Whether the HSE was justified in refusing access to certain information and records under section 15(1)(a) of the FOI Act

26 February 2024

Background

In a request dated 30 August 2023, the applicant sought access to the following information relating to St Luke's Hospital Kilkenny:

• A list of all dates in chronological order that a Serious Incident Management Team (SIMT)/review decision meeting was held in the Hospital between 1^stDecember 2022 to date.

She further requested that this include the following: meeting date, meeting location, the meeting attendees name and role, the meeting apologies name and role, the number of patients discussed at each separate meeting and the number of pages of the minutes of each separate meeting held.

The applicant also sought that the data be provided in a specific format and that each meeting's data would be listed separately in chronological order under separate meeting data headlines.

In a decision dated 25 September 2023, the HSE granted partial access to the information sought by releasing redacted copies of the SIMT minutes sought. It stated in its decision that "the FOI Act confers a general right of access rather than a general right to information. If the information sought is not contained in a record the FOI Act does not impose an obligation of an FOI Body to create a record where none exists; nor does it provide a mechanism for answering questions, or for seeking clarification, except to the extent that the questions posed or clarification sought can reasonably be inferred to be a request for a relevant record that exists at the date of the request, and which contains the answer or clarification sought."

The HSE scheduled the minutes of 12 SIMT meetings, constituting 66 pages, between 19 December 2022 and 14 August 2023. It partially granted access to all minutes, withholding access to information of third parties discussed in the minutes under section 37(1). All information regarding the attendees, apologies, meeting times, location and the personal information of the applicant's late father were released to her. On 26 September 2023, the applicant submitted a request for internal review to the HSE. In her application she requested that the data be provided in the specific format originally requested, she also stated that her original request for the number of patients discussed at each meeting on each specific date has not been provided, nor was any reference made to it in the original decisions. In addition, she noted that no redacted minutes had been provided for February 2023, she requested that the HSE confirm if any SIMT meetings were held by the Hospital on that date, and she requested that confirmation be provided that all the documentation provided cover all the meetings held by the SIMT from December 2022, to date.

On 16 October 2023, the HSE issued its internal review decision affirming the original decision. It stated that the information withheld from these minutes contains the personal information of other individuals. It further outlined that no meetings were held in February 2023, and that accordingly no minutes exist for the Month of February 2023. It stated that all minutes which exist between the relevant dates had been released. It also stated in response to her request for the number of patients discussed at each meeting, that the material was exempt from release as it would disclose the personal information of other patients and that in accordance with the FOI Act, the hospital is not required to release the information, nor are they required to create a new record.

On 18 October 2023, the applicant applied to this Office for a review of the HSE's decision. Alongside her application, she provided a letter of submission, the points raised by the applicant therein, will be explored later in the decision.

I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the submissions made by the relevant parties who made submissions, the applicant's comments in her application for review and to the submissions made by the FOI body in support of its decision. I have also examined the records at issue. I have decided to conclude this review by way of a formal, binding decision.

Scope of Review

During the course of the applicant's engagement with this Office, she clarified that she is seeking the total number of patients discussed at each meeting, and she has also sought the total number of incidents. She has also sought the minutes from any SIMT meeting which took place in February 2023.  The applicant did not request the total number of incidents in her original request to the HSE, or the application for review to this Office, it was raised in submissions provided to the Investigator during the course of the review. As the applicant is aware, the scope of any review undertaken by this Office is confined to the original request made and/or to any subsequent narrowing of the scope of the request either during the processing of the request by the FOI body or during the review being undertaken by this Office. We have no authority to broaden the scope of a review beyond what was originally sought. Accordingly, I cannot consider this information for release to the applicant. 

I also understand from submissions provided by the applicant that she is not seeking the release of any personal information relating to the patients discussed at the meeting, but has expressly stated in response to the HSE's comments around the number of patients, that the data does exist and no private or personal data would be released and can certainly be anonymised. Accordingly, I will not consider the release of any additional personal data to the applicant.

Therefore, this review is concerned with whether the HSE was justified in refusing under section 15(1)(a) of the FOI Act, the minutes of the February SIMT meeting and the total number of other patients discussed at each SIMT meeting, between December 2022 and August 2023.

