Whether the HSE was justified in refusing access, under section 15(1)(c) of the FOI Act, to details of all purchase orders over €20,000 for the period 2018, 2019, and for the first three quarters of 2020 for four hospitals within the Dublin Midlands Hospital Group on the ground that processing the request would cause a substantial and unreasonable interference with, or disruption of, its work

20 January 2022

Background

In a decision dated 19 March 2021 in case OIC-102936, I found that the HSE had failed to offer assistance for the refinement of a request for details of all purchase orders over €20,000 for the period 2018, 2019 and the first three quarters of 2020 for the four statutory hospitals within the Dublin Midlands Hospital Group before refusing the request under section 15(1)(c) of the FOI Act. That section allows a body to refuse a request where processing the request would cause a substantial and unreasonable interference with, or disruption of, its work. However, section 15(4) requires that such an offer of assistance must be made before a request can be refused under section 15(1)(c). I annulled the decision of the HSE and directed it to consider the request afresh.

On 6 April 2021, the HSE invited the applicant to amend his request so that it would no longer fall to be refused under section 15(1)(c). As it did not receive a reply, it issued a decision on the request on 19 April 2021 wherein it refused the request under section 15(1)(c).

The applicant sought an internal review of that decision on 23 April 2021, on the ground that publication of the data sought is not discretionary and is an obligation for all public bodies. He contended that details of payments/purchase orders could easily be run as a report by any functional financial management system. The HSE subsequently issued its internal review decision, in which it affirmed the refusal of the request under section 15(1)(c). On 30 April 2021, the applicant sought a review by this Office of the HSE’s decision.

I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the correspondence between the HSE and the applicant as set out above and to the correspondence between this Office and both parties on the matter. I have decided to conclude this review by way of a formal, binding decision.

Scope of the Review

The scope of this review is solely concerned with whether the HSE was justified in refusing, under section 15(1)(c) of the Act, the applicant’s request for details of all purchase orders over €20,000 for the period 2018, 2019 and the first three quarters of 2020 for the four statutory hospitals within the Dublin Midlands Hospital Group, on the ground that processing the request would cause a substantial and unreasonable interference with or disruption of work of the four hospitals specified in the request.

Analysis and Findings

Before I consider the applicability of section 15(1)(c), I would like to address the applicant’s argument as to why the section should not apply. In essence, he argued that the hospitals are obliged to publish the information sought and as such, a public body should not be allowed to refuse to publish information it is obliged to publish on the ground that there is too much work involved.

The Programme for Government “Government for National Recovery 2011-2016” contained a commitment that every purchase order over €20,000 by a government department or agency should be published online. The Public Service Reform Plan 2011-2016 reiterated that commitment.

Under section 8 of the FOI Act, every public body must prepare and publish a publication scheme concerning the publication of information by the body in conformity with a model publication scheme or any guidelines published by the Minister for Public Expenditure and Reform.

The Minister published a model publication scheme and accompanying guidance in 2016. The model scheme provides that a publication scheme should contain information concerning payments or purchase orders for goods and services. The accompanying guidance provides that details of payments or purchase orders over €20,000 for goods and services should be published and updated on a quarterly basis.

In its submissions to this Office, the HSE said that while it appreciates the information sought should be published, it is not currently in a position to do so and work is ongoing on progressing the matter.

It is a matter of great concern that the Hospitals concerned have not, to date, complied with the publication scheme guidance given that it issued over five years ago. I understand that some work had been undertaken by the HSE to rectify the matter but that it was hindered by the Covid-19 pandemic and the recent cyber-attack. Nevertheless, the fact remains that the information sought is not currently published. As such, I cannot accept that the HSE should not be entitled to seek to rely on section 15(1)(c) to refuse the request solely because it should have published the information sought in order to comply with the publication scheme guidance. I must have regard to the HSE’s arguments as to why it deems section 15(1)(c) to apply.

Section 15(1)(c) provides that an FOI body may refuse to grant a request if it considers that granting the request would, by reason of the number or nature of the records concerned or the nature of the information concerned, require the retrieval and examination of such number of records or an examination of such kind of records concerned as to cause a substantial and unreasonable interference with, or disruption of, work (including disruption of work in a particular functional area) of the body. The section is an express acknowledgement of the fact that there are limits to the resources a public body must expend on processing requests. The FOI Act seeks to strike a balance between ensuring access to records to the greatest extent possible and managing the administrative burden on FOI bodies in dealing with requests that require a significant allocation of time and resources.

