Decision
Mr S and Health Service Executive
From Office of the Information Commissioner (OIC)
Case number: OIC-153676-T5Y7H1
Published on
From Office of the Information Commissioner (OIC)
Case number: OIC-153676-T5Y7H1
Published on
Whether the HSE was justified in refusing access to further records relating to the applicant’s medical file on the grounds that no further records exist or can be found under section 15(1)(a) and in redacting certain information from the records released under section 37(1) of the FOI Act
25 October 2025
In a request dated 28 March 2024, the applicant submitted an FOI request to the HSE wherein he requested that he be given an opportunity to read his file and that a copy of the file be provided to his GP. He explained that a recent request he had made to read his file had been refused.
In its decision dated 17 April 2024, the HSE granted access to 111 pages of records contained on files held by its Mental Health Services, with redactions made to certain records under sections 35(1)(a) and 37(1) of the FOI Act. The applicant sought an internal review of that decision. He said the records released did not include anything in the past three years. He said wanted access to everything in his file. He also said he wanted a copy of his file to be sent to his GP.
On 05 June 2024, the HSE issued a response in which it said the request had been processed under the General Data Protection Regulation (GDPR) and that it had been decided to part-grant the request.
On 11 June 2024, the applicant contacted this Office. He said that following his application for internal review, he was given a file which was more recent but that pages were left blank and parts were still redacted. He also said that certain records were missing, including medical reports and copies of prescriptions. He queried why the HSE had processed his application for internal review under GDPR. He also said he was requesting everything in his file, including but not limited to his A&E notes from doctors at Beaumont, prescriptions, and notes taken during his GP’s appointments.
This Office contacted the HSE and asked it to issue its effective position on the applicant’s application for internal review that he had made under the FOI Act. The HSE issued its effective position on the request by letter dated 16 July 2024, wherein it said it had decided to vary the original decision and to part-grant the majority of the records and additional records. The accompanying schedules of records provided included 57 additional records containing 258 pages.
It cited section 37(1) of the Act as the basis on which certain information was withheld. On 13 November 2025, the applicant applied to this Office for a review of the HSE’s decision. He remains of the view that the HSE did not release all relevant records and believes that the HSE was not justified in redacting certain records.
I have now completed my review in accordance with section 22(2) of the FOI Act. In carrying out my review, I have had regard to correspondence between the applicant and the HSE as outlined above and to correspondence between this Office and both the applicant and the HSE on the matter. I have also had regard to the contents of the records at issue. I have decided to conclude this review by way of a formal, binding decision.
The applicant is of the view that the HSE holds further relevant records coming within the scope of his request. The HSE’s position is that all relevant records have been identified for release. This is, in essence, a refusal to provide further relevant records pursuant to section 15(1)(a) of the FO Act which provides for the refusal of a request where the records sought do not exist or can be found.
Accordingly, the scope of this review is concerned with whether the HSE was justified in refusing access, under section 15(1)(a) of the FOI Act, to any further relevant records coming within the scope of the applicant’s request, and in redacting certain information from a number of the released records under section 37(1) of the FOI Act on the basis they contain third party personal information.
During the course of the review, this Office sought to establish why the HSE decided to issue a decision under data protection legislation upon receipt of an application for internal review of a decision made under the FOI Act. While the HSE was not in a position to explain why it did so, it is apparent that this was simply a mistake. Nevertheless, it is a mistake which has serious consequences for an individual’s ability to exercise his/her rights under the FOI Act which, as the HSE is fully aware, are wholly separate to, and independent from, any rights afforded under data protection legislation. I trust the HSE will take measures to ensure that no such similar mistake is made in the future.
Section 15(1)(a) of the FOI Act provides for the refusal of a request where the records sought do not exist or cannot be found after all reasonable steps to ascertain their whereabouts have been taken. Our role in a case such as this is to review the decision of the FOI body and to decide whether that decision was justified. This means that I must have regard to the evidence available to the decision maker and the reasoning used by the decision maker in arriving at their decision and also must assess the adequacy of the searches conducted by the FOI body in looking for relevant records. The evidence in “search” cases generally consists of the steps actually taken to search for the records along with miscellaneous and other information about the record management practices of the FOI body, insofar as those practices relate to the records in question.
During the course of the review, the Investigator asked the applicant to provide submissions as to the records he believed to be missing from the records released. In response, the applicant referenced “return to study” forms and “prescription records”, namely written recommendations by medical practitioners for specific prescriptions for his GP. This Office sought submissions from the HSE concerning the searches undertaken for relevant records and its record management practices insofar as they relate to the type of records sought in this case. We also sought its comments in respect of the particular records referenced by the applicant.
