Decision
Ms P and Health Service Executive
From Office of the Information Commissioner (OIC)
Case number: OIC-127260-F6C9D8
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-127260-F6C9D8
Published on
Whether the HSE was justified in refusing the applicant’s request for access to her late sister’s medical records under sections 35 and 37 of the FOI Act
8 March 2023
In a request dated 27 September 2021, the applicant sought a copy of her late sister’s medical records held by a named HSE hospital. The applicant indicated on the application form that she was requesting the records as next of kin. She also said that she and her son were acting as executors of her sister’s estate. She provided some supporting documentation, including an Advance Healthcare Directive (AHD) from another jurisdiction in which, according to the applicant, her sister had indicated that she wanted the applicant and her son to have access to her medical records.
On 18 November 2021, the HSE refused the request under sections 35(1)(a) and 37(1) of the Act. The decision maker referred to correspondence between the parties where the applicant had apparently indicated that she suffered from similar medical conditions and suggested that the applicant get her consultant to write to the HSE to outline what information might be of assistance. She said she would review such correspondence and supply any applicable medical records to the consultant. The decision maker added that if the applicant’s wished to apply for an internal review of her decision as next of kin or as administrator of her sister’s estate, she should provide one of a number of specified documents.
The applicant sought an internal review of that decision by letter dated 14 December 2021. Among other things, she provided a letter from her GP in which it was outlined why the applicant requires access to the records.
On 16 February 2022, the HSE issued an internal review decision in which it varied its original decision. Of three volumes of records it identified as relevant to the request, it granted partial access to Volume 3, comprising 759 pages and covering the period August 2018 to October 2020. It redacted certain information from a number of the records and refused access to volumes 1 and 2 in the entirety, under sections 35(1)(a), 37(1) and 37(8) of the FOI Act. The decision maker said her decision was supported by the correspondence from the applicant’s GP and by the AHD which it described as not binding in this jurisdiction but “persuasive”.
On 15 August 2022, the applicant, represented by her son, applied to this Office for a review of the HSE’s decision. Her son submitted a letter of authority from the applicant in which she authorised her son to communicate with this Office on her behalf for the purpose of progressing the review.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the submissions made by the applicant and to the submissions made by the HSE in support of its decision. I have also examined the records at issue. I have decided to conclude this review by way of a formal, binding decision.
This review is concerned solely with the question of whether the HSE was justified, under sections 35 and 37 of the Act, in refusing access in whole or in part to certain medical records relating to the applicant’s late sister.
Section 22(12)(b) of the Act provides that a decision to refuse to grant an FOI request shall be presumed not to have been justified unless the head concerned shows to the satisfaction of the Commissioner that the decision was justified. This means that the onus is on the HSE of satisfying this Office that its decision to withhold certain records was justified.
Section 37 Personal Information
Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information relating to an individual other than the requester, including personal information relating to a deceased individual.
Section 2 of the FOI Act defines personal information as information about an identifiable individual that, either (a) would, in the ordinary course of events, be known only to the individual or members of the family, or friends, of the individual, or (b) is held by an FOI body on the understanding that it would be treated by that body as confidential. Section 2 goes on to specify 14 categories of information which, without prejudice to the generality of the above definition, constitute personal information, including information relating to the medical history of an individual. The records at issue comprise the medical records of the applicant’s late sister. I find that the release of the records would involve the disclosure of personal information relating to the applicant’s late sister and small amounts of information relating to other individuals and that section 37(1) applies.
Section 37(2)
There are some circumstances, provided for at section 37(2), in which the exemptions at section 37(1) do not apply. I am satisfied that none of the circumstances identified at section 37(2) arise in this case. That is to say, (a) the information contained in the records does not relate solely to the applicant; (b) the third parties have not consented to the release of their information; (c) the information is not of a kind that is available to the general public; (d) the information at issue does not belong to a class of information which would or might be made available to the general public; and (e) the disclosure of the information is not necessary to avoid a serious and imminent danger to the life or health of an individual.
Section 37(5)
Section 37(5) of the Act provides that a request that would fall to be refused under section 37(1) may still be granted where, on balance (a) the public interest that the request should be granted outweighs the right to privacy of the individual to whom the information relates, or (b) the grant of the information would benefit the person to whom the information relates. I see no basis for finding that the grant of the request would benefit the individual to whom the information relates and I am satisfied that section 37(5)(b) does not apply in this case.
