Decision
Mr X and Health Service Executive
From Office of the Information Commissioner (OIC)
Case number: OIC-140328-Q8G4K3
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-140328-Q8G4K3
Published on
Whether the HSE was justified in refusing access, under section 15(1)(a) of the FOI Act, to further records other than those already released on the ground that no further relevant records could be found
15 May 2024
On 2 February 2023 the applicant sought access to the following:
(a) Internal communications between a named psychiatrist and either other HSE staff members or external third parties relating to the applicant between August 2021 and the date of the request; including but not limited to the following:
(i) Communications relating to a letter from the applicant in January 2023
(ii) Communications relating to the applicant and the psychiatrist’s change of role
(iii) Communications relating to Medical Council processes
•
(b) Internal communications between a named occupational therapist and either other HSE staff members or external third parties relating to the applicant between March 2022 and the date of the request; including but not limited to the following:
(i) Communications relating to the applicant’s Coru complaint
(ii) Communications relating to the applicant’s engagement with the Home-Based Crisis Team
(iii) Communications relating to a letter from the applicant in October 2022
(iv) Communications relating to the applicant and the occupational therapist’s change of role
(v) Communications from the occupational therapist relating to the applicant’s text messages
(vi) Communications relating to the applicant’s Medical Council complaint
•
(c) Internal communications between a named clinical nurse specialist and either other HSE staff members or external third parties relating to the applicant between January 2022 and the date of the request; including but not limited to the following:
(i) Communications relating to the applicant’s Medical Council complaint
(ii) Communications relating to the applicant’s Coru complaint
(iii) Communications relating to the applicant’s emails and text messages requesting a meeting following the Coru decision in October and November 2022
(iv) Communications relating to the applicant’s NMBI complaint
On 12 May 2023 the HSE issued its decision. It identified 30 pages of records as falling within the scope of the applicant’s request and it released all records to the applicant. On 16 May 2023 the applicant sought an internal review of this decision saying that he consider that further records should exist relevant to his request. The internal review decision dated 27 June 2023 subsequently affirmed the original decision.
On 7 July 2023 the applicant appealed the matter to this Office
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the applicant’s comments in his application for review and to the submissions made by the HSE in support of its decision. I have also had regard to the contents of the records concerned. I have decided to conclude this review by way of a formal, binding decision.
This review is therefore concerned solely with whether the HSE was justified in refusing access, under section 15(1)(a) of the FOI Act, to further records relevant to the applicant’s request, other than those already released, on the ground that no further relevant records exist or can be found.
Before I address the substantive issues arising, I would like to make one preliminary comment.
As has previously been explained to the applicant, this Office has no remit to investigate complaints, to adjudicate on how FOI bodies perform their functions generally, or to act as an alternative dispute resolution mechanism with respect to actions taken by FOI bodies.
Searches – section 15(1)(a)
In his application to this Office, the applicant has argued that further records exist relevant to his request which have not been identified and as such the provisions of section 15(1)(a) are of relevance.
Section 15(1)(a) of the FOI Act provides for the refusal of a request where the records sought do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken. In such cases, the role of this Office is to review the decision of the FOI body and to decide whether that decision was justified. This means that I must have regard to the evidence available to the decision maker and the reasoning used by the decision maker in arriving at his/her decision and I must assess the adequacy of the searches conducted by the FOI body in looking for relevant records.
During the course of the review, the HSE provided submissions to this Office in which it provided details of the searches carried out for relevant records in all three requests and of its explanation as to why no further relevant records could be found. As I have already provided the applicant with those details, I do not propose to repeat them in full here.
The HSE provided details of the specific searches which were conducted, the specific search terms which were used and the specific electronic folders and generic email addresses which were searched. It provided details of the hard copy physical files which were searched. In addition, the HSE provided a list of sixteen staff members who were specifically contacted to see if they held relevant records. As I have already provided this information to the applicant, I do not consider it necessary to repeat it here.
In addition, I also sought details from the HSE with regard to a number of specific issues raised by the applicant. First, I sought further details in relation to the reference to North Lee Mental Health Services in the original decision and why it appeared that the applicant’s request was interpreted as relating only to records held by this Service. In response, the HSE said that the reason the applicant’s request was interpreted as relating only to records held by this Service is that all of the applicant’s records are kept in the North Lee Mental Health Services, currently in a composite clinical file; at a named Primary Care Centre, and a specific unit within Mercy Hospital Cork. It further said that despite temporarily living in another area, it was agreed by the Multi-Disciplinary team (MDT) that the applicant would remain under the care and treatment of North Lee Mental Health Services in order to engage with a specific programme. It further informed me that given the location of the applicant’s GP, for consistency, the MDT team and all file assessments were carried out under the North Lee Mental Health Service remit including the Home Base Crisis Team referrals and follow ups.
