Whether the HSE was justified in refusing access, under section 37 of the FOI Act, to additional information sought by the applicant concerning details about patients diagnosed with influenza who had been in contact with the applicant's late client while she was a patient at Cork University Hospital

05 July 2022

Background

The applicant in this case is a firm of solicitors acting on behalf of the family of a person who died whilst a patient in Cork University Hospital (CUH). In a multi-part request dated 12 March 2021, the applicant sought access to various records concerning any incidents/outbreaks of influenza A during January and February 2019, including procedural documents relating to such outbreaks, details of patients and staff members diagnosed with influenza A, to include their location within CUH, related actions taken by management, and records relating to the cleanliness of the areas where the family member was located.

On 14 April 2021, the HSE part-granted the applicant's request. It granted access to a number of records relating to its infection control policy and procedures, its cleaning procedures, its flu vaccine programme for staff and emails from CUH infection control to senior management about influenza outbreaks in CUH during the relevant period. It refused the applicant's request for certain records under section 15(1)(a) of the FOI Act on the ground that no such records exist. In its decision, the HSE explained that CUH does not record incident/outbreak for Influenza A with regard to patient to patient or staff members to patient. It also said CUH has no risk assessments or investigation records for the period in question, and that it does not keep records of cleanliness in the wards unless they are under audit. Among other things, it provided the applicant with documentation relating to patients diagnosed with Influenza A (H1N1), including their location, their admission date and the date they were detected with influenza. This information was extracted from a database maintained by the CUH Department of Infection Prevention and Control and contained in the emails referred to above from CUH infection control to senior management about influenza outbreaks.

On 12 May 2021, the applicant sought an internal review of the HSE's decision. Among other things, it challenged the accuracy of some of the information provided and identified a range of records that it had not received. In its internal review decision dated 11 August 2021, the HSE released further records and affirmed its refusal of certain other records under section 15(1)(a). On the matter of providing information about the location of other patients diagnosed with influenza, the HSE said it could not provide the additional data requested, as it was not possible to access the records of other patients without their consent.

On 10 December 2021, the applicant sought a review by this Office of the HSE's decision. In its application to this Office, the applicant said it is not looking to identify any patient or staff member but rather the fact of infection and the location within CUH of the staff member and/or patient with the infection for the months of January 2019 and February 2019. The applicant provided this Office with date and location details of four unnamed patients who had Influenza during the relevant period and said it was confining its request to information about these patients, from one of whom the applicant's representative claims it is possible the family member contracted Influenza A. It also said it wanted hygiene audit results for the hospital's Emergency Department for the months of January and February 2019.

During the course of this review, the HSE informed this Office that the audit reports sought do not exist as no audit was carried out in the Emergency Department for the months of January and February 2019. It said that searches were carried out of the CUH Environmental Database for 2019. In the absence of an environmental audit record for the Emergency Department, the HSE agreed to provide the applicant with the record of Terminal Cleaning undertaken in the Emergency Department for the time period specified.

I have now completed my review in accordance with section 22(2) of the FOI Act.  In carrying out my review, I have had regard to the correspondence referred to above and the correspondence between this Office and both parties. I have decided to conclude this review by way of a formal, binding decision.

Scope of Review

This review is concerned solely with whether the HSE was justified, under section 37 of the FOI Act, in refusing access to further information about the four patients identified by the applicant in its correspondence with this Office.

Analysis and Findings

Whether a record exists that contains the information sought

While the FOI Act provides for a right of access to records held by FOI bodies (section 11 refers), requests for information, as opposed to requests for records, are not valid requests under the Act. The Act does not require FOI bodies to create records if none exist, apart from a specific requirement to extract records or existing information held on electronic devices in certain circumstances (section 17(4) refers).

Under section 17(4), where a request relates to data contained in more than one record held on an electronic device by the FOI body concerned, the body must take reasonable steps to search for and extract the records to which the request relates. The reasonable steps are those that involve the use of any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by the FOI body. Where these reasonable steps result in the creation of a new record, that record is, for the purposes of considering whether or not such a new record should be disclosed in response to the request, deemed to have been created on the date of receipt of the request. However, there is no corresponding requirement on an FOI body to extract relevant information from hard copy files in order to compile the information sought. Such an exercise would involve the creation of a new record, which is not required under the Act.

In this case, the applicant is seeking additional specific information relating to four patients who were identified by CUH from information that was extracted from a database that is maintained by the CUH Department of Infection Prevention and Control. The additional information sought by the applicant is not recorded on the database. This additional information is held in hard copy files, rather than electronically. In order to provide the information sought, the HSE would need to extract the information from the medical records of the four patients or provide a redacted copy of the relevant information contained in those medical records. Accordingly, I am satisfied that section 17(4) is not relevant in this case.

Access to the medical records of other patients

Submissions from the HSE

In its submissions to this Office the HSE said that the information which it provided to the applicant in relation to the location of a number of possible patients from whom they claim their client contracted Influenza A (H1N1) was extracted from a database that is maintained by the CUH Department of Infection Prevention and Control. The HSE said that the database does not track the movement of patients. It explained that database does not record where a patient is moved/transferred to a different location after diagnosis with influenza. The HSE said that the database does not hold any further information other than that already released to the applicant. The HSE stated that it is not possible to extract the information about the location of the four patients, their dates in each location and any movement within CUH from any other source other than the hard copy medical files of these four patients.