In relation to the applicability of section 37(5)(a), in carrying out any review this Office has regard to the general principles of openness and transparency set out in section 11(3) of the FOI Act. Section 11(3) provides that an FOI body must have regard to the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. It is important to note that in The Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57 (“the eNet Case”), the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and “there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure”. Although the Court’s comments were made in cases involving confidentiality and commercial sensitivity, I consider them to be relevant to the consideration of public interest tests generally.
In relation to the issue of the public interest, it is also important to have regard to the comments of the Supreme Court in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v. the Information Commissioner [2011] IESC 26. It is noted that a true public interest should be distinguished from a private interest.
The FOI Act recognises the public interest in the protection of the right to privacy both in the language of section 37 and the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). It is also worth noting that the right to privacy has a constitutional dimension, as one of the unenumerated personal rights under the Constitution. Moreover, unlike other public interest tests provided for in the FOI Act, there is a discretionary element to section 37(5)(a), which is a further indication of the very strong public interest in the right to privacy. Privacy rights will therefore be set aside only where the public interest served by granting the request (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy.
In her correspondence with the HSE, the applicant identified a number of reasons as to why she wished to obtain her late sister’s records. Under section 13(4) of the Act, any reasons a requester gives for a request must generally be disregarded in deciding whether to grant or refuse the request. In the context of considering the public interest test under section 37(5)(a), this means that the reasons given for the request may be considered only insofar as they reflect a true public interest, i.e. insofar as the concerns raised in relation to the request may also be matters of general concern to the wider public. It seems to me that in this case, the applicant has identified what are essentially private interests for seeking access to the records at issue.
In considering where the balance of the public interest lies, I have had regard to the fact that the release of records under FOI is regarded, in effect, as release to the world at large, given that the Act places no constraints on the uses to which a record released under the Act may be put. Having examined the records at issue in this case, I have not been able to identify any sufficiently specific, cogent and fact-based reason for finding that the public interest that the request should be granted outweighs the right to privacy of the individuals to whom the information relates. I find, therefore, that section 37(5)(a) does not apply.
Section 37(8)
Section 37(8) provides that notwithstanding subsection (1), the Minister may provide by regulations for the grant of an FOI request where the individual to whom the record concerned relates is dead and the requester concerned is a member of a class specified in the regulations. Such regulations have, indeed, been made. They are the Freedom of Information Act 2014 (Section 37(8)) Regulations 2016, as amended (the 2016 Regulations).
Regulation 4 provides that, notwithstanding section 37(1), an FOI request may be made for records which involves the disclosure of personal information (including personal information relating to a deceased individual), and shall, subject to the other provisions of the Freedom of Information Act 2014, be granted if the case falls within a case to which Regulation 7 applies. Regulation 7 applies to a case in which the individual to whom the record concerned relates is dead (“the individual”) and either-
(a) the requester concerned belongs to one or other of the following classes:
(i) a personal representative of the individual acting in due course of administration of the individual’s estate or any person acting with the consent of a personal representative so acting,
(ii) a person on whom a function is conferred by law in relation to the individual or his or her estate acting in the course of the performance of the function, or
(b) the requester is the spouse or the next of kin of the individual and, in the opinion of the head, having regard to all the circumstances, the public interest, including the public interest in the confidentiality of personal information, would on balance be better served by granting than by refusing to grant the request.
It is important to note that each of the three classes outlined are standalone classes. If a requester shows that they satisfy one of the classes, it is not necessary for the requester to show that they satisfy any other of the classes. Moreover, once the conditions of the category are met, the 2016 Regulations provide that the FOI body shall grant the request, subject only to the other provisions of the Act. It is also important to note that the 2016 Regulations do not provide for the release to the next of kin of the personal information of any party other than the relevant deceased person. Neither do they provide for the release to such a requester of the personal information of the deceased person where that is joined to the personal information of any other party. Therefore, I have considered section 37(8) and the 2016 Regulations only in relation to the information that relates solely to the deceased.
The applicant stated that she was seeking access to her late sister’s medical records as her next of kin. The HSE said it accepts that the applicant is the next of kin of the deceased for the purposes of the 2016 Regulations. Accordingly, the question arising is whether, having regard to all the circumstances, the public interest, including the public interest in the confidentiality of personal information, would on balance be better served by granting than by refusing to grant the request.
