Decision
Mr X and St Vincents University Hospital
From Office of the Information Commissioner (OIC)
Case number: OIC-139024-S7T0X6
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-139024-S7T0X6
Published on
Whether the Hospital’s refusal of access to an email chain was justified under section 15(1)(a) of the FOI Act (reasonable searches/record does not exist)
1 May 2024
The Hospital and St Vincent’s Private Hospital (SVPH) are part of the St Vincent’s Healthcare Group. SVPH is not an FOI body.
By way of general background to this review, the applicant’s father (Mr Y) was primarily a patient of SVPH. However, the applicant says that his father’s condition was reviewed in a number of Hospital-based multi-disciplinary team (MDT) meetings, which included consultants/personnel from SVPH, and that Mr Y also had lab testing and scans done in the Hospital whilst an SVPH patient. The applicant says that his father also once attended the Hospital’s A&E. I understand that the applicant has complained on behalf of his father about Mr Y’s medical treatment and also raised concerns with the Hospital and SVPH about a particular consultant who works in both locations.
Parts 1, 4 and 7-12 of the applicant’s 17-part correspondence with the Hospital of 27 March 2023 comprised applications under section 10 of the FOI Act for statements of reasons concerning Mr Y’s treatment. My decision in Case No. OIC-139045-K7H9K6 examined the Hospital’s decisions on some of these applications.
The remaining parts of the correspondence of 27 March 2023 sought access to various records. In particular, part 5 sought access to the email chain arising from an email sent by the Director of Quality and Patient Safety (the Director) to a named consultant on 24 May 2022; the consultant’s response; and any correspondence from parties who contacted the Director on the consultant’s behalf. I will not describe the remaining requests for records because, as described below, they do not form part of my review.
The Hospital’s decision of 27 April 2023 granted access to records relevant to parts 2 and 6, and refused parts 3 and 5 on the basis that no records exist (section 15(1)(a)). It said that all records covered by parts 13-17 had already been provided and refused access to further such records on the basis that they do not exist.
The relevant parts of the applicant’s email to the Hospital of 27 April 2023 sought an internal review of the Hospital’s decision on part 5, and asked for further information about the records provided in relation to part 6.
The Hospital’s internal review decision of 22 May 2023 affirmed its refusal of part 5 and noted that, on 28 April 2023, the applicant had withdrawn his query regarding part 6.
The relevant parts of the applicant’s correspondence to this Office of 31 May 2023 sought a review of the Hospital’s decision on parts 2 and 5, and questioned whether the disclosure of personal data in a record relevant to part 6 was contrary to personal data legislation. During the review, the applicant also asked for the records sought at part 3 of his request.
The review was initially assigned to another caseworker, whose letter to the applicant of 11 September 2023 outlined the Hospital’s submission regarding its refusal of part 5. My letter to the applicant of 9 February 2024 summarised the letter of 11 September 2023, and also outlined further information I had since sought from the Hospital on the matter.
I have now completed my review in accordance with section 22(2) of the FOI Act and I have decided to conclude it by way of a formal, binding decision. In carrying out my review, I have had hard regard to the above correspondence, to correspondence between this Office and the Hospital and the applicant, and to the provisions of the FOI Act.
The scope of this review is confined to whether the Hospital’s refusal of part 5 of the applicant’s correspondence of 27 March 2023 is in accordance with section 15(1)(a) of the FOI Act.
As the applicant was informed, the review cannot extend to the Hospital’s decision on parts 2 and 3 because he did not seek an internal review of these matters. He is also aware that that this Office has no remit to deal with his query relating to data protection legislation (part 6). However, the applicant says, in particular, that the review should examine the Hospital’s decision on part 2 of his request. He says that he would have sought an internal review of the matter if he had not been misinformed by the Hospital’s original decision on part 1 (a statement of reasons).
Section 21 of the FOI Act gives FOI bodies the right to review, inter alia, decisions to refuse to grant FOI requests, whether wholly or in part. This is, generally speaking, the internal review process. In turn, section 22(2) of the FOI Act gives the Commissioner the power to review “a decision to which this section applies”. As set out in section 22(1), these are decisions made under section 21 (i.e. internal review decisions), and certain other types of decision that are not at issue here. While I note the applicant’s reason for not seeking an internal review regarding part 2, it remains that the Hospital’s initial decision on the matter has not been subject to an internal review. Accordingly, the matter is not capable of review by this Office.
Finally, as the applicant also knows, this Office has no role in relation to SVPH. Neither have we any remit to investigate complaints, or to adjudicate on how FOI bodies (or their staff) perform their functions generally.
Summary of relevant events
I understand that the Hospital’s Patient Advice and Support Service, which deals with complaints, is part of the Quality and Patient Safety (QPS) department.