I also sought details from the HSE in relation to the comments of the applicant as to whether the Area Administrators for both North and South Lee Mental Health Services had been contacted for records relevant to his request. In response, the HSE said both Area Administrators were consulted for records relevant to the applicant’s request. With regard to the three specific individuals referred to by the applicant in his request, I sought confirmation that these three individuals had been consulted. In response, the HSE said that records were requested of two staff members who remain employed by the HSE. It further said that records were not requested from staff who are no longer employed by the HSE.
I also sought further information in light of the applicant’s comments in which he considered that other individuals may hold records relevant to his request; namely the line managers of the three individuals referred to in the original request, HSE South Lee Administrator, the Acute Mental Health Service CUH, the Clinical Directors of North Lee and South Lee, the Executive Clinical Director and the Head of Mental Health Services. In response the HSE confirmed that all relevant members of the applicant’s Multi-Disciplinary Team have been requested to provide any records they may hold on multiple occasions due to the multiplicity of requests for records which have been submitted by the applicant.
•
Finally, specifically, with regard to records relating to the applicant’s NMBI complaint, the HSE noted that complaints made to a professional body by a third party are held and managed by that professional body and not the employer, the HSE in this case.
In addition to the above specific matters, I also details from the HSE regarding the storage of records and their records management practices more generally. In response the HSE said the records which fall within the scope of this request are made up of the following:
•
a. Clinical File
b. Multi-Disciplinary Team notes for sector team
c. FOI files
d. Occasional emails – kept on individual inbox only and not printed or shared digitally
e. Administrative records
•
The HSE said the clinical file is in a physical format and it is held at a named primary care centre. It further indicated that there are two types of files; outpatient file and inpatient file. It said the outpatient file is retained at the primary care centre in a records filing room, which is locked and access is only gained via swipe card. It said that the inpatient file is kept at a specific unit in Mercy Hospital Cork in a records filing room in a metal drawer. It added that access is gained via swipe card, and files are checked in and out and signed for.
In addition, it informed me that digital files are kept on a shared drive relevant to the sector they refer to e.g. FOI, Internal Review or OIC requests and will be both digitally filed in a specific folder on a shared drive and a physical folder in a secure area. It said access to the shared drive/folder is via individual passwords. It added that the CRM (Customer Relationship Management) Data Base is known as IPIMS (Interactive Patient Information Management System). It said that one MRN (Medical Record Number) is allocated to the patient. The HSE further said that while a register of files is kept by each Community Mental Health Team sector, at present there is not a unified composite registry of the applicant’s files kept in one location as:
a. The applicant’s outpatient file is kept at the primary care centre;
b. The applicant’s in-patient file is kept at a specific unit in Mercy Hospital; and
c. all other files such as FOI requests are kept with the Community Mental Health Team Sector relevant to the specific request.
In sum, it is the HSE’s position that all records relevant to the applicant’s request have been identified.
In light of the above clarifications, I informed the applicant of my view that the HSE had, at that stage taken all reasonable steps to ascertain the whereabouts of relevant records. I invited the applicant to make further submissions if he remained of the view that further relevant records should exist. In his response, the applicant made the following general comments with regard to all three strands of his request. He said that all three individuals referred to are involved in statutory processes and where a clinician who is a regulated professional is in a statutory process, they must inform their employer; in this case the HSE. The applicant said that such records should exist, most likely on the employee’s file. The applicant further said that the HSE is likely to have provided legal advice for some of these professionals and records should exist in relation to this. The applicant added that such records are not likely to be lost or misplaced given the serious nature of the matters.
With regard to the electronic searches undertaken, the applicant queried whether the information provided related to one mailbox folder as its sub-folders or whether it related to separate email accounts. The applicant also referred to two generic email accounts and provided a list of twelve individual staff members and queried whether these generic and individual email accounts had been searched. With regard to a specific staff member, referred to in part (b) of the applicant’s request, the applicant said it was his understanding that this individual had received a new email account and he queried whether this mailbox had been searched. The applicant also queried whether the line managers of the three individuals mentioned in his request were contacted with regard to records within the scope of his request.
With regard to the email accounts of staff no longer employed by the HSE, the applicant said that it was his understanding that ‘the HSE retains access to employee’s email accounts and employee files. It would seem that they have not performed searches in this regard’.