The Minister for Public Expenditure and Reform has published guidance on the application of the 2016 Regulations (the Guidance), in accordance with section 48(1) of the FOI Act. Section 48(3) of the FOI Act requires FOI bodies to have regard to guidelines published by the Minister in the performance of their functions.
The Guidance provides that it is a matter for the decision maker to make such enquiries and engage in such consultation as is necessary to allow him or her to decide if the public interest would be better served by granting than by refusing the request.
It suggests that certain factors should be taken into consideration when deciding if release is appropriate to the spouse or next of kin of the deceased, including:
Furthermore, in considering the nature and confidentiality of records to be released, the Guidance states that if the record is inherently private and of a very sensitive nature, then there must be compelling reasons for its release. In relation to medical records in particular, it states that due regard should be had to the confidentiality of medical records in accordance with the relevant Irish Medical Council guidance (currently the Guide to Professional Conduct and Ethics for Registered Medical Practitioners - 8th edition published May 2016 (the Medical Council Guide)). The Medical Council Guide states that patient information remains confidential even after death and suggests that, if unclear whether the patient consented to disclosure of information after their death, it should be considered how disclosure of the information might benefit or cause distress to the deceased family or carers, along with the effect of disclosure on the reputation of the deceased and the purpose of the disclosure.
It is apparent from the 2016 Regulations, which refer to “all the circumstances” and from the factors specified in the Guidance, that such circumstances and matters, where relevant, cannot be excluded solely on the basis that they are not public interest factors.
In its submissions, the HSE said it is of the opinion that, having regard to all the circumstances, the public interest, including the public interest in the confidentiality of personal information, is on balance better served by refusing to grant the request for the release of the full volumes of the deceased’s medical records in their entirety. It made submissions in respect of the various actors outlined in the Guidance as follows:
The confidentiality of personal information
The HSE said it takes very seriously its role in ensuring the privacy and confidentiality of a patient’s inherently private and confidential personal sensitive healthcare records in its possession.
Whether the deceased would have consented to the release of the records to the requester when living
The HSE said it took into consideration the fact that the deceased individual lived with the applicant when she returned to live in Ireland from another jurisdiction, that the applicant was named as “next of kin” on medical records and attended on occasion with her sister at the hospital. It said it also considered the letter from the applicant’s GP relating to the request for records and to concerns presented by healthcare professionals regarding a discharge plan for the deceased from hospital to home care.
Whether the person had outlined arrangements in his or her will or other instrument in writing consenting to the release of personal records
The HSE said that it took into consideration the copy of the AHD provided, which the deceased signed in 2014 in another jurisdiction. It noted that the AHD was the subject of a meeting attended by the applicant and another family member in 2017 with the hospital and that at that time, no one was appointed by the Irish courts to act on the patient’s behalf.
It said it also noted other documents referring to “administration of the estate” provided by the applicant and said it was on this basis that the “class of requester” was considered also as a legal personal representative and administrator of the estate. It said it would have been very helpful to the HSE had the applicant provided a copy of her late sister’s will to determine if she had outlined arrangements in her will consenting to the release of personal records, similar to her action in signing an AHD in 2014.
Whether release of the records would damage the character and good name of the deceased
The HSE said it was cognisant of the fact that release of records under FOI is considered to be release to the world at large and that care planning information and concerns pertaining to the deceased as well as the deceased’s wishes regarding her personal care are considered by the HSE to be inherently private.
The matter of the nature of the relationship of the applicant to the deceased and the circumstances of their relationship before the deceased's death
The HSE said it took into consideration the fact that the deceased individual lived with the applicant when she returned to live in Ireland from another jurisdiction, that the applicant was named as “next of kin” on medical records and attended on occasion with her sister at the hospital. It said it also took into consideration the fact that the principal social worker for safeguarding identified in 2017 that the patient’s nephew was not appointed, to that date, with power of attorney and did not have decision making authority. It again noted that the AHD was the subject of a meeting attended by the applicant and the deceased’s nephew in 2017 with the hospital and that at that time, no one was appointed by the Irish courts to act on the patient’s behalf and a solicitor had yet to be instructed in that regard.
The nature of the records to be released
The HSE said that it considered the content of a letter from the applicant’s GP in the context of the scope of the request. It said that the deceased’s treating consultant and a named advanced medical practitioner confirmed as part of the HSE’s submission that the records released are considered to fulfil the scope of the request as understood.
