Decision
Ms X and Health Service Executive
From Office of the Information Commissioner (OIC)
Case number: OIC-137944-J9H3R9
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-137944-J9H3R9
Published on
Whether the HSE was justified in refusing the applicant access to her late son’s medical records
3 August 2023
On 3 January 2023, the applicant made an FOI request to the HSE for access to her late son’s medical file. The HSE’s decision of 21 March 2023 referred to Regulations issued under section 37(8) of the FOI Act (access to records of a deceased person) and noted that the applicant was making her request in her capacity as next of kin. It refused the request under section 37(1) of the FOI Act (personal information).
The applicant sought an internal review on 4 April 2023. On 26 April 2023, the HSE affirmed its refusal of her request.
On 2 May 2023, the applicant applied to this Office for a review of the HSE’s decision.
I have now completed my review in accordance with section 22(2) of the FOI Act and I have decided to conclude it by way of a formal, binding decision. In carrying out my review, I have had regard to the above exchanges, and correspondence between this Office, the HSE and the applicant. I have also had regard to the contents of the records at issue, the provisions of the FOI Act and Guidance published in May 2017 by the Minister for Public Expenditure and Reform under section 48(1) of the FOI Act (i.e. Central Policy Unit Notice 25 ).
The scope of this review is confined to whether the HSE’s refusal to grant the applicant’s request was justified under the provisions of the FOI Act.
Release of records under FOI is generally understood to have the same effect as publishing them to the world at large, given that the Act places no constraints on the uses to which the information contained in those records may be put.
Section 13(4) of the FOI Act requires a review to disregard any reasons that an applicant has or may have for making an FOI request. This means that, generally, such reasons can only be taken into account in a review to the extent that they represent a true public interest.
Section 25(3) of the FOI Act requires the Information Commissioner to take all reasonable precautions in the performance of his functions to prevent the disclosure of information contained in an exempt record or that would cause the record to be exempt if it contained that information. This provision has implications for the extent to which I can give reasons for my decision in this case.
Section 37 – personal information
Section 37(1)
Section 37(1), subject to other provisions of section 37, requires the refusal of a request if access to the record concerned would involve the disclosure of personal information (including personal information relating to a deceased individual). Section 2 of the FOI Act defines the term personal information and also lists 14 non-exhaustive examples of what must be considered to be personal information. The examples include (i) information relating to the medical or psychiatric history of the individual.
The requested records relate to the applicant’s son’s medical history. The applicant does not appear to dispute that the records comprise his personal information. For completeness, I am satisfied that they are captured by example (i) above. I find that the mandatory section 37(1) applies.
Section 37(1) requires consideration of other provisions of section 37, however. I will firstly deal with the applicant’s potential right of access to her son’s personal information under Regulations made under section 37(8) of the FOI Act.
Section 37(8) – records relating to deceased persons
Section 37(8) of the FOI Act provides that, notwithstanding subsection (1), the Minister for Public Expenditure and Reform may provide by Regulations for the grant of an FOI request where the individual to whom the record concerned relates is dead and the requester concerned is a member of a class specified in the regulations.
The relevant Regulations in this case are the Freedom of Information Act 2014 (Section 37(8)) Regulations 2016 (S.I. No. 218 of 2016), as amended, (the Regulations). In relevant part, the Regulations provide that, notwithstanding section 37(1), a request for records which involves the disclosure of personal information of a deceased individual shall be granted where the requester is the spouse or the next of kin of the individual and in the opinion of the head, having regard to all the circumstances, the public interest, including the public interest in the confidentiality of personal information, would on balance be better served by granting than by refusing to grant the request.
Under section 48(1) of the FOI Act, the Minister for Public Expenditure and Reform (the Minister) may draw up and publish guidelines for the effective and efficient operation of the Act to assist bodies in the performance of their functions under the Act. Section 48(3) of the FOI Act provides that FOI bodies "shall have regard to" such guidelines when performing their functions under the FOI Act. The Minister has produced guidance relating to section 37(8) and the Regulations, section 3.2 of which lists the following as factors to be considered:
On the matter of where the public interest lies and the factors to be considered, this Office generally has regard to the comments of the Supreme Court in The Governors and Guardians of the Hospital for the Relief of Poor Lying-In Women v. the Information Commissioner [2011] IESC 26 (the Rotunda case). It is noted that a true public interest should be distinguished from a private interest.
On the matter of the type of public interest factors that might be considered in support of the release of the information at issue, I have had regard to the findings of the Supreme Court in The Minister for Communications, Energy and Natural Resources v The Information Commissioner & Ors [2020] IESC 5 (the eNet case). In her judgment, Baker J. indicated that the public interest in favour of disclosure cannot be the same public interest as that broadly stated in the Act. She said the public interest in disclosure must be something more than the general public interest in disclosure and the reason must be found from the scrutiny of the contents of the record. She said there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure.
While the comments of the Supreme Court in both judgments cited above were made in relation to provisions of the FOI Act other than section 37, this Office considers them to be relevant to the consideration of public interest tests generally. However, I also must bear in mind that these comments were made in relation to the requirements of FOI legislation in general and not to the very specific and detailed provisions covering access by next of kin to records of deceased persons.
