcing changes who performs the work, not who is answerable to the student. Treat the university as your first point of responsibility, because it usually retains its own contractual, negligence, equality and data protection duties, while keeping in mind that the outside company can also be directly liable for the way it actually delivered the support. The right target and legal route depend on exactly what failed and what the university had promised, so those are the facts worth pinning down first.