Whether the HSE was justified in refusing to grant access to additional records in full or in part relating to the funding of a disability service provider for the care of a service user on the basis of sections 15(1)(a), 29 and 35 of the FOI Act

28/09/2018

Background

On 29 September 2017, the applicant sought access to all correspondence and contacts between the HSE and Deloitte and Touche (Deloitte) from 1 March 2017 to September 2017 concerning the funding of a particular disability service provide for the care of a specific service user. He also sought access to all internal HSE communications relating to the same matters. 

The HSE's decision was due on 27 October 2017. On 26 October it sought what it described as an extension of one week, although it said that the decision would issue on 9 November, nearly two weeks after the deadline. In any event, it issued its internal review decision on 9 November 2017, in which it refused to grant the applicant's request on the basis of sections 31(2)(a) and 31(1)(c)(ii)(1) and (11) of the FOI Act. 

On 23 November 2017, the applicant sought an internal review of the HSE's decision. The HSE again sought an extension of time to consider the applicant's request, and said that a decision would issue on or before 3 January 2018. On 26 January 2018, approximately 9 weeks after the applicant's request, the HSE issued its internal review decision. This varied its original decision and granted access to records relating to the first part of his request (correspondence between the HSE and Deloitte). These records comprised 391 pages and had previously been provided to the Public Accounts Committee (the PAC). The HSE had consulted with the PAC before releasing these records to the applicant.

In relation to the second part of the applicant's request (internal HSE communications relating to the funding), the HSE identified 24 relevant records. Of these, it released 21 records in full and withheld three in part (Record 4, and the attachments to Records 6 and 24). It relied on sections 29(1)(a) - deliberations of FOI bodies and 36 - commercially sensitive information, in respect of the records withheld. The HSE also redacted the name of the service provider throughout the records on the basis of section 31(1)(a) (legal professional privilege) and other information in the records such as the mobile phone numbers of staff members was withheld on the basis of section 37 (personal information).

Having reviewed the records released, the applicant raised some queries with the HSE concerning additional records. On foot of this the HSE located and released further records to him. 

The applicant applied to this Office on 14 March 2018 for a review of the HSE's decision. Among other things, he was of the view that the HSE might not have identified all relevant records falling within the scope of his request. 

During the course of this review, the applicant confirmed to this Office that he is not seeking access to the following items contained in the records: the name of the service provider (withheld throughout the records), the mobile telephone numbers/personal information of staff (removed from Record 13 and throughout the records) and the daily rates paid to Deloitte staff contained in Record 4. He confirmed that he still sought a copy of the draft report prepared by Deloitte (listed as an attachment to Records 6 and 24 and refused in full). He also stated that it remained unclear whether the HSE had identified all records relating to his request.

In submissions to this Office, the HSE indicated that it was also relying on section 35(1)(a) - information provided in confidence - in support of its decision to refuse access to the attachment to Records 6 and 24 (the draft version of Deloitte's report). It also provided details of searches undertaken to locate additional records in this case which have been provided to the applicant by this Office. 

Having completed my review, I have decided to bring this review to a close by way of a formal, binding decision. 

In conducting this review, I have had regard to the correspondence between the HSE and the applicant as set out above. I have also had regard to the communications between this Office and both the applicant and the HSE, as well as the contents of the records concerned. I have also had regard to submissions from Deloitte, made to this Office during the course of this review.

Scope of Review

Having regard to the above, this review is solely concerned with whether the HSE was justified in its decision to refuse to grant access to additional records on the basis that no further relevant records exist or could be located once all reasonable steps had been taken to ascertain their whereabouts (section 15(1)(a) refers) and whether it was justified in refusing access to the draft report on the basis of sections 29(1)(a) and 35(1)(a) of the FOI Act.

Preliminary Matters

Although I am obliged to give reasons for my decision, section 25(3) of the FOI Act requires me to take all reasonable precautions in the course of a review to prevent disclosure of information contained in an exempt record. This means that the extent to which I can describe the contents of the records is limited.