The Regulations and Guidance make it clear that a range of matters such whether the deceased would have consented to the release of the records to the requester when living, the nature of the records to be released, and "any other relevant circumstances", must be considered. Therefore, notwithstanding section 13(4), matters which may be seen as private interests cannot be excluded solely on the basis that they are not public interest factors.
The parties’ arguments
The applicant says that her son was cared for and got the best of treatment but that obtaining his records may help her understand and process his death. She says that she is not seeking information about other parties.
In inviting the HSE’s submission, I noted that although its initial decision refers to section 37(8) and the Regulations, it does not detail what, if any, consideration was given to these provisions or the Minister’s Guidance. I also noted that the internal review does not refer to section 37(8) and the Regulations at all. In addition, I referred the HSE to various details in the records, which I cannot set out here due to section 25(3), and asked it to comment accordingly.
The HSE says that the next of kin does not have an automatic right of access to a deceased person’s records. In this case, it says that it considered the public interest, including that in preserving the confidentiality of personal information, and the factors set out in the Guidance. It notes in particular that there must be compelling reasons for the disclosure of inherently private and sensitive records such as those at issue. It says that, from a service perspective, it can be inferred that the applicant is already aware of much information about her son’s health because she attended many of his appointments. It says that, while it has great sympathy for the applicant, it does not consider that her stated reasons for making her request are compelling.
The HSE notes the Medical Council’s position that medical information remains confidential even after death and that, if it is unclear as to whether the patient consented to disclosure of information even after their death, it must be considered whether disclosure might benefit or cause distress to family or carers, as well as the impact of disclosure on the reputation of the deceased and the purpose of disclosure. It refers to disclosure under FOI being equivalent to publication to the world at large and is concerned that the information in the records might cause upset to other members of the deceased’s family.
The HSE says that the information was given in confidence by the applicant’s son, to whom it owes an ongoing duty of confidentiality. It says that, while the applicant was present for some of her son’s consultations, there is no indication in the records that he would have consented to the release of his personal information.
The HSE is also of the view that, because the applicant was present at her son’s final consultation, she was aware of all relevant information about his health at that time. It says that, because the records do not extend to when the applicant’s son died, their disclosure would not provide her with any information about his health at that particular time.
I will deal firstly with the HSE’s concern that granting the request effectively discloses the records to the world at large. This is true of all records released under FOI regardless of the identity of the requester, including where the requester seeks access to his or her own personal information. However, the Oireachtas has determined that access to records of deceased persons shall be granted to certain categories of requesters, provided the requirements of the Regulations have been met. Accordingly, I do not accept that the fact that disclosure of records under FOI is without any restriction is a reasonable ground for refusing the applicant’s request.
Noting the content and nature of the records, I accept that they are very sensitive, private and confidential. The HSE also maintains that there are no compelling reasons favouring their release because of the applicant’s extent of knowledge about her son’s care, and that because of the timeframe they cover, disclosure may not give her any better understanding of her son’s death. However, while the HSE appears to attach considerable weight to these factors, it does not explain why it considers them overall to outweigh other factors appearing to support release.
Neither the Regulations nor the Guidance require the applicant to provide evidence that her son would have consented to release of the records to her while he was alive. The records do not deal with this matter explicitly. However, it seems reasonable to me to draw conclusions from their contents. The HSE does not refer me to, nor can I identify, any details therein supporting its view that the applicant’s son would not have consented. Furthermore, although invited to, the HSE did not comment on various excerpts of the records to which I referred it. It seems to me that these, and other details in the records, support a contrary conclusion to the HSE’s i.e. that the applicant’s son would have consented to release to her of his records.
I am also satisfied that the contents of the records do not indicate any concerns regarding the nature of the relationship between the applicant and her son or the circumstances of their relationship before his death. The HSE does not comment on the details to which I referred it in this respect. Moreover, neither does it express any concerns about their relationship or refer me to any relevant details. Similarly, while I note the HSE’s concerns over release potentially damaging the patient’s reputation and upsetting other family members, it did not address my observations on certain details that would also appear relevant in considering these issues.
The public interest in protecting the right of privacy of persons, including deceased persons, is expressly stated in section 37 and also in the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). In addition, the 37(8) Regulations recognise the public interest in maintaining the confidentiality of personal information relating to a deceased individual.
On the other hand, the records provide information about the HSE’s performance of its functions in relation to the applicant’s son. The applicant does not dispute the quality of treatment afforded to her son. The HSE’s position is that the applicant is aware of the relevant details due to her attendances with him at various appointments, including when he discharged himself. Nonetheless, it could be argued that only by having all relevant documented information available could the next of kin of a deceased person draw informed conclusions regarding that person’s medical treatment.
Having carefully considered the parties’ arguments, the contents of the records, and all of the circumstances, on balance I am satisfied that the public interest would be better served by granting than by refusing to grant the request. I find that the applicant is entitled to access to her son’s personal information further to the Regulations made under section 37(8) of the FOI Act.