To put part 5 of the request in context, it is useful to describe various contacts between the applicant, the Hospital and the consultant. These are as follows:
On 16 May 2022 at 23:50, the applicant emailed the consultant’s SVPH address, and the Hospital’s Patient Advice and Support Service, seeking various information and records relating to Mr Y and raising issues about his care and treatment. The email included the names of both Mr Y and the applicant.
On 24 May 2022 at 17:08, the Director forwarded the email of 16 May 2022 to the consultant’s SVPH email address, and also to the Patient Advice and Support Service’s email address. In particular, the Director asked the consultant whether it would be possible to meet to discuss the applicant’s email. This is the email of 24 May to which part 5 of the FOI request refers.
On 25 May 2022 at 11:54, the Patient Advice and Support Service apologised to the applicant for the delay in acknowledging receipt of the email of 16 May, and said that the Service would “link with” the consultant and reply in due course.
On 25 May at 16:35, the Patient Advice and Support Service emailed the applicant to say that it had been “in contact” with the consultant. The email said it was understood that Mr Y was treated in SVPH. It said that relevant SVPH staff had advised that the consultant had contacted them regarding the applicant’s email. The Service provided contact details for the SVPH, and said that, if the applicant wished, his email of 16 May could be sent on directly.
The application to this Office included a 17-page pdf of assorted emails, including the applicant’s email of 16 May 2022 and the two Patient Advice and Support Service emails of 25 May 2022. The pdf does not include the Director’s email of 24 May 2022.
Section 15(1)(a) – reasonable searches/whether further records exist
Part 5 seeks the email chain/thread that the applicant maintains was created in response to the Director’s email of 24 May 2022. The applicant believes that this record has been deleted. However, the Hospital contends that section 15(1)(a) applies on the basis that the record probably never existed, and that, in any event, it has taken reasonable steps to find it.
Section 15(1)(a) of the FOI Act provides that a request for access to a record may be refused where the record does not exist or where it cannot be found after all reasonable steps to ascertain its whereabouts have been taken. A review of an FOI body's refusal of records under this provision assesses whether or not the FOI body is justified in claiming that it has taken all reasonable steps to locate records of relevance to a request or that the requested records do not exist. It is not normally the function of this Office to look for records.
It should be noted that section 15(1)(a) does not require bodies to search indefinitely for records, or absolute certainty as to the existence or location of records. It is open to this Office to find that an FOI body has satisfied the requirements of section 15(1)(a) where records that an applicant believes ought to exist have not been located.
Arguments made
The applicant is aware of the Hospital’s position that it has no access to patient information or care plans etc. in SVPH and that it has no role in reviewing the care of SVPH patients. The Hospital says that it automatically redirects all complaints relating to SVPH patients to SVPH.
As set out in this Office’s letter to the applicant of 11 September 2023, the Hospital says that the applicant’s email of 16 May 2022 did not say that Mr Y was an SVPH patient. It says that on 24 May, the Director requested a meeting with the consultant to discuss the care provided to Mr Y. It says that it was realised on 25 May that Mr Y was a SVPH patient. The applicant was then advised to contact SVPH about his concerns.
The Hospital says that in making its initial decisions on the request, it consulted with the Patient Advice and Support Service team, the Director’s Executive Assistant (EA) and the Interim Director of QPS. It says that the director drive, the Patient Advice and Support Service drive, and the QPS computer drives were checked. It says that the Director’s EA confirms that she was not aware of any such email chain. It says that it consulted with the consultant and the Director (on leave), and that both confirmed they do not hold any email chain.
The applicant responded to this Office’s letter on 21 September 2023. He queries how the Hospital could quote from the requested email chain, with exact dates, if it does not exist. He gives various details regarding his position that his father was not treated completely in SVPH.
When the case was reassigned to me, I sought further details from the Hospital about its searches, which I then provided to the applicant on 9 February 2024. In summary, the Hospital confirms that it used the applicant’s and Mr Y’s names as search terms (in the format “Last Name, First Name”). The Hospital says that it did not search the consultant’s SVPH computer/drives, or those of her private secretary, because these are outside the remit of the FOI Unit. However, it confirms that the consultant searched their Hospital email account and holds no relevant emails or records. Finally, it says that there are no records of the contact made with the consultant (as referred to in the Patient Advice and Support Service’s email of 25 May 2022), in that the contact is understood to have been verbal.
The applicant’s response to me of 21 February 2024 expresses surprise that the email thread has disappeared and reiterates that the Hospital has quoted from it in official correspondence. He says that the Director’s email did not include either his name or his father’s, even though the email related to them, and that it was also copied to the Patient Advice and Support Service. He says that he expects more on this, and that he was provided with other emails with dates very close to the correspondence he is seeking.