Preliminary Matters

During the course of this review, the applicant has raised a number of concerns including the relevant Hospital's capacity to provide safe patient care and the importance of public hospitals being scrutinised in order to raise the standards of such care. She also expressed dissatisfaction concerning the internal reviewer's adjudication of her requests, specifically relating to the dual role of independent reviewer and the HSE's Group Communication Manager. As stated to the applicant, it is important to note that this Office has no remit to investigate complaints, to adjudicate on how FOI bodies perform their functions generally, including the running of hospitals, or to act as an alternative dispute resolution mechanism with respect to actions taken by FOI bodies.

The applicant has also stated that the request did not relate to the personal data of her late father and expressed concern that the HSE had released the personal information of her late father to her from the records. She sought the matter to be investigated by this Office. Taking the above into consideration, it is worth stating the HSE had previously adjudicated on a number of other requests from the applicant seeking personal data relating to her late father, during the course of these requests the applicant has been established as her late father's next of kin, and on that basis has a right to access his personal data in the records requested as part of this request. This is notwithstanding the fact that the same information in the record in question was already released to the applicant by virtue of a separate request.

For the benefit of the applicant, I also wish to explain that while the purpose of the FOI Act is to enable members of the public to obtain access to information held by FOI bodies, the mechanism for doing so is by accessing records held by these bodies. In other words, a person wishing to obtain information from an FOI body must make a request for records, requests for information are not valid requests under the Act, except to the extent that a request for information can reasonably be inferred to be a request for a record containing the information or answer sought.

Analysis and Findings

Section 15(1)(a)

Section 15(1)(a) of the FOI Act provides for the refusal of a request where the records sought do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken.

It is important to note that the Act does not require FOI bodies to create records if none exist apart from a specific requirement, under section 17(4), to extract records or existing information held on electronic devices. Section 17(4) provides that where a request relates to data contained in one or more record held on an electronic device by the FOI body concerned, the body must take reasonable steps to search for and extract the records to which the request relates. Where the reasonable steps result in the creation of a new record, that record is, for the purposes of considering whether or not such a new record should be disclosed in response to the request, deemed to have been created on the date of the receipt of that request. Section 17(4) defines reasonable steps as steps that involve the use of any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by the FOI body.

If a body does not hold a record containing the information sought and cannot search for and manually extract the electronically held records by taking reasonable steps, it is entitled to refuse the request under section 15(1)(a) on the ground that the record sought does not exist. The question I must consider in this case, therefore, is whether the HSE was justified in finding that it does not hold records containing the additional specific information sought and/or that it cannot search for and extract the relevant electronically held records by taking reasonable steps.

Submissions from the Applicant

During the course of this review the applicant has provided two sets of submissions. Initially, the applicant argued that she has not been provided with the number of patients discussed at each meeting, and further that it had not been confirmed if minutes for the February 2023 meeting existed. She argued that the decision not to release the number of patients discussed was incorrect as the data was available and could be compiled or extracted from the data. She contended that it would be easy for the data controller to manually count the number of patients discussed at the meetings and that this information should be provided as requested. In her second submission provided to this Office, the applicant also stated that in response to the HSE's consideration of the public interest test, and more generally, that the Hospital's statement of"on balance, the public interest that the request should be granted outweighs the public interest that the right to privacy of the individual to whom the information relates should be upheld"is irrelevant in this instance as no private data would be released, she stated that the hospital have admitted that the minutes do show how many people were discussed and therefore the data does exist and no private/personal data would be released as it could be anonymised. The applicant also alleged that the hospitals statement that the hospital did not collect information or report the number of patients discussed at the meetings appeared to be untruthful. She argued that she was aware that specific incidents are reported to the SIMT and managed in line with the HSE's Incident Management Framework and that there is an obligation on the hospital to notify specific incidents externally to the service where the incident occurred. In support of her argument the applicant provided a copy of a Health Information and Quality (HIQA) inspection, and a copy of the HSE Incident Management Framework.

Submissions from the HSE

The HSE have confirmed that the SIMT met on the following dates that fall under the scope of the request: 19.12.2022, 16.01.2023, 13.03.2023, 24.04.2023, 15.05.2023, 22.05.2023, 06.06.2023, 03.07.2023, 18.07.2023, 24.07.2023, 31.07.2023 and 14.08.2023. It has stated that the minutes have been released to the applicant in part, and that it is satisfied that the withheld records contain personal information of other patients. It has argued that service users can be identified by different means such as their initials, last names, medical record number and NIMS reference number, it has also states that associated with these details are sensitive medical information. It states that the dates listed above are the only dates the SIMT met during the timeframe set out by the applicant in her request. The hospital have confirmed that no SIMT meeting was held in February 2023, the staff who would normally be in attendance were consulted and confirmed that they did not meet, the room booking were checked for the room were the meetings are held and no booking had been made for this meeting. Therefore, the hospital's position remains that no SIMT meeting took place in February 2023 and as such, no records exist.