It is also important to note that when a record is released under the FOI Act, it effectively amounts to disclosure to the world at large, as the Act places no restrictions on the type or extent of the subsequent use to which a record may be put.

Section 22(12)(b) of the FOI Act provides that a decision to refuse to grant access to a record shall be presumed not to have been justified unless the head concerned shows to the satisfaction of the Commissioner that the decision was justified. It should also be noted that a review by this Office under section 22 of the FOI Act is de novo in that it is based on the circumstances and the law as they apply on the date of the decision.

Issues concerning the delay in the HSE's decisions

Effective Veto
The applicant was of the view that the HSE had effectively given a veto to the Public Accounts Committee (the PAC) in this case. The HSE's initial decision on his request referred to the PAC having formally requested a copy of all correspondence between the HSE and Deloitte relating to the final draft of Deloitte's report. The applicant's internal review request on 23 November 2017 noted that  the PAC had not sought both categories of records he requested. He also stated that the records did not comprise "opinions, advice, recommendations, or the results of consultations" as required by section 31(1)(c)(ii) (which the HSE had relied on in refusing access to the records sought). It appears that the HSE accepted the applicant's arguments, insofar as it did not rely on the same exemption in its internal review decision and, in fact, released the records requested by the PAC to the applicant. In submissions to this Office the HSE stated that the PAC was not given a veto on the release of the records, but that rather it was consulted to see if it had any objections to release. The HSE said that it had regard to section 34B of the Health Service Executive Act 2004, which provides that the HSE Director General is required to give evidence to the PAC. In essence, it said that the DG was due before the PAC at the time of its processing of the applicant's request and that it did not wish to release records which attracted an exemption under the Act. 

Consultations
It seems that the delay in issuing decisions in this case arose at least to some extent because the HSE was concerned that release of the records sought would effect the work of the PAC (which requested some of the records sought by the applicant, albeit in a late stage in the process) or a Commission of Investigation set up to investigate related matters. The HSE stated that it consulted internally with staff who had provided information to Deloitte in its preparation of the report, as well as the PAC and  the Commission in processing the applicant's internal review request. It also said that it obtained legal advice following consultations, which it said delayed the process of dealing with the applicant's request further. In any event, the HSE's cautious approach meant that it did not process the applicant's requests within the timelines provided for in the FOI Act. 

Section 14 - Extension of time to consider request
The applicant has questioned the timing of the HSE's decision to extend the time to deal with his request, which was made on the same day that the PAC requested a copy of the correspondence between Deloitte and the HSE. However, it is clear from the records provided to this Office for the purposes of this review that the HSE was not in a position to reply to his request by the four week deadline provided for in the Act (27 October 2017 by my calculations). An email from the DG's Office to the relevant HSE divisions asking them to check for additional records to those already located in the DG's Office issued on 26 October. In other words, regardless of the PAC's actions, the HSE had not yet collated all of the relevant records for consideration.

However, it is important to note that although section 14 provides for an extension of time to consider an FOI request, it solely applies to original decisions on FOI requests and not to internal review requests. Furthermore, the maximum extension of time allowed under section 14 is four weeks. The HSE's internal review decision issued some nine weeks after the applicant's request. This was six weeks after the deadline to issue a decision on his internal review request. The applicant would have been entitled to request a review by this Office once 3 weeks had passed from his internal review request, on the basis of a deemed refusal. In fact, I note that the applicant contacted this Office on 1 February 2018 to make an application for a review as he had not yet received the HSE's decision. His application was withdrawn when he received the HSE's internal review decision. He also would have been entitled to appeal the HSE's decision to extend the time to deal with his request to this Office under section 14 of the Act.

Communication with requester
The applicant also raised an issue relating to the HSE not keeping him informed following his internal review request. The HSE provided copies of correspondence with the applicant between his internal review request on 23 November 2017 and its internal review decision on 26 January 2018, in support of its position that it kept the applicant informed during this time. However, I note that it appears that he had to request updates from 4 January 2018, rather than the HSE being proactive in contacting him. 

