A new statutory duty of candour making health bosses legally accountable for responding to concerns about patient safety could also be introduced.