The HSE has also confirmed that the only document that contain information on the number of patients discussed at each meeting of the SIMT are the minutes of each meeting. In relation to whether the number of patients could be extracted from each meeting and provided as an overall figure, the HSE have stated that while it would be possible to do this, it has stated that the FOI Act provides for a right of access to records as opposed to information/answers to questions. It has also stated that the minutes are in word format and while these documents are held electronically, that the provisions of section 17(4)(a) refer to any facility for electronic search or extraction. It has stated that a search for the minutes of each meeting can be carried out electronically, this search would not identify how many patients were discussed at the meeting. It has further outlined that the information sought by the applicant cannot be extracted electronically from the documents in the same way that information can be extracted from a spreadsheet or database. It has stated that the minutes of each meeting would have to be read by a person to manually count the number of patients discussed at each meeting, and that these numbers along with the date of the meeting would then have to be manually recorded in a new document in order to provide the information to the applicant.

My Analysis

As I have outlined above, as part of this review I must consider two questions

1. Whether minutes for the February 2023 SIMT meeting exist and,

2. Whether the number of patients across the relevant meeting minutes can be extracted by using any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by the HSE

Having regard to the submissions provided by the HSE, I consider that the steps carried out to search for the minutes of an SIMT meeting in February 2023, are reasonable, I note in particular that all regular attendees were contacted and provided confirmation that they did not meet, I also note that no booking had been made for the meeting room, and I note that the applicant has not advanced any further arguments outlining why she considers that a meeting should have taken place. Having examined the minutes myself I note that all meetings which have been scheduled are held in the same meeting room and further that there tends to be overlap between the attendees. Accordingly, I accept that no meeting of the SIMT was held in February 2023 and that the record in question does not exist.

It is worth repeating, that the Act does not require public bodies to create records if none exist, apart from a specific requirement, under section 17(4), to extract records or existing information held on electronic devices. Under section 17(4), where a request relates to data contained in more than one record held on an electronic device by the body concerned, the body must take reasonable steps to search for and extract the records to which the request relates. The reasonable steps are those that involve the use of any facility for electronic search or extraction that existed on the date of the request and was ordinarily used by the FOI body. Where these reasonable steps result in the creation of a new record, that record is, for the purposes of considering whether or not such a new record should be disclosed in response to the request, deemed to have been created on the date of receipt of the request. However, if the body does not hold a record containing the information sought and cannot search for and extract the electronically held records by taking reasonable steps, then that is the end of the matter.

In this case, it is not in contention that the HSE holds records that contain the information sought, or that the information sought could be extrapolated from the information held, following additional work, I say this insofar as the names or reference numbers of patients together would indicate the total number of patients discussed. In considering whether the HSE's position is reasonable, I note that the HSE has stated the work would involve manually combining and cross referencing patient details across each record in order to create a new record which would provide the information sought by the applicant. Patient details in the records in question are recorded using surnames and various reference numbers and the records contain crossover, the applicant hasn't disputed this fact, and it is clear to me that in order to compile this information, each patient referenced would need to be counted manually from each set of minutes. In addition, the HSE has also stated that the Hospital does not collect that information and that there is no requirement to do so. In my view, where information held on a database requires further manual input in order to collate the specific information that has been requested, I would not consider this to be a 'reasonable step' of the sort set out in section 17(4).

In relation to the applicant's arguments concerning the Hospital's obligations to report the number of specific incidents which occurred, I note that the National Incident Management Framework provides for the reporting of specific incidents as opposed to the number of patients discussed at each meeting of the SIMT, I have also noted that certain patients don't have NIMS numbers as it was either determined that no incident took place, or potentially they hadn't been assigned one yet. Accordingly, I don't consider that the HSE have mislead the applicant by stating that they do not record the specific number of patients discussed at each meeting.

Having regard to the foregoing, it seems to me that the HSE is not in a position to produce any records containing the information sought in the request further to the requirements of section 17(4), and further that the minutes sought for the February 2023 meeting cannot be found after all reasonable steps to ascertain their whereabouts have been taken and therefore section 15(1)(a) of the FOI Act applies to these minutes.

Decision

Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the HSE's decision. I find that the HSE was justified in refusing access to further information under section 15(1)(a) on the basis that no further information exists.

Right of Appeal

Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.

Rachael Lord
Investigator