Decision
Mr. X and Health Service Executive
From Office of the Information Commissioner (OIC)
Case number: OIC-155793-F2V2Q6 and OIC-155794-Q3K5T5
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-155793-F2V2Q6 and OIC-155794-Q3K5T5
Published on
Whether the HSE was justified in refusing the applicant’s request for access to records relating to a complaint he made concerning his mother’s care and to a clinical file concerning his mother’s care
06 February 2026
This review concerns two related FOI requests which the applicant submitted to the HSE in June 2024. The applicant made a single application to this Office in respect of both requests and the issues to be considered in both requests overlap to a significant extent. I will, therefore, consider both requests in a single review decision.
In a request dated 4 June 2024, the applicant sought access to all relevant communications, meeting notes, records, and documentation related to a complaint he raised concerning his mother’s care and specifically involving a number of named doctors, a nurse and other named individuals.
In a second request dated 19 June 2024, he sought access to all information pertaining to his mother’s clinical file as shared with a named doctor as part of his internal review of his complaint. On 18 July 2024, the applicant requested the HSE to carry out internal reviews of both his requests as it had failed to issue original decisions.
On 26 July 2024, the HSE issued separate internal review decisions in relation to each of the applicant’s two FOI requests. In both decisions, the HSE’s internal reviewer stated:
“The records which you are seeking relate to personal information of another person, and having regard to the request, the records in question are considered to hold exceptionally personal, sensitive information. While I understand that a form of consent of this person has been previously provided, I must draw your attention to the fact that, having considered the type of records which you are seeking, I consider that the consent required needs to be much more explicit, and must demonstrate that the person is aware of the nature of the records which may be disclosed as part of this request. As an internal review decision maker, I am obliged to ascertain your authorisation from the person to whom the records relate. As contact with the person to whom the records relate has not been possible, I must conclude that valid consent has not been established and I am refusing your application on this basis.”
On 26 January 2025, the applicant submitted a single application to this Office seeking a review of both of decisions. During the course of the review, this Office provided the parties with an opportunity to make submissions. In its submissions, the HSE said that it was refusing access to the records relevant to the applicant’s first request for complaint related records on the basis that they contain third party personal information and valid consent was not provided and it said it was refusing access to records relevant to the applicant’s second request for clinical file records under section 15(1)(i) of the FOI Act on the basis that these records are already available to the applicant. This Office updated the applicant in relation to the HSE’s submissions, and the applicant provided his comments and observations in reply.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to the submissions made to date. I have also had regard to the contents of the records concerned. I have decided to conclude this review by way of a formal, binding decision.
This review is concerned with whether the HSE was justified in refusing access to records relevant to the applicant’s first FOI request for complaint related records under section 37(1) of the FOI Act records on the basis that the records contain the personal information of a third party and valid consent was not provided for their release and whether it was justified in refusing access to records relevant to the applicant’s second request under section 15(1)(i) of the FOI Act on the basis that the records are already available to the applicant.
Before I address the substantive issues arising, I wish to address a number of preliminary matters.
Firstly, in his application to this Office, the applicant has raised a number of concerns in relation to how the complaint handling process was conducted by the HSE. He said that through a previous FOI request and a recent GDPR request, he had become aware of key evidence and information missing from the complaint file. He argued that based on documents provided to him, it appeared that key material including opposing clinical opinions may have been removed or excluded. He said missing information includes multiple consultants’ conflicting opinions that appears to have been removed or excluded from the file said and he said he had concerns that members of staff who were involved in managing the complaint file were also involved in managing his FOI request.
On the matter of how the complaint process was handled by the HSE, this Office has no remit to investigate complaints, to adjudicate on how FOI bodies perform their functions generally, or to act as an alternative dispute resolution mechanism with respect to actions taken by FOI bodies. As such, while it is clear that the applicant is dissatisfied with the manner in which the HSE dealt with him and his complaint, this Office has no role in examining the appropriateness of those actions. This review has been conducted under section 22(2) which means that it is concerned solely with a review of the decisions taken by the HSE on the applicant’s FOI requests.
Secondly, section 13(4) of the FOI Act provides that in deciding whether to grant or refuse a request, any reason that a requester gives for his or her request shall be disregarded. This means that this Office cannot have regard to the applicant's motives for seeking access to the information in question, except in so far as those motives reflect what might be regarded as public interest factors in favour of release of the information where the Act requires a consideration of the public interest.
The HSE has refused access to the applicant’s first request for complaint file records under section 37 of the Act. It argues that valid consent was not provided for the release of these records by the applicant.
Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the records concerned would involve the disclosure of third party personal information. Personal information is defined in section 2 of the FOI Act as information about an identifiable individual that either (a) would in the ordinary course of events be known only to the individual or members of the family or friends of the individual, or (b) is held by an FOI body on the understanding that it would be treated by that body as confidential. Section 2 also details 14 specific categories of information which is personal without prejudice to the generality of the foregoing definition, including, but not limited to (i) information relating to the educational, medical, psychiatric or psychological history of the individual. I have carefully examined the complaint file records provided by the HSE to this Office for the purpose of the review. I accept the HSE’s position that the records contain exceptionally sensitive personal information. The records include detailed information concerning the medical, psychiatric or psychological history of the applicant’s mother. I find that section 37(1) applies to the complaint file records at issue. However, section 37(1) is subject to the other provisions of section 37, which I will examine below.
Section 37(2) provides for a number of circumstances in which section 37(1) does not apply. Section 37(2)(b) provides that the section 37(1) does not apply if any individual to whom the information relates consents, in writing or such other form as may be determined, to its disclosure to the requester. Where a consent is provided to the FOI body, subsection (2) provides that the FOI body must ensure that the consent of the individual is established to its satisfaction before the request is granted. The Commissioner takes the view that, generally speaking, it is not appropriate for his Office to approach third parties to seek their consent to the release of their personal information. Where it is argued that consent has been given, the relevant terms and the circumstances need to be considered, including whether the terms of the consent cover all of the records at issue.
The HSE says it previously received an FOI request from the applicant for access to records in a complaint file related to his mother. The applicant appealed its decision in that case to this Office and the reference number for that decision is OIC-150549-R2B7Z0. The HSE says following receipt of that FOI request which was dated 22 December 2023, the decision maker had a number of interactions with the applicant seeking his mother’s consent for the processing of the request. It says a digital copy of his mother’s consent was then provided. It says that the consent did not reference the FOI Act and was dated 10 November 2022 and was signed by the applicant on 11 September 2022. It says at the time the decision maker accepted this consent.
The HSE says that subsequent FOI requests were received on 4 June 2024 (OIC-155793-F2V2Q6) and 19 June 2024 (OIC -155794-Q3K5T5). It says both requests were processed as internal reviews due to non-response. It says the request from 4 June was refused on 26 July 2024, as the decision maker was not satisfied valid consent was provided. It says the second request of 19 June 2024 was refused on 26 July 2024. It says this second request contained a typed, undated authority signed by the applicant’s mother and the decision maker was again, not satisfied that valid consent had been provided.
The HSE says both of the above internal review decisions are based on the following. In June 2024, the applicant’s mother was invited to a meeting arranged by the Head of Mental Health Services. It says the purpose of this meeting was to meet with the applicant’s mother to validate consent to progress an external review of a complaint and also the FOI requests received in June 2024. The HSE says the applicant attended this meeting but his mother did not attend. The HSE says a subject access request under Article 15 of the GDPR was received from the applicant on the 04 November 2024. It says the same authority was provided as per the above FOI request. It says a letter issued to the applicant’s mother on the 17 December 2024 seeking verification of consent. It says no response was received. The HSE says it has not been provided with any evidence of a Health Care Directive or decision making representation. It says it has no knowledge of the applicant’s mother’s capacity as she is not in attendance with the service in the duration of all of the above interactions.
As outlined above, this Office provided the applicant with an update following the HSE’s submissions. The applicant says the HSE’s submission relies heavily on his mother’s non-attendance at a meeting on 24 June 2024. He says the meeting was not about FOI consent and no FOI consent objection was raised at the meeting.
I note from this Office’s review in case 150549 that clarity was sought from the HSE on why personal and private medical information related to the applicant’s mother was released and only references to her name and identifiers withheld. In particular, the Investigator queried how the HSE could argue that having released the majority of information related to the applicant’s mother’s diagnosis apart from references to “her” or “mum”, the HSE could argue that it was challenging the consent provided. The Investigator noted that the HSE had argued that the release of this personal medical information at original decision stage was a mistake, and that in relation to later FOI requests, it did not consider the consent valid nor did it release the information in question. For the purposes of the review in case 150549, the Investigator took the view that the remaining information in the records related to the applicant’s mother, did not go any further in identifying her, considering the information which had already been released. Based on that, it was the Investigator’s view that it is reasonable to find that access to the remaining redacted information would not involve the disclosure of personal information as such information had already been disclosed and should be released on that basis. Accordingly, the Investigator was of the view that the question of consent was not entirely relevant to the matter before her based on the HSE’s release of sensitive medical information related to the applicant’s mother.
The Investigator noted that the applicant had other appeals before this Office and the HSE has stated that in relation to those appeals it has not validated the applicant’s mother’s consent, nor has it released the information concerned. The Investigator stated that her finding in that case should not of itself, prejudice any argument the HSE may want to make in subsequent reviews regarding its concerns around the consent given and those arguments should be adjudicated on accordingly.