In its submissions to this Office, the HSE said that while it accepts that the information sought should be published, the fact remains that it is not and it said there is no “list/database/or spreadsheet” with the requested information in existence for the four hospitals within the Dublin Midlands Hospital Group. It argued that the fact that the HSE does not routinely publish this information is an indication of the complexities it faces in order to compile such a document.

It said a record would have to be created in order to fulfil the request, and it argued that the work required to create such a record would cause a substantial and unreasonable interference of the HSE’s work, hence its refusal of the request under section 15(1)(c).

The HSE said that at individual hospitals level, the precise nature of the request is not recorded on any of their financial systems. It said not all purchase orders (POs) are processed electronically and many are processed manually. During the processing of a manual PO, the invoice details raised against the PO are captured on the financial system, not the details of the PO. A PO may be raised for an annual requirement for a particular item/service, but there may be 12 invoices against that one PO throughout the year. It is also the case that one invoice may contain details for more than one cost centre. For example, an invoice may contain details of four medical devices which cost €5,000 each but are cost coded to four different areas within the hospital. It said running a report for all invoices over €20,000 would not capture this invoice given the cost coding system. In summary, it said that as manual POs are not captured/input on the financial system, a report cannot be generated of all POs over €20,000, and running a report of all invoices over €20,000 does not provide the information detailing POs over €20,000. It said that this is why a manual exercise of checking individual POs would be necessary in order to compile a list/database/spread sheet as requested by the applicant.

The HSE outlined the divide between hardcopy and electronic records containing POs for each of the four hospitals as follows:

• Midland Regional Hospital Tullamore: POs for the Lab and Pharmacy are electronic.  All other areas of the hospital are manual.
• Midland Regional Hospital Portlaoise: Most areas within the hospital have electronically processed POs with the exception of Pharmacy, Maintenance, Clinical Engineering and Catering.
• Naas General Hospital: As Naas General Hospital have a different financial system to the other hospitals within the group, most of their POs are electronic with a few limited exceptions (e.g. recruitment agency fees).
• St Luke’s Radiation Oncology Network: All POs are manual.

POs held in hardcopy format

The HSE said that all POs for the Midland Regional Hospital Tullamore are processed manually with the exception of the Lab and Pharmacy areas. The hospital estimated that, based on the number of order books that were signed off for 2019, it processed in the region of 5,800 manual POs for 2019. As such, the HSE estimated that the hospital would have processed in the region of 15,900 POs for the period of time covered by the scope of this request. It said that while the other three hospitals may have processed smaller numbers of manual POs, it could make a conservative estimate that in excess of 25,000 POs would have to be retrieved and examined to determine, in the first instance, those that are to the value of over €20,000. It added that of the POs that are over €20,000, checks would have to be carried out to ensure that the payments would not be exempt from being put in the public domain (e.g. grants, disbursements, Court pay-outs, staff payments, patient payments etc.)

The HSE said that the POs that are processed manually are held in paper format and filed within a manual system. It said that while the retrieval process itself would not be an unduly burdensome task, it is the time that would need to be taken to examine the number of records involved that would cause the most disruption of work. It suggested that if four POs could be checked every minute (including the time taken to retrieve the 2019 and 2020 POs that have been archived), it would take in excess of 100 hours to examine the records involved. It said the Hospital Group was satisfied that in excess of 100 hours of work for the processing of the request would cause substantial and unreasonable interference/disruption within the Finance Departments’ normal working routine.

The HSE said there are various staffing levels in each Finance Department of the four named hospitals. Taking the Midland Regional Hospital as an example, it said it has ascertained that the process of checking the POs would fall to the Patient Accounts Department, which is staffed by 3.5 whole time equivalents (WTE). It said the other three hospitals would have either a similar arrangement or smaller WTE.

POs held in electronic format

During the course of the review, the Investigating Officer noted that three of the hospitals concerned hold some or the majority of POs in electronic form. She queried whether it might be possible to extract those POs over €20,000 from the electronic systems. In response, the HSE said that the Midland Regional Hospital Tullamore and Midland Regional Hospital Portlaoise can extract a report regarding electronically processed POs and are happy to provide same to the applicant. It said that before the reports can issue, checks will need to be carried out to ensure no personal information is included.