In its submissions, the HSE said that the records consist of two volumes of records totalling 369 pages. It said the records document the care and treatment of the applicant both as an inpatient and outpatient of its service. It said the records include detailed documentation of interactions with the applicant including a treatment plan, medications, blood test results and correspondence with his G.P. It said the records are typical of the records held for any service user in receipt of care from its mental health services. It said all notes/updates, correspondence received or issued by the multi -disciplinary team with responsibility for the applicant would be filed and documented in his clinical file. It said the clinical file for the applicant’s care would be created by the administration staff at first appointment with the service and updated accordingly. It said a reference to the file is maintained in the Database/Register of Service Users attending the relevant Community Mental Health Team (CMHT). It noted that active records are maintained securely onsite by the CMHT, locked and stored in a secure area.
With respect to its relevant filing systems, the HSE said that the applicant’s files are physical paper-based charts and that they are stored and locked in a secure area and held in compliance with GDPR requirements. It noted that while actively in use, files are held onsite in the relevant CMHT. It said patient files remain onsite for approximately 12 months following discharge and are then transferred to an archive facility. It said the Medical Records Department maintains a Database Register for documenting all archived records. It said the Register includes searchable fields such as Surname, first name, Address, date of Birth (DOB), Box number and Rack Number. It said the key words/identifiers used as part of any search to locate records of any service user in archive and used as part of any search to locate records for any service user in archive and used in the applicant’s case would be DOB, Surname, First Name and Address. It said the Medical Records Department’s Database Register serves as the official record of all archived files. It includes detailed identifying information and physical storage location within the archive.
The HSE said that searches were undertaken in the specified Primary Care Centre, which involved a physical search of the patient’s files stored onsite in the secure records room, and in the administrative offices responsible for patient records and correspondence. It said the searches comprised manual inspection of physical paper files relating to the applicant’s care during the relevant periods (2022 and 2023) and that this included all volumes of the clinical records, correspondence, and related documentation held onsite and in the archive. It said searches were also undertaken at the Medical Records Department Archive Facility and that the electronic databases and Registers used by the Medical Records Department were searched, along with the Database Register of archived records, using the applicant’s name, date of birth address, and relevant keywords such as “return to study”, £prescription” and “medical recommendation”
The HSE said that the searches were conducted manually by records staff and clinical administrators experienced in the filing system. It said electronic searches were conducted using the database’s search functions with specific identifiers and keywords. It noted cross referencing of physical file locations with the database records was performed to rule out misfiling. It said that additional inquiries were made into adjacent filing areas and temporary storage locations at the Primary Care Centre to account for potential misfiling or misplaced documents. It said the Medical Records Department also reviewed offsite archival storage and backup systems. The HSE said that no evidence was found to suggest that the requested records were misfiled or located elsewhere.
The HSE said that key administrative and clinical staff responsible for maintaining and handling the records at the relevant Primary Care Centre were consulted. Medical Records Department personnel responsible for archive management were also engaged and all consulted parties confirmed the absence of the additional records in question after their own searches and review.
The HSE said that its position is that the specific “return to study” forms for 2022 and 2023 and “prescription records” were never created or received as part of the applicant’s clinical records held by the HSE. It noted that during the FOI process, the FOI Decision maker consulted with the applicant’s Consultant Psychiatrist, who said they had no recollection of signing any return to study forms apart from those in 2021/2022 which were released with the original FOI as records 44-47. The HSE said that the administrative and clinical procedures for managing patient care within the CMHT do not include the creation or retention of separate “return to study” forms unless specifically initiated by an applicant or requested by clinical staff, which it said is not the case here. It said that “prescription records” as defined by the applicant – written medical recommendations for prescriptions to the G.P., are held by the G.P. and not retained with the Mental Health service file. The HSE said that there is no evidence to suggest that any such records once existed and were subsequently destroyed. It noted the records management policies in place would have required documented authorisation for destruction, which it said does not apply in this case.
The Investigator provided the applicant with details of the HSE’s submission. In response, the applicant clarified that the prescription records sought would be held in a prescription booklet used to write recommendations for prescription’s and is dual layered. He said it traces the handwriting of the Psychiatrist as they write. With respect to the return to study records, the applicant said that a copy of his 2023 form, which he obtained from a university, has ‘file copy’ written at the top of the form. He said he received a photocopy (stamped again) of this form from the HSE after the original was misplaced by the Primary Care Centre.