I note that in this case, the applicant provided the following written consent with his second FOI request of 19 June 2024:
“I (applicant’s mother) hereby authorise my son (son’s name) to request and obtain medical records and information pertaining to my care and any related complaints, including but not limited to requests made under the FOI laws or regulations. This authorisation extends to all healthcare providers involved in my treatment and includes access to any relevant documentation necessary for understanding and addressing my medical needs and concerns (signed by the applicant’s mother).”
As outlined above, where it is argued that consent has been given, the relevant terms and the circumstances need to be considered, including whether the terms of the consent cover all of the records at issue. It seems to me that the terms of the consent do cover the records at issue. In terms of the circumstances in which consent was given, the HSE says it has no knowledge of the applicant’s mother’s capacity as she was not in attendance with the service for the duration of the above interactions. The HSE says it arranged for an in-person meeting with the applicant and his mother prior to issuing its internal review decision and the applicant’s mother did not attend. The applicant however disputes that the purpose of this meeting was to validate consent. I have not been provided with the meeting invite or other documents which show that the purpose of this meeting was to validate consent in relation to the FOI requests made in June 2024.
It is regrettable in my view that the HSE did not issue original decisions following either FOI request. Had it issued decisions outlining the concerns it had in relation to validating whether the applicant’s mother had capacity to give consent, this could have given the applicant an opportunity to address those concerns. It is also noteworthy that while the HSE refused both FOI requests on grounds it was unable to validate consent, it says a subject access request under the GDPR was received from the applicant on 04 November 2024 and the same authority was provided as per the above request and the HSE did release records clinical records relating to the applicant’s mother following that subject access request.
Having regard to the circumstances of this case, I do not accept that the HSE was justified in refusing the records on the basis that they contain personal information and the individual to whom the records relates has not consented to their release to the requestor. I do not, however, consider it appropriate to simply direct the release of the records, given the highly sensitive personal information contained in them. Instead, I find that the most appropriate course of action is to annul the HSE’s decision on the applicant’s request dated 4 June 2024 and to direct it to conduct a fresh decision-making process in respect of any records relevant to that request.
I would encourage the HSE to communicate any concerns it has in relation to consent to the applicant in writing and to give the applicant an opportunity to address those concerns.
Section 15(1)(i) of the FOI Act provides for the discretionary refusal of a request where the request relates to records already released, either to the same or a previous requester and where the records are available to the requester concerned. For the section to apply, the FOI body should be in a position to show that (i) the records sought were already released and (ii) they are available to the requester.
In its submissions, the HSE says they have received the necessary authorisation from the applicant’s mother via her Solicitor seeking her Clinical Medical Charts under a subject access request in accordance with the GDPR. It says the subject access request was processed and issued via her Solicitor on the 15 September 2025. It says the applicant’s mother is now in receipt of her clinical records and therefore section 15(1)(i) applies.
The applicant says under section 15(1)(i), the HSE must demonstrate that the records previously released are: 1. identical in substance, 2. complete, and 3. contemporaneous with the records actually supplied to the named Doctor for the internal clinical review. He says the subject access request records issued in 2025 and reflect a different point in time from the internal clinical review carried out years earlier. He says there is no evidence documentary or otherwise that the SAR bundle: is identical to the file reviewed by the named Doctor, contains the same records, contains only the records available at that earlier time.
The applicant’s second request is for “all information pertaining to his mother’s clinical file as shared with a named doctor as part of his internal review of his complaint.” As outlined above, he believes certain clinical records were removed from the file provided to that doctor. He worded his request to include only those records that were shared with the named Doctor.
Generally, if a body wishes to refuse a request under section 15(1)(i) I would expect it to be able to show that the records sought were previously released to the requester and to explain why it considers that they are available to the requester concerned. While the HSE has provided a schedule with the clinical file records provided to this Office, it has not provided a schedule of the records released following the subject access request. This would have allowed for both schedules to be compared to confirm that these records were already released. On the basis of the information provided by the HSE, I cannot be satisfied that section 15(1)(i) applies to the applicant’s second request and I find accordingly.
I do not consider it appropriate to simply direct the release of the clinical file records, given the nature of these records. I find that the most appropriate course of action is to annul the HSE’s decision on the applicant’s request dated 19 June 2024 and to direct it to conduct a new decision-making process in respect of any records relevant to that request.
Having carried out a review under section 22(2) of the FOI Act, I hereby annul the HSE’s decision to refuse the applicant’s requests under sections 37 and 15(1)(i) of the Act and I direct it to consider the applicant’s requests afresh.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal, normally on a point of law, must be initiated not later than four weeks after notice of the decision was given to the person bringing the appeal.
Jim Stokes
Investigator