With regard to the NMBI complaint process mentioned in part (c) of his request, the applicant said that he understood that the clinical nurse specialist had accessed his clinical file, copied certain pages of this file and shared them with the NMBI and the individual’s trade union without the applicant’s knowledge or consent. The applicant alleged that records relating these communications should exist and fall within the scope of his request. Finally, the applicant said that it was his understanding that the individual was awarded legal advice by the HSE as part of the NMBI process and there should be file relating to this which would also include details of his complaint.
As indicated above, I provided details of the applicant’s comments to the HSE. In response the HSE provided me with the following information. With regard to the applicant’s comments that records should exist on the respective employee files in relation to the various complaints made by the applicant, the HSE said that any information relating to its staff being in a complaints-related statutory process is the personal information of such staff members within the meaning of section 2 of the FOI Act. It said that such information is inherently personal and private information which would not be released to third parties without the explicit consent of the individuals concerned. The HSE made similar comments in relation to the applicant’s contention that records should exist in relation to NMBI complaint concerning the individual referred to in part (c) of his request. In addition, the HSE also clarified that it does not engage with legal advisers on behalf of a staff member as the onus is on the staff member to source their own legal advice.
With regard to the applicant’s query as to whether two specific generic email accounts had been searched, the relevant email accounts are the administrative email accounts used by the Consumer Affairs team primarily for processing FOI requests/SARs and managing data breaches. The HSE said that bearing in mind the wording of the applicant’s request, there was no logical reason why records relevant to the applicant’s request would be contained in these generic accounts and therefore such email accounts were not searched.
With regard to the specific individual email accounts which the applicant had queried, the HSE said that the specifics of the applicant’s request relates to records created by and concerning three named employees. It said that expanding the search beyond those already contacted within North Lee Mental Health Services risks violating these staff members’ rights to privacy by informing additional employees that they are the subject of complaints to professional bodies. The HSE said that in light of the considerable searches outlined above, it is satisfied that all reasonable searches have been conducted.
With regard to the applicant’s query as to whether one of the staff members referred to in his request was provided with a new email account, the HSE stated that the individual in question only has one email account and the email account referred to by the applicant does not appear on the HSE’s Global Address List. With regard to the applicant’s comments as to whether the line managers of the individuals in question, the HSE once again referred to the specifics of the applicant’s request. It said that the scope of the applicant’s request was such that any records which were identified would have included any correspondence with their respective line managers.
With regard to the applicant’s comments with regard to staff members no longer employed by the HSE, the HSE provided the following information with regard to email account deregistration. It referred to the HSE’s Access Control Policy, available at the following link: Here https://assets.hse.ie/media/documents/ncr/access-control-policy.pdf , and specifically quoted the following extract:
• As soon as a user leaves the employment of the HSE all his/her information systems and network access accounts must be revoked immediately. Line managers must request the deletion of a user’s access accounts as soon as they have been informed by the user that they are leaving the employment of the HSE. The requests must be made in writing using the HSE Suspend / Remove Access Request Form Health Service Executive Access Control Policy Version 3.0 10 February 2013 [internal link provided] and forwarded to the ICT Directorate and 8 the appropriate system administrator(s). The request should be clearly marked ‘Delete User Account’ and made in advance of the users last day.
• System administrators and network administrators must revoke user accounts at the requested date and time after the receipt of a properly completed HSE Suspend / Remove Access Request Form [internal link provided].
In addition, the HSE indicated that its IT Unit had provided the following information:
• Emails on its Microsoft Exchange server are backed up every night, saved to disc in-house for three months then deleted;
• Once a month, a “full back up” is done, copied to tape and sent to a third party offsite for seven years. It is noted that individual mailboxes may be spread across two tapes;
• In order to conduct a search of a tape, the server name, email account, as well as ‘from’, ‘to’, ‘dates’ and ‘subject’ is required;
• The searches are not conducted on-site by the HSE, rather a specialist third party external company would have to be engaged to search relevant identified tape(s), extract information, effectively create a new mailbox, then carry out search for personal data;
• The cost for the third party external company to search one tape is approximately €3,000 and there is no guarantee that the search would be successful;
• The purpose of creating back-up tapes is for use in the event of a disaster, i.e. fire/flood, etc., or cyber-attack where the HSE may need to recover IT systems and the tapes are held off site for added protection.
The HSE said that in light of the above, and due to the fact that the HSE cannot confirm that any data relating to an individual is held on the tapes, it is not possible to search tapes on the system on the off-chance that a name may appear as this would be seen to be excessive and have a disproportionate effect on the resources of the HSE.