Whether the requester can obtain the information they seek without accessing the records of the deceased
The HSE noted that the applicant and/or her son were generally in attendance at appointments with the deceased and attended care planning meetings regarding the care of the deceased.
My Analysis
It is clear that the HSE gave detailed consideration to the Guidance when considering whether, having regard to all the circumstances, the public interest, including the public interest in the confidentiality of personal information, would on balance be better served by granting than by refusing to grant the request. What is less clear however, is why, having considered the issues it outlined in its submissions, it subsequently concluded that the public interest would on balance be better served by refusing access to volumes 1 and 2 of the records. It would appear that the HSE afforded significant weight to the inherently private nature of the records. However, it has not explained why this particular factor was considered to outweigh the other factors considered that appear to support release.
For example, the HSE specifically acknowledged the relevance of the AHD signed by the deceased in 2014. In that AHD, the deceased designated and appointed the applicant and her son as her co-agents for all matters relating to her health care. Among other things the AHD granted the agents the authority to request, review, and receive any information regarding the individual’s physical or mental health, including her individually identifiable health information or other medical records. While I appreciate that the AHD does not extend to providing authority for access to such records following her death, it is a clear indicator, in my view, that the deceased would have consented to the release of the records to the requester when living
On the matter of the HSE’s concern that the release of records under FOI is, in effect, release to the world at large, I fully accept that as records released pursuant to the FOI Act are released without any restriction as to how they may be used, such release is regarded, in effect, as release to the world at large. This is true of all records released under FOI regardless of the identity of the requester. Indeed, it is also true of requests where the requester seeks his/her own personal information. Nevertheless, the fact remains that the Oireachtas saw fit to determine that access to the records of deceased persons shall be granted to certain categories of requesters, provided the requirements of the 2016 Regulations have been met. Accordingly, I do not accept that the fact that the release of records under FOI is essentially release to the world at large provides a reasonable ground for refusing access to a category of requester that the Oireachtas has determined should be granted access.
On the matter of the nature of the relationship of the applicant to the deceased and the circumstances of their relationship before the deceased's death, the HSE has not presented any evidence to suggest that it had any concerns about that relationship, nor are any such concerns apparent from my examination of the records at issue. I note the HSE’s reference to a meeting attended by the applicant and the deceased’s nephew in 2017 with the hospital. Having carefully examined the records relating to the 2017 meeting, I can see no indication that the concerns of the HSE at the time or now are such as to justify refusal of access to the applicant. It appears the HSE’s concerns related to the level of care the deceased required and the capacity of her family to provide that at home and to have appropriate care in place prior to the deceased being discharged. I note that the deceased was discharged home at that time. I also note from the records that the applicant and her son were the only family members engaged with the HSE in relation to the care of the deceased at all times.
Finally, on the matter of the HSE’s argument that it essentially granted access to those records it considered to address the applicant’s concerns as set out in the letter she provided from her GP, it seems to me that this does not, of itself, mean that no other records should be released. The applicant did not limit the scope of her request solely to those records that might address her own concerns. Rather, she sought access to all of the records held.
Having regard to all of the circumstances arising in this case, I am not satisfied that the HSE has satisfactorily shown that, on balance, the public interest would be better served by refusing access to the records at issue. In conclusion, therefore, I find that the HSE was not justified in refusing the applicant’s request for her late sister’s medical records under section 37(8) of the FOI Act and the 2016 Regulations.
However, that is not the end of the matter. As I have outlined above, the 2016 Regulations are subject to the other provisions of the FOI Act. As the HSE also refused to grant access to the records at issue under section 35(1)(a), I must go on to consider whether the records sought are exempt from release under that provision.
Section 35
Section 35(1)(a) of the Act provides that an FOI body shall refuse to grant an FOI request if –
the record concerned contains information given to an FOI body in confidence and on the understanding that it would be treated by it as confidential and the body considers that its disclosure would be likely to prejudice the giving to the body of further similar information from the same person or other persons and it is of importance to the body that such further similar information as aforesaid should continue to be given to the body.
However, section 35(2) provides that:
“subsection (1) shall not apply to a record which is prepared by a staff member of an FOI body in the course of the performance of his or her functions unless disclosure of the information concerned would constitute a breach of a duty of confidence that is provided for by an agreement or statute or otherwise by law and is owed to a person other than an FOI body or its staff.”