For the absence of doubt, FOI bodies are required to comply with the deadlines in the FOI Act. They are also required to comply with the provisions of section 14 when making a decision to extend the time to deal with an FOI request. Accordingly, I would expect the HSE to take steps to ensure that it complies with these provisions in future. However, I should say that I accept that much of the delay arose from concerns within the HSE lest any decision on the FOI request have any impact on the external investigation processes relevant to the subject matter, including a statutory Commission of Investigation.

Analysis and Findings

Section 15(1)(a) - Additional Records
The HSE effectively refused to grant access to additional records on the basis of section 15(1)(a) of the FOI Act, insofar as its position was that all relevant records had been located and considered for released.

Section 15(1)(a) provides that access to records may be refused if the records concerned do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken. The role of the Commissioner in a "search case" is to decide whether the decision maker has had regard to all of the relevant evidence and, if so, whether the decision maker was justified in coming to the decision that the records do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken. The evidence in search cases consists of the steps actually taken to search for records, along with miscellaneous other evidence about the record management practices of the FOI body, on the basis of which the decision maker concluded that the steps taken to search for records were reasonable. This Office does not normally search for records.

Details of searches undertaken 
The HSE stated that it initially carried out a scoping exercise within the Office of the Director General (the DG), who had commissioned the Deloitte report. It provided details of hardcopy and electronic searches undertaken of the email accounts of the Director General's Personal Assistant, and his assistant, the electronic document management system and the office's physical files. Based on this, it said that it identified the following divisions of the HSE which might hold records relating to the request: Communications Division, Parliamentary Affairs Division, Community Healthcare Office 5 (CHO5), Social Care Division and Internal Audit. It said that it consulted with decision-makers in all five divisions and forwarded a schedule of the records located in the DG's office, grouped by division, so that each decision-maker could use that as a starting point to locate related records. It also said that searches were undertaken by searching relevant email accounts and hardcopies of records held in each office. The HSE stated that each division was instructed to forward any additional records located to the DG's Office for inclusion in the HSE's final response to the applicant. As noted above, further details of these searches have been supplied to the applicant.

Records located following the HSE's decisions 
Following the HSE's internal review decision, the applicant raised a query in relation to three categories of records which were referred to in the documents released but were not included. These were as follows: emails between the CHO5 Chief Officer and a local General Manager and Finance Manager; minutes of a meeting with Deloitte in August 2017; and a HSE internal audit report. The HSE located additional emails between the Chief Officer and the Finance Manager which were released to the applicant. In relation to the meeting with Deloitte, it confirmed that it had taken place on 10 August and released additional records relating to the scheduling of the meeting. The HSE stated that the meeting took place in order for HSE staff to provide feedback on the draft report, to allow them to clarify, amend or add content to that previously supplied and so that Deloitte could clarify the information already provided by CHO5. It said that the meeting concerned feedback already provided and that, as a result, no minutes were taken. There is nothing before me to suggest that this was not the case. The HSE also stated that the DG confirmed to the PAC at a meeting on 15 June 2017 that no internal audit had been carried out concerning the matters at hand. In any event, this review is not concerned with the question of whether or not records sought ought to exist. Rather, the question I must consider is whether the HSE has taken all reasonable steps to ascertain the whereabouts of relevant records.

There is no evidence before me to suggest that additional relevant records exist which have not been released. The HSE stated that when the applicant made queries about the additional records set out above, it contacted each of the relevant Divisions and asked them to carry out a cross-checking exercise to ensure that all relevant records had been identified. It stated that none of the sections, except CHO5, located any further records following the re-check of their files. Its position is that all relevant records have now been located and considered for release. I accept that the HSE located additional records on foot of queries raised by the applicant after its decision issued. However, having reviewed the search details provided by the HSE, I am satisfied that, at this point, it has taken all reasonable steps to locate relevant records. I find, therefore, that HSE's effective decision to refuse to release additional records under section 15(1)(a) of the FOI Act was justified on the basis that no further records exist or could be found once all reasonable steps were taken to ascertain their whereabouts.