With regard to the applicant’s comments referred to above in relation to the NMBI complaint process mentioned in part (c) of his request, the HSE said that the applicant lodged a complaint with the HSE Deputy Data Protection Officer on 26th June 2023 regarding the above allegation. The HSE said that this complaint is under review. It said the application has also made a complaint to the Data Protection Commission. It said the HSE is seeking legal advice in relation to these allegations and the applicant and the DPC have been informed. It said the request currently under review was received on 3rd February 2023, whilst the complaint regarding the alleged data breach was made on 26th June 2023. Therefore, the HSE said that any records created in relation to this alleged data breach are outside the scope of the applicant’s current request.
Finally, the applicant also queried one specific document which he said that the HSE had not identified in this case and which he believes to exist. More particularly, he indicated that it was his understanding that in August 2021 his solicitor contacted the psychiatrist named in the first part of his request in relation to possible wardship proceedings. The applicant said that he considers that this correspondence, and possibly further correspondence relating to this matter should have been identified in this case. When I put the matter to the HSE they provided me with the following information. They said that if a letter had been sent to the psychiatrist named in the first part of the applicant’s request relating to a matter such as wardship, then in line with the National Hospitals Office Code of Practice for Healthcare Records Management (available at the following link: Here https://www.hse.ie/eng/services/publications/hospitals/nho-code-of-practice-for-healthcare-records-management-version-2-0.pdf) correspondence relating to legal issues would not be included in a healthcare file. It further said that the psychiatrist is no longer working with the HSE and therefore it is unable to verify whether any such correspondence was received. In the circumstances it said that it is unable to confirm whether such correspondence ever existed or continues to exist.
In sum, it is the HSE’s position that all reasonable steps have, at this stage, been taken to ascertain the whereabouts of records coming within the scope of the applicant’s requests and that no further relevant records exist or can be found. It is important to note that it is possible, and it is clearly envisaged by the Act, that records may exist, but still may not be found after all reasonable steps have been taken to ascertain their whereabouts. In certain cases, and depending on the circumstances, an FOI body may not be a position to state definitively what happened to the records or why they cannot be found. However, this Office takes the view that, in acknowledgement of the fact that situations can arise where records cannot be found, the FOI Act does not require such certainty. Rather, it requires the body to take all reasonable steps to ascertain their whereabouts. Moreover, the FOI Act does not require an FOI body to continue searching indefinitely for records that cannot be found. We may conclude that an FOI body has conducted reasonable searches even where records were known to have existed but cannot be found.
Having considered the details of the searches undertaken and its explanation as to why no further records exist or can be found, and in the absence of further supporting evidence to suggest that specific additional searches may be warranted, I am satisfied that it has. It seems to me that a thorough search has been undertaken using appropriate search terms and asking the relevant individuals to look for records. I consider that, in relation to the applicant’s FOI request generally, the HSE has provided a reasonable and logical explanation for the lack of additional records, and has provided a clear and adequately detailed explanation of the nature of its systems and processes that accounts for the non-existence of additional records. Clearly, the applicant does not consider such explanations adequate. However, it is important to recall that the test in section 15(1)(a) is whether searches have been reasonable, and this Office does not take the view that the FOI Act requires absolute certainty as to the location of or (as in this case) existence of records.
I am satisfied that, on balance, the HSE has provided a sufficiently detailed and cogent explanation of the relevant searches carried out, and of its storage and retention practices and policies, the account for the lack of records which the applicant asserts should exist. Given the requirements of this test, I consider that the HSE has provided sufficient information to this Office to demonstrate that the steps it took in this case to establish the non-existence of the records sought were reasonable. Specifically with regard to the email account of the staff member no longer working in the HSE, in the circumstances of the case, I do not consider it reasonable to require the HSE to engage a third party specialist external company to conduct searches at considerable cost simply because the applicant asserts that more records should or might exist. In addition, I am also satisfied that with regard to records which may exist on the respective employee files in relation to the various complaints made by the applicant, in keep with previous decisions of this Office, such information would clearly constitute the personal information of such staff members such that section 37 would apply to this information. Finally, with regard to the specific correspondence from the applicant’s solicitor, I accept in the specific circumstances of this case that this record cannot be located following reasonable searches. In any event, it is important to note that the applicant is already in possession of this record as he has supplied it to this Office.
For these reasons, I find that the HSE was justified in refusing to release any further records on the basis that such records do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken.
Accordingly, I find that, the HSE was justified in relying on section 15(1)(a) of the FOI Act to refuse access to any additional records relevant to the applicant’s amended request on the ground that no further relevant records exist or can be found after all reasonable steps to ascertain their whereabouts have been taken.
Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the HSE’s decision.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Mary Connery, Investigator