Accordingly, before considering whether section 35(1)(a) might apply, I have considered whether section 35(2) serves to disapply section 35(1)(a) in this case. As the HSE said in its submissions, the records at issue “were prepared by employees of an FOI body, namely a public hospital under the remit of the Health Service Executive, in the course of the performance of their role and in the provision of healthcare”.
Accordingly, pursuant to section 35(2), section 35(1)(a) cannot apply unless the release of the records would constitute a breach of a duty of confidence that is provided for by an agreement or statute or otherwise by law and is owed to a person other than an FOI body or its staff.
In addressing section 35(2) in its submissions, the HSE did not identify any agreement or statute that might provide for a duty of confidence in this case. Nevertheless, a duty of confidence provided for “otherwise by law” is generally accepted to include a duty of confidence arising in equity. This Office accepts that breach of an equitable duty of
Confidence is comprehended by section 35(1)(b). The essence of the HSE’s argument in this case is that it owes a duty of confidence to the deceased.
In the Supreme Court decision in the case of Mahon v Post Publications Ltd [2007] 3 I.R. 338 Fennelly J confirmed that the requirements for a successful action based on a breach of an equitable duty of confidence, at least in a commercial setting, are found in the judgment of Megarry J in Coco v. A. N. Clark (Engineers) Ltd. [1969] R.P.C. 41, at 47: “[T]hree elements are normally required if, apart from contract, a case of breach of confidence is to succeed. First, the information itself ... must 'have the necessary quality of confidence about it'. Secondly, that information must have been imparted in circumstances importing an obligation of confidence. Thirdly, there must be an unauthorised use of that information to the detriment of the party communicating it."
Fennelly J summarised or restated the requirements of what he called “the contours”
of the equitable doctrine of confidence as follows:
1. the information must in fact be confidential or secret: it must ... “have the necessary quality of confidence about it”;
2. it must have been communicated by the possessor of the information in circumstances which impose an obligation of confidence or trust on the person receiving it;
3. it must be wrongfully communicated by the person receiving it or by another person who is aware of the obligation of confidence.”
In previous decisions, this Office has adopted this approach in considering whether
disclosure of information would constitute a breach of an equitable duty of confidence. I accept that the records meet the first test in that they contain confidential information about the health and treatment of the deceased. The second element requires that there be an understanding that the information would be treated as confidential. I accept that this was so in the context of the consultations between the deceased and the health services. The third element in the test for a breach of duty of confidence is that there must be an unauthorised use of the information to the detriment of the person who communicated it to the HSE i.e. the deceased.
Section 37(8) provides for the release of the personal information of deceased persons in certain circumstances; in effect, it provides for what, on the face of it, is a limited breach of privacy and of confidentiality. Section 37(8) and the 2016 Regulations provide for a process under which the personal and confidential information of a deceased person will be released to certain specified classes of person and to such classes only. This Office takes the view that to invoke section 35 in relation to personal information which is otherwise releasable by virtue of section 37(8) is at odds with the intent of the FOI Act. Given the express provision in Regulation 4 of the 2016 Regulations for the granting of access to records of a deceased individual to the classes of individual set out in Regulation 7, I consider it untenable to find that such disclosure would be unauthorised.
As regards the possibility of detriment to the deceased, I realise that this is not a settled area of law. Nonetheless, I am not prepared to accept in the circumstances of this case that an authorised disclosure to a specified individual (the next of kin of the deceased) in accordance with a statutory provision could be to the detriment of the deceased. It seems to me that if it was the case that all medical records were to be exempt from disclosure on the basis that their release would constitute a breach of confidence, the provisions of Regulation 4 and of section 37(8) would be made redundant.
I should add, in any event, that in the particular circumstances arising in this case, I am not satisfied that the release of the records sought would involve an unauthorised use of the information to the detriment of the deceased. In holding this view, I am cognisant of the facts that;
Accordingly, I find that release of the records would not give rise to a breach of a duty of confidence and that section 35(1) cannot therefore apply given the provisions of section 35(2).
Having carried out a review under section 22(2) of the FOI Act, I hereby vary the HSE’s decision. I find that the HSE was not justified in refusing access to the medical records of the applicant’s late sister records under sections 35 and 37 of the FOI Act. I direct the release of the records sought, apart from any third party personal information in the records relating to parties other than the applicant or her late sister. I find such information to be exempt from release under section 37(1) of the Act.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated by the applicant not later than eight weeks after notice of the decision was given, and by any other party not later than four weeks after notice of the decision was given.
Stephen Rafferty, Senior Investigator