The Investigator put the applicant’s response to the HSE. In response, the HSE said that scripts are issued from a prescription pad which is numbered and strictly controlled. The HSE said that the ‘white copy’ may be given to the patient or forwarded directly onto their pharmacy for dispensing depending on position of the patient clinically. It said that the ‘pink copy’ which is marked “do not dispense” is retained in a folder at the back of the service user’s medical file. It said it is the clinical view that the ‘pink copies’ of prescriptions are not given out as copies to service users so as to avoid any inappropriate use. It noted that a service users’ medication is referenced in the notes under “plan” at the end of each review/consultation. The HSE also set out its views as to why it believes it is not in the public interest to release the prescription records in question. It said return to study forms relate to academic institutions and are not relevant to health care files. It said it has no responsibility to retain such forms.
It is possible, and it is clearly envisaged by the FOI Act, that records may exist, but still may not be found after all reasonable steps have been taken to ascertain their whereabouts. The FOI Act does not require absolute certainty as to the existence or location of record. What section 15(1)(a) requires is that the FOI body takes all reasonable steps to locate relevant records.
In essence, the HSE’s position is that all relevant records it holds in relation to the applicant would be located on his file, apart from the prescription records that it holds separately as described above. Prescription records aside, no evidence has been presented to this Office to suggest that other relevant records might be held in other locations within the HSE. As such, having regard to the HSE’s description of its record management practices and of the searches it actually undertook to locate relevant records, I am satisfied that the HSE has, indeed, taken all reasonable steps to locate the records that would generally be held on the applicant’s file.
On the other hand, while I accept that the applicant’s request was for a copy of his file, he made it clear in his application for internal review that he had also expected to be given access to the prescription records. I do not consider this to comprise a broadening of the request. Rather, it was a clarification of the type of records the applicant assumed would be held on his file and to which he required access. As such, I believe that that the HSE should have considered the prescription records in the course of carrying out its internal review.
I note the HSE’s submissions that the public interest would not be served by the release of such records. Nevertheless, the fact remains that it did not consider those records during the processing of the applicant’s request. Accordingly, I simply cannot find that the HSE has taken all reasonable steps to ascertain the whereabouts of all relevant records coming within the scope of the request. I consider that the most appropriate course of action for me to take is to annul the HSE’s effective reliance on section 15(1)(a) in refusing access to further records in so far as it relates to the prescription records in question. The effect of this is that the HSE must consider the applicant’s request afresh and make a new, first instance decision in respect of those records in accordance with the provisions of the FOI Act. The applicant will have a right to an internal review and a review by this Office if he is not satisfied with the HSE’s fresh decision.
Section 37(1) of the FOI Act provides that, subject to the other provisions of the section, an FOI body shall refuse a request if access to the record concerned would involve the disclosure of personal information. This does not apply where the information involved relates to the requester (section 37(2)(a) refers). However, section 37(7) provides that, notwithstanding section 37(2)(a), an FOI body shall refuse to grant a request if access to the record concerned would, in addition to involving the disclosure of personal information relating to the requester, also involve the disclosure of personal information relating to an individual or individuals other than the requester (commonly known as joint personal information). Essentially, this means that while section 37(1) does not provide a basis for refusing access to personal information that relates solely to the requester, the request shall be refused if that personal information is inextricably linked to personal information relating to parties other than the applicant. Section 37(1) is subject to sections 37(2) and 37(5).
Having reviewed the records, I am satisfied that all of the information withheld comprises either personal information relating solely to other third parties, such as addresses and/or telephone numbers, or joint personal information relating to the applicant and other third parties. Some of the records include clinic notes, checklists, progress notes, discharge forms, referral forms, care plans and safety plans containing information provided by third parties to support the applicant and give a greater understanding to the medical clinicians treating the applicant with his medical needs. I find, therefore, that section 37(1) applies to all of the redacted information. However, that is not the end of the matter as section 37(1) is subject to the other provisions of section 37, which I examine below.
Section 37(2) provides that section 37(1) does not apply if:
(a) subject to subsection (3), the information concerned relates to the requester concerned,
(b) any individual to whom the information relates consents, in writing or such other form as may be determined, to its disclosure to the requester,
(c) information of the same kind as that contained in the record in respect of individuals generally, or a class of individuals that is, having regard to all the circumstances, of significant size, is available to the general public,
(d) the information was given to the FOI body concerned by the individual to whom it relates and the individual was informed on behalf of the body, before its being so given, that the information belongs to a class of information that would or might be made available to the general public, or
(e) disclosure of the information is necessary in order to avoid a serious and imminent danger to the life or health of an individual,
I am satisfied that none of the circumstances identified at section 37(2) arise in this case. Section 37(2)(a) does not serve to provide for the release of personal information relating to a requester if that information is inextricably linked with third party personal information. On the applicability of section 37(2)(b), I note that the applicant considers that some of the joint personal information may be information provided by or relating to his mother and that she has no objection to the release of her personal information. While I am constrained by section 25(3) of the Act from disclosing exempt information, I can say that no third party consent to the release of personal information was provided with the applicant’s FOI request and I am satisfied, therefore, that section 37(2)b) does not apply.