The Draft Report
The remaining record to be reviewed in this case is the draft report prepared by Deloitte and circulated to the service provider and a number of HSE staff for feedback, before being finalised. The final version of the report was released to the applicant by the HSE and has been published on the Oireachtas website. Furthermore, an excerpt from the draft report as provided to the PAC by Deloitte has also been published by the Oireachtas.

Section 29(1)
Section 29(1) provides for the discretionary refusal of a request if the record concerned contains matter relating to the deliberative processes of an FOI body. The HSE relied on this exemption in relation to its refusal to grant access to the draft report.

The public interest test in section 29(1)(b) differs from the public interest test found in other exemptions under the FOI Act. Other exemptions require the public body to be of the opinion that the public interest would be better served by release. To avail of section 29, the public body must be of the opinion that releasing the records would be against the public interest. Generally speaking, this requires a body to identify a specific harm to the public interest flowing from release. These are two independent requirements and the fact that the first is met carries no presumption that the second is also met. It is therefore important for FOI bodies to show to the satisfaction of the Commissioner that both requirements have been met. 

While there is nothing in the exemption itself which requires the deliberative process to be ongoing, the question of whether the process is ongoing or at an end may be relevant. Furthermore, section 29 specifically requires consideration of whether the requester would, by the release of the record(s), become aware of a significant decision that the an FOI body proposes to make. 

Deliberative Process
An FOI body relying on this exemption should identify both the deliberative processes concerned and any matter in particular records which relates to these processes. A deliberative process may be described as a thinking process which informs decision making in FOI bodies. It involves the gathering of information from a variety of sources and weighing or considering carefully all of the information and facts obtained with a view to making a decision or reflecting upon the reasons for or against a particular choice. Thus, it involves the consideration of various matters with a view to making a decision on a particular matter. It would, for example, include some weighing up or evaluation of competing options or the consideration of proposals or courses of action. 

I note that Mr Tony O'Brien, the former Director General of the HSE, informed the PAC on 23 March 2017 that the HSE's figures relating to the levels of the relevant funding provided had been disputed by the service provider. He said that as part of the HSE's engagement with that organisation, he gave a commitment to it that he would undertake an independent external review of funding. Deloitte was commissioned to carry out its review as a result of that commitment. (Source: https://www.oireachtas.ie/en/debates/debate/committee_of_public_accounts/2017-03-23/5/?highlight%5B0%5D=hse&highlight%5B1%5D=deloitte) 

The HSE stated that the draft report was a "working document prepared for review and deliberation". It also stated that the report formed part of the deliberative process. It appears to be arguing that the deliberative process concerned was that of Deloitte providing a draft to both parties and getting their comments and feedback for consideration. The HSE also stated that Deloitte made a decision on what would or would not be included in the final report. 
It seems to me that the body carrying out the deliberative process in this case was Deloitte, not the HSE. Furthermore, the context and circumstances of the commissioning of the report indicate that the report was intended to be used to reassure the service provider and/or to form part of a report back to the PAC. It is not completely clear to me how this would have involved the HSE being involved in a deliberative process. The HSE may have meant that staff deliberated when considering the contents of the draft report. 

Having considered the content and context of the record concerned, and the submissions made by the HSE, I do not accept that the draft report comprises opinions, advice and recommendations considered by the HSE or by the staff of the HSE for the purpose of a deliberative process. Accordingly, having regard to the provisions of section 22(12)(b), I find that the Department has not satisfied this Office that its decision to refuse access to the record sought was justified on the basis of section 29(1) of the FOI Act. 

Public Interest
I should state that even if I had accepted that the record contained material for the purpose of a deliberative process, the HSE would have also had to satisfy me that release of the record concerned would be contrary to the public interest. The public interest test contained in section 29(1)(b) requires the FOI body to be of the opinion that releasing the records at issue would be contrary to, or against, the public interest. Generally speaking, this requires a body to identify a specific harm to the public interest flowing from release. A mere assertion without supporting evidence is not sufficient to satisfy the requirement that access to the record could reasonably be expected to result in the outcome envisaged. 