In relation to Naas General Hospital, the hospital said that report that can be used locally to collate the requested information in its financial system SAP extracts all the lines of POs (i.e. each PO can have multiple lines), with a range per month of 2,000 to 3,000 lines. It said the report would have to be run one month at a time, to avoid the system ‘hanging’ in the running of a larger report and this takes approximately 10 minutes, dependent on the number of lines. It said this data could be exported into Excel and that this can take an additional 5 – 10 minutes depending again on the number of lines. It said each Excel file would need to be manipulated to collate the relevant information on each PO (rather than the granular level of the PO lines that would be extracted) and this would take approximately 20 minutes, again dependent on the number of lines. It said there would also need to be a verification process to ensure that correct information is captured where PO lines cross over multiple months and it could not give an estimation of how long this would take. In summary, it said that the process would take approximately 40 minutes for each month and that the overall process for the period in question wold take approximately 22 hours plus a validation piece at the end that is not quantifiable. It said that given the current resource level and demands of the particular unit that would be carrying out this work, it could assign approximately two hours per week to fulfil the extraction and preparation of the information, with a view to completing it in 10 - 12 weeks.

Analysis of the HSE’s submissions

As I have indicated above, it is entirely unsatisfactory that the HSE has not implemented processes and procedures to enable it to comply with the model publication scheme and accompanying guidance, which provides that details of payments or purchase orders over €20,000 for goods and services should be published and updated on a quarterly basis. I note the HSE’s comment that work is ongoing on progressing the matter, and that it has been hindered by the Covid-19 pandemic and the recent cyber-attack. Nevertheless, the model scheme and guidance were published more than five years ago and as such, the HSE had ample time to develop and implement such processes before now.

It is important to note that the requirement on public bodies, under section 8 of the FOI Act, to prepare and publish a publication scheme concerning the publication of information by the body in conformity with the model publication scheme and in accordance with the accompanying guidelines is mandatory. However, while the Act entitles this Office to examine and report in its annual report on the extent to which it considers FOI bodies to be in compliance with section 8, it does not provide for any sanctions or consequences for a public body’s non-compliance.

In the circumstances, I must consider the position as it currently exists. As I have indicated above, this means that when considering whether the HSE was justified in refusing the request under section 15(1)(c), I must have regard to the fact that the information sought is not currently published.

Having regard to the HSE’s description of the manner in which the various hospitals process POs, I accept the compilation of the information sought in order to grant the request would require substantial resources in terms of staff time. The question I must consider is whether the allocation of those resources would cause a substantial and unreasonable interference with, or disruption of, work (including disruption of work in a particular functional area) of the hospitals. I am satisfied that it would. I accept that many of the POs at issue are processed manually and that the collation of the information sought would require the examination of a substantial number of hard-copy records. I also accept that the units that would be required to collate the information at issue are small and that their other work would suffer if they were to devote the time resources required to process the request.

In the circumstances, I find that the HSE was justified, under section 15(1)(c) of the Act, in refusing to provide details of all purchase orders over €20,000 for the period 2018, 2019, and for the first three quarters of 2020 for the four hospitals in question. Nevertheless, it seems to me that the HSE should be in a position to at least grant the request in part without substantially and unreasonably interfering with or disrupting the work of three of the hospitals.

As I have outlined above, the HSE said that the Midland Regional Hospital Tullamore and Midland Regional Hospital Portlaoise can extract a report regarding electronically processed POs and are happy to provide same to the applicant. It also said that Naas General Hospital could assign approximately two hours per week to fulfil the extraction and preparation of the electronically held information, with a view to completing it in 10 - 12 weeks. Accordingly, I direct the HSE to provide details of the POs for the period in question that were processed electronically by Midland Regional Hospital Tullamore, Midland Regional Hospital Portlaoise, and Naas General Hospital.

Decision

Having carried out a review under section 22(2) of the FOI Act, I hereby vary the decision of the HSE to refuse, under section 15(1)(c) of the Act, the applicant’s request for details of all purchase orders over €20,000 for the period 2018, 2019 and the first three quarters of 2020 for the four statutory hospitals within the Dublin Midlands Hospital Group, on the ground that processing the request would cause a substantial and unreasonable interference with or disruption of work of the four hospitals in question. I direct the release of details of the POs for the period in question that were processed electronically by Midland Regional Hospital Tullamore, Midland Regional Hospital Portlaoise, and Naas General Hospital.

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision.  In summary, such an appeal, normally on a point of law, must be initiated by the applicant not later than eight weeks after notice of the decision was given, and by any other party not later than four weeks after notice of the decision was given.

Stephen Rafferty

Senior Investigator