Section 35 - confidential information
The HSE says that the records contain information given in confidence by the applicant’s son and are subject to an ongoing duty of confidentiality. While it does not rely on the relevant FOI provision (section 35 of the FOI Act) or make any detailed arguments, I will consider the application of section 35 for completeness.
In essence, section 35(1) of the FOI Act requires the refusal of information given in confidence (section 35(1)(a)) and information that is subject to a duty of confidence (section 35(1)(b)). Where the relevant records were created by an FOI body, section 35(2) is also relevant.
Section 35(2) provides that section 35(1) shall not apply to a record which is prepared by a staff member of an FOI body in the course of the performance of his or her functions unless disclosure of the information concerned would constitute a breach of a duty of confidence that is provided for by an agreement or statute or otherwise by law and is owed to a person other than an FOI body or its staff.
All of the records at issue here were created by the HSE in the course of treating the applicant’s son. As noted, the HSE considers itself to owe the applicant’s son an ongoing duty of confidentiality regarding his medical records. It does not identify any agreement or statute that might provide for a duty of confidence, nor am I aware of any that may be relevant to my review. However, a duty of confidence provided for “otherwise by law” is generally accepted to include an equitable duty of confidence (also known as a duty of confidence arising in equity). This Office accepts that section 35(1)(b) comprehends the breach of an equitable duty of confidence.
In the Supreme Court decision in the case of Mahon v Post Publications Ltd [2007] 3 I.R. 338 Fennelly J. confirmed that the requirements for a successful action based on a breach of an equitable duty of confidence, at least in a commercial setting, are found in the judgment of Megarry J. in Coco v. A. N. Clark (Engineers) Ltd. [1969] R.P.C. 41, at 47:
“First, the information itself ... must 'have the necessary quality of confidence about it'. Secondly, that information must have been imparted in circumstances importing an obligation of confidence. Thirdly, there must be an unauthorised use of that information to the detriment of the party communicating it."
Fennelly J. summarised or restated the requirements of what he called “the contours” of the equitable doctrine of confidence as follows:
1. the information must in fact be confidential or secret: it must ... “have the necessary quality of confidence about it”
2. it must have been communicated by the possessor of the information in circumstances which impose an obligation of confidence or trust on the person receiving it;
3. it must be wrongfully communicated by the person receiving it or by another person who is aware of the obligation of confidence.
Previous decisions from this Office have adopted the above approach in considering whether disclosure of information would constitute a breach of an equitable duty of confidence.
I accept that the first two tests above are met. As already set out, I accept that the records contain confidential information about the applicant’s son’s medical history and treatment. I also accept that he would have understood and expected that such information would be treated by the HSE as confidential.
However, I am not satisfied that the third test is met. Section 37(8) and the Regulations provide for a process under which personal information of deceased persons may be released to certain specified classes of person in certain circumstances i.e. they provide for a limited breach of a duty of confidence. Previous decisions from this Office have taken the view that to invoke section 35 in relation to personal information which is otherwise releasable by virtue of section 37(8) is at odds with the intent of the FOI Act. Given the express provisions in the Regulations regarding the granting of access to a deceased individual’s personal information to the particular classes of individual set out, I do not accept that such disclosure would be unauthorised.
The possibility of detriment to a deceased person is not a settled area of law. However, in the circumstances of this case, it does not seem to me that an authorised disclosure to the applicant, as next of kin of her son in accordance with a statutory provision, could be to her son’s detriment. As has been said in other decisions made by this Office, if it was the case that all medical records were to be exempt from disclosure on the basis that their release would constitute a breach of confidence, the provisions of the Regulations and section 37(8) would be made redundant.
Furthermore, and as noted above in my analysis under section 37(8), the records contain various facts and details that I brought to the HSE’s attention and on which it did not comment. I cannot describe the details here because of section 25(8). However, in my view, such details also give me a basis to be satisfied that the release of the records to the applicant would not involve an unauthorised use of the information to her son’s detriment.
Accordingly, I find that disclosure to the applicant of her son’s personal information would not give rise to a breach of a duty of confidence owed to him. Further to the provisions of section 35(2), I find that section 35(1) does not apply.
Third party information
The HSE notes that the records also contain personal information relating to parties other than the applicant and/or her son. I accept that the records contain a number of references to third parties. While the applicant is not seeking information about parties other than her son, it is important to note that the Regulations do not entitle the applicant to such information in any event.
Given that this Office is not a first instance decision maker, I do not consider it appropriate for me to go on to determine the precise extent to which the records contain third party information. It seems to me that, in the circumstances, the most appropriate decision for me to make is to annul the HSE’s refusal of the applicant’s request, and to direct it to release the records subject to the redaction of any personal information therein about parties other than the applicant and/or her late son. For avoidance of doubt, the applicant would have the usual rights of review in relation to the extent of the HSE’s redactions.
Having carried out a review under section 22(2) of the FOI Act, I hereby annul the HSE’s decision. I direct it to grant access to the records subject to the deletion of personal information therein about parties other than the applicant and/or her son.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Anne Lyons, Investigator