In relation to accessing the medical records of any patients whose data may be contained on this database, it is the positon of the HSE that CUH cannot access the medical records of any patients (other than the applicant's late client) when reviewing this FOI request as any such information is exempt from release under section 37(1) of the FOI Act. The HSE said that the information being sought in this case is held within the medical files of other patients. It argued that the information sought would contain inherently personal information, including personal medical information, of a very sensitive nature relating to persons other than the applicant's client. It is the position of the HSE and CUH, that the FOI Act does not expect an FOI body to redact the medical records of third parties to satisfy an FOI request from a third party. Furthermore, the HSE stated that as the number of cases of positive influenza for the specified timeframe is small, the disclosure of specific information held on file relating to another patient may result in the disclosure of information relating to an identifiable individual.

Submissions from the Applicant

In its submissions to this Office, the applicant contends that the information sought is not exempt from release under Section 37(1) of the Act. The applicant argues it is not -�personal information-� as defined by the Act which means information about an identifiable individual. The applicant said that the four individuals are the four possible patients from whom they say their client contracted Influenza A (H1N1). The applicant said the information they are seeking, namely the location of each of the four individuals and, where there is more than one location, the date for each location, makes them no more identifiable than it would from the location of each of these individuals that has been extracted from the database obtained by the CUH Department of Infection Prevention and Control. The applicant argues, the location of the individual, and where more than one location, the dates for each location as extracted from their files is no more -�personal medical information of a very sensitive nature-� than is the location of each of them as has been extracted from the database to date. The applicant stated they are not looking for the medical records of the four patients/individuals per se. The applicant said they require details of their location in CUH for the months of January and February 2019 and, where more than one location, the dates for each location. The applicant contends the disclosure of this information will not result in the disclosure of information relating to an identifiable individual any more than the disclosure of the information from the database.

Section 37

Section 37(1) provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information relating to individuals other than the requester.

For the purposes of the Act, personal information is defined as information about an identifiable individual that either (a) would ordinarily be known only to the individual or members of the family, or friends, of the individual, or (b) is held by an FOI body on the understanding that it would be treated by that body as confidential. The FOI Act details fourteen specific categories of information that is personal, without prejudice to the generality of the foregoing definition, including (i) information relating to the medical history of the individual.

I note from their application to this Office that the applicant already has a certain amount of information available to them about these patients, including the date the patients were admitted to CUH, the dates they were detected with influenza, location data and the ages of three patients. In its submissions to this Office the HSE contends that as the number of cases of positive influenza for the specified timeframe is small, the disclosure of specific information held on file relating to another patient may result in the disclosure of information relating to an identifiable individual.

I am satisfied that section 37(1) applies to the medical records of the four patients at issue in this case. Furthermore, in my view, given the information already available to the applicant and the HSE's comments about the small number of patients recorded with influenza for the relevant period, I am satisfied that providing the information sought even in redacted form may reveal personal information about an identifiable individual. Accordingly, I find that section 37(1) applies.

Section 37(2) of the FOI Act sets out certain circumstances in which section 37(1) does not apply. I am satisfied that none of those circumstances arise in this case. Section 37(5) of the FOI Act provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the information would be to the benefit of the person to whom the information relates.

I am satisfied that the release of the information at issue would not be to the benefit of the individuals concerned and that section 37(5)(b) does not apply. In relation to paragraph (a), I must consider whether the public interest in granting the request outweighs, on balance, the public interest in protecting the right to privacy of the individuals to whom the information relates.

In relation to the public interest test contained in section 37(5)(a), I wish to emphasise that in carrying out any review, this Office has regard to the general principles of openness and transparency set out in section 11(3) of the FOI Act. In sum, section 11(3) recognises the need to enhance public scrutiny and accountability of government and public affairs, particularly the activities and decision making of FOI bodies. However, in a judgment delivered on 25 September 2020 (The Minister for Communications, Energy and Natural Resources v The Information Commissioner & Ors [2020] IESC 57, available on our website), the Supreme Court held that general principles of openness and transparency do not provide a sufficient basis for directing the release of otherwise exempt information in the public interest. Rather, a -�sufficiently specific, cogent and fact-based reason-� is required -�to tip the balance in favour of disclosure-�. While the comments of the Supreme Court were made in the context of the public interest test in section 36, which is concerned with the protection of commercially sensitive information, I consider them to be relevant to the consideration of public interest tests generally.

The FOI Act recognises the public interest in the protection of the right to privacy both in the language of section 37 and the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). It is also worth noting that the right to privacy has a constitutional dimension, as one of the unenumerated personal rights under the Constitution. Moreover, unlike other public interest tests provided for in the FOI Act, there is a discretionary element to section 37(5)(a), which is a further indication of the very strong public interest in the right to privacy. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy.

Having carefully considered the matter, I find that there is no public interest factor in favour of the release of the information that, on balance, outweighs the right to privacy of the individuals to whom the information relates. I find, therefore, that section 37(5)(a) does not apply.

In conclusion, therefore, I find that the HSE was justified in refusing access, under section 37(1) of the Act to the relevant information contained the medical records of the patients at issue in this case.

Decision

Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the HSE's decision. I find that it was justified in refusing access, under section 37 of the Act, to the information sought by the applicant that is contained in the medical files of other patients.

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
 

Stephen Rafferty
Senior Investigator