Simply because a deliberative process exists and is ongoing does not mean that the exemption automatically applies without consideration of all the provisions of section 29. Equally, if a deliberative process is at an end this does not mean that the exemption automatically does not apply. 

In submissions to this Office, the HSE stated that release of the record would be contrary to the public interest as the applicant might seek to rely on "incomplete and inaccurate information" in the draft report, which was "subject to change and may mislead the public". Deloitte had made similar arguments in its refusal to provide the draft report to the PAC and in submissions to this Office stated that the final report was the version which had "been through a robust internal quality assurance review". Essentially, the HSE and Deloitte were of the view that it would be contrary to the public interest to release a record containing information which had not been included in the final report on the matter, and/or contained confusing or duplicate information.

Deloitte also commented that the outcome of the report had not changed, even though some of the content had. However, I take the view of a former Commissioner, who found in Case No. 98114 et al., (Eircom Plc and The Department of Agriculture and Food, available at www.oic.ie) that the possibility of information being misunderstood is not a good reason to refuse access to records under FOI. Furthermore, it is open to the applicant and other readers to compare the draft report with the final published report and would be open to the HSE to put further information in the public domain, if that were necessary, to clarify matters.

There is a strong public interest in ensuring openness and accountability, as recognised by the FOI Act itself, in respect of the HSE, its funding of the service provider and how the matters at hand have been dealt with. I note that the issues surrounding the report have been discussed at length by the PAC and form part of the terms of reference of the Commission of Investigation(https://health.gov.ie/wp-content/uploads/2017/03/DRAFT-Commission-of-Investigation-Terms-of-Reference-1.pdf at IX(b), page 5). The PAC has also discussed the draft report and Deloitte itself wrote to the PAC referring to and setting out part of the report which had been in contention. Much of the information in the final report, which has been released, is also in the draft version. In fact, other than some minor changes in figures, the main difference between the draft and final versions of the report is the absence of a table of figures (Table 3.3) in the final report. I note that this table is contained in the letter from Deloitte to the PAC dated 22 November 2017 which is available publicly.
Having considered the matter carefully, I am of the view that release of the record concerned would further the public interest in openness and transparency, and also enable public debate about the matters at issue. Furthermore, in my view the HSE has not adequately demonstrated that the release of the draft report at this time would be contrary to the public interest. 

Section 35
Section 35(1)(a) is a mandatory exemption which provides that a request for a record shall be refused if the information in the record concerned was given to an FOI body, in confidence; on the understanding that it would be treated as confidential; its disclosure would be likely to prejudice the giving to the body of further similar information; and it is of importance to the body that such further similar information should continue to be given to the body.

However, section 35(1) does not generally apply where a record is prepared by a member of staff of an FOI body or a service provider, unless disclosure would constitute a breach of a duty of confidence which is owed to a person other than an FOI body, a member of staff of an FOI body or service provider. 

The HSE stated that the draft report had been presented to to it by Deloitte on a strictly private and confidential basis. It noted that the front page of the draft carried an an explicit instruction that it was "subject to amendment and should not be relied upon", as well as that it may not "be shown, quoted or referred to any party" without Deloitte's explicit consent. 

In submissions to this Office, Deloitte argued that the draft report is its own intellectual property and, as such, is owned by Deloitte, not the HSE. It also stated that the draft formed part of its working papers and was not "a deliverable of the contracted services". It contended that the draft had been provided to the HSE (and to the service provider) solely for the purpose of allowing the HSE to comment on its contents. In essence, it sought to differentiate the draft version from the final report, which it argued it was solely contracted to provide. However, neither the HSE nor Deloitte have argued that the draft report was not prepared by Deloitte in the course of the performance of its functions as a service provider to the HSE. In any event, I cannot see how the preparation and forwarding of the draft report could be otherwise than in accordance with the provisions of the contracted service.