I then asked the applicant for details of the document that he says quotes from the requested email thread. He provided me with a copy of the Director’s email of 24 May 2022. I explained to him that the Hospital had already told me that it had not released this email, because it understood that it was not part of the resulting email chain that had been requested. I reiterated the Hospital’s position that no resulting chain existed i.e. that the Director’s email of 24 May 2022 resulted in verbal contacts of which no notes were taken. I also reiterated the Hospital’s position that, in any event, it had carried out reasonable searches, including of computers in the Patient Advice and Support Service office. Finally, I said that it seemed reasonable to me for the Hospital to use the applicant’s and his father’s names as search criteria. I said here that, while the Director’s email of 24 May 2022 did not cite names, it forwarded the applicant’s email of 16 May 2022 which did contain such details.
In further contacts with me, the applicant says that there is a misunderstanding over what he is looking for. He says that various emails provided to him by the Hospital are not what he seeks, and that they do not include the Director’s email to the consultant of 24 May 2022. He reiterates that he is seeking the chain attached to the Director’s email of 24 May 2022, and all communications afterwards. He says that there is a high possibility of such communications, and disputes that a consultant would respond to the Director’s email by phone. He reiterates that he also asked for correspondence sent on the consultant’s behalf and asks if searches have been carried out for replies sent to the Director by the consultant’s secretary. He also asks for a further search to be carried out using his email address. In addition, he asks for confirmation that all folders, including deleted emails folders, were searched in both the “safety office and Director’s office accounts” and that there is “no way to access deleted emails away from the computers of the Safety Office or the Director’s computers.”
Arising from the applicant’s comments, I made further enquiries of the Hospital. It confirms that it has now conducted further searches of the shared folders in the QPS department (including the Patient Advice and Support Service files/folders) and the Directors Drive. It confirms that both the FOI Liaison Officer and the ICT unit have carried out further searches of all email accounts previously searched (i.e. those of the Director, the Interim Director, and their EA; and those of QPS Admin, the Patient Advice and Support Service and Patient Feedback and Complaints (which is the new name of the Patient Advice and Support Service)). It confirms that the search terms used were the applicant’s email address, and his/his father’s surname in English and Irish (both with and without a fada).
The Hospital also clarifies that its searches of email accounts included the folders for deleted emails. However, it says that deleted emails are retained for 40 days unless a formal request is made for the retention period to be extended, and that no such request was made in this case.
The Hospital also confirms that while the email of 24 May 2022 was sent by the Director “on behalf of” the Patient Advice and Support Service, the particular email account she used is not personal to her. It says that any replies to the email should have been picked up in the searches of Patient Advice and Support Service emails and folders.
The Hospital confirms that it has still not found any records relevant to the request.
Analysis
The issue that I must decide on is whether the Hospital has justified its refusal of access to the requested record (i.e. the email chain arising from the Director’s email to a named consultant of 24 May 2022) on the basis that the chain does not exist, or cannot be found after all reasonable steps to ascertain its whereabouts have been taken.
Having reviewed the Hospital’s submissions, I am satisfied that it has made reasonable enquiries of all relevant parties who might be expected to be aware of or hold the requested record. I am satisfied that it has searched all email accounts and drives where the record might be expected to be held, on a number of occasions. I am also satisfied that the various search terms used were reasonable for the purposes of identifying any replies to the Director’s email of 24 May 2022, whether sent directly by or on behalf of the consultant. I am satisfied as to why the Hospital has not searched any SVPH records. Although unlikely that relevant records would be held in the consultant’s Hospital email account, I note the Hospital’s confirmation that the consultant searched the account concerned.
I note also the Hospital’s position on deleted emails. I do not consider it reasonable to ask the Hospital to explore the possibility of re-generating or re-creating emails deleted between May 2022 to date in order to establish whether these may include the requested email chain.
As outlined earlier, section 15(1)(a) does not require exhaustive searches or certainty as to the existence or whereabouts of a record. While the applicant believes that records should, and must, have been created, this does not give me a basis to require the Hospital to carry out further searches. Having carefully considered the various arguments, I am satisfied from the Hospital’s submission that, in particular, it has taken all reasonable steps to locate the requested record. I find that section 15(1)(a) applies on the basis that the requested record cannot be found after all reasonable steps to ascertain its whereabouts have been taken.
Although not necessary for me to go further, I will also say in light of the Hospital’s understanding that the contact with the consultant (as referred to in the Patient Advice and Support Service’s email of 25 May 2022) was verbal, that I consider it reasonable for the Hospital to contend that the requested record may well not have been created in the first place.
Having carried out a review under section 22(2) of the FOI Act, I hereby affirm the Hospital’s refusal of part 5 of the request under section 15(1)(a) of the FOI Act.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Anne Lyons, investigator