In submissions made to this Office, Deloitte also argued that there was a duty of confidentiality owed by Deloitte, the HSE and the service provider to the individual whose cost of care was the subject of the report. It referred to an oral agreement between Deloitte and the service provider not to name or reference the service provider in the draft report in support of this. It also said that it understood that there may be certain legal restrictions in place preventing anyone from naming the service provider. As mentioned above, the applicant has clearly stated that he is not seeking such identifying information and, accordingly, any references in the draft report to the organisation concerned or information which would identify the individual concerned are outside the scope of this review and the applicant's request. Furthermore, as noted earlier, much of this information is already in the public domain. I also note that the final version of the report, which is publicly available, contains a caveat that that version of the report was confidential and should not be used, reproduced or circulated for any purpose without Deloitte's prior written consent. However, no case has been made to this Office that the release of final report should be regarded as a breach of any duty of confidence owed to Deloitte.

I would consider that any version of a report which resulted from a company being engaged to undertake a review for a public body forms part of the work resulting from the service/contract. As I understand it the draft was created on foot of Deloitte's preliminary examination of the issues at hand, and then it was circulated to the parties concerned for comments. I do not see, nor has it been argued, how a duty of confidence would be owed to a service provider in the circumstances of this case. I am also satisfied that release of the record at issue subject to the redaction of any identifying information would not breach any duty of confidence owed to the individual concerned.  I find, therefore, that the HSE has not justified its reliance on section 35(1)(a) to refuse to grant access to the draft report. 

Other Exemptions
Deloitte has argued that release of the draft report would reveal financial information provided by the service provider which could be commercially sensitive. It also said that the subject matter of the report was the cost of care of one specific individual and the nature of that care, all of which could be said to be the personal information of that individual. While I have carefully considered these arguments, I note that in the particular circumstances of this case, a lot of these details are already in the public domain. For instance, the final version of Deloitte's report, which contains more information, was released to the applicant under FOI by the HSE on 26 January 2018. It has also been made publicly available online. In any case, as noted above, the applicant has not sought details of the individual service user concerned (who is not identifiable in the records) or the name of the service provider. Furthermore, there is no evidence before me of any harm arising from the exemptions cited by Deloitte which has arisen from the release or publication of the final version of the report. In any event, even if I had found section 36 or 37 to apply, I would have to weigh the public interest arguments in favour of releasing the records against those in favour of refusing the request.

Deloitte also argued that section 32(a)(iv) applies to the draft report. This is a discretionary exemption which provides that an FOI body can refuse to release records which could reasonably be expected to prejudice or impair the fairness of proceedings in a court or other tribunal. While the HSE initially relied on this exemption to refuse access to the records sought, it did not do so at internal review stage or in submissions to this Office. Deloitte was concerned that release of the draft report could prejudice the ongoing work of the Commission of Investigation into matters relating to the records in this case. It stated that there was a possibility that the record could be used to influence the Commission on the basis of inferences drawn from what was an unfinished draft report.

There is no evidence before me that the Commission has objected to the release of any of the records in this case. In fact, the HSE provided a copy of a letter from the Commission in response to the HSE's notification that records relating to theses matters have been the subject of an FOI request. The Commission stated that it was not appropriate for it to comment on the HSE's proposed decision. It seems to me that if the Commission had been concerned that its work would be impaired, it would have said so. In any event, I am satisfied that the Commission is capable of drawing its own conclusions from the information concerned.

Having regard to the above, I find that the HSE's refusal to grant access to the draft report is not justified and I direct the HSE to grant access to the record subject to the removal of any reference to the service provider or information which would identify the individual concerned.  

Decision 

Having carried out a review under section 22(2) of the Freedom of Information Act 2014, I hereby vary the decision of the HSE. I annul its decision to refuse access to the draft report on the basis of sections 29 and 35 of the Act and direct its release subject to the redactions set out above. I affirm its decision to refuse to grant access to additional records on the basis of section 15(1)(a).

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.

Elizabeth Dolan
Senior Investigator