Section 37(5) provides that a request that would fall to be refused under subsection (1) may still be granted where, on balance, (a) the public interest that the request should be granted outweighs the public interest that the right to privacy of the individual to whom the information relates should be upheld, or (b) the grant of the request would benefit the person to whom the information relates.
I am satisfied that the release of the third party personal information at issue would not benefit the third parties in question. I find, therefore, that section 37(5)(b) does not apply.
Before I consider the applicability of section 37(5)(a), there are a number of points to note. First, section 13(4) provides that, subject to the Act, in deciding whether to grant or refuse an FOI request, any reason that the requester gives for the request and any belief or opinion of the FOI body as to the reasons for the request shall be disregarded. In relation to the question of the public interest, this means that I cannot have regard to the applicant's motives for seeking access to the records at issue, except in so far as those motives reflect, or overlap with, what might be regarded as true public interest factors in favour of release of the records, i.e. insofar as the concerns raised in relation to the request may also be matters of general concern to the wider public.
Secondly, it is important to note that the release of records under the FOI Act must be regarded, in effect, as release to the world at large, given that the Act places no constraints on the uses to which a record released under the Act can be put. With certain limited exceptions provided for under the Act, FOI is not about granting access to information to particular individuals only and as noted above, a requester's reasons for making a request are generally not of relevance. Thus, records are not released under FOI for any limited or restricted purpose.
All of this means that in considering whether a right of access exists to records under section 37(5)(a) of the Act, any decision to grant access would be on the basis that there is an overriding public interest in the release of the records effectively to the world at large that outweighs the privacy rights of the third party individuals concerned.
In considering where the balance of the public interest lies in this case, I have had regard to section 11(3) of the Act which provides that in performing any functions under the Act, an FOI body must have regard to, among other things, the need to achieve greater openness in the activities of FOI bodies and to promote adherence by them to the principles of transparency in government and public affairs and the need to strengthen the accountability and improve the quality of decision making of FOI bodies. However, in doing so, I have also had regard to the judgment of the Supreme Court in The Minister for Communications, Energy and Natural Resources and the Information Commissioner & Ors [2020] IESC 57 (“the Enet case”). In that case, the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and “there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure”. Although the Court’s comments were made in cases involving confidentiality and commercial sensitivity, I consider them to be relevant to the consideration of public interest tests generally.
In its effective position on the request, the HSE said that in carrying out its internal review, it had regard to the general principles of openness and transparency set out in section 11(3) of the FOI Act. It said that having regard to the nature of the information at issue and to fact that the release of information under the FOI Act is, in effect, release to the world at large, it considered that the public interest in granting access to the records does not, on balance, outweigh the right to privacy of third parties. In its submissions to this office, it said the basis for its decision is grounded on stronger rights and weight attached to the right of privacy and breach/disclosure of the personal information of third party details contained within the records and as provided for under the Constitution and consistent with the provisions of Article 8 of the European Convention on Human Rights. It also said that the disclosure of the information would damage the relationship and trust which these third parties would have with mental health services.
In his correspondence with this Office, the applicant said that ultimately the name on the file is his and that one’s environmental factors play a role in the health of an individual both mentally and physically. He said that a better equilibrium can be established by focussing on redacting names, addresses or other identifying personal information to respect the personal right of others. He said he does not understand the rational for the basis of the HSE’s decision, that of stronger rights and weight attached to the right of privacy and breach/disclosure of the personal information of third party details contained within the records and as provided for under the Constitution and consistent with the provisions of Article 8 of the European Convention on Human Rights. He said that the HSE is given sustenance by the appropriate Minister and the Government and thus in a court of law, constitutional rights can be imposed by way of proxy through the HSE on The State. He said that Article 41(1)(I) can be used to give a family member “inalienable and imprescriptible rights, antecedent and superior to all positive law” to render any Judicial Power of any Judge past, present or future useless. He noted this with respect to the Family as a moral institution. He said that under Article 53 of the EU charter of Fundamental Rights, EU law cannot be used to trump or influence Article 41 of the Irish Constitution ‘Nothing in the Charter Shall be interpreted as restricting or adversely affecting human rights and fundamental freedoms as recognized…. By the Member States’ constitutions”
The question I must consider is whether, on balance, the public interest in granting access to the information at issue, which would involve the disclosure of third party personal information, outweighs the public interest in protecting the privacy rights of those third parties. I fully accept that there is a public interest in the applicant knowing what information it holds on file relating to him, particularly in circumstances where that information is relevant to the care and treatment afforded to him.
On the other hand, the FOI Act recognises the public interest in the protection of the right to privacy both in the language of section 37 and the Long Title to the Act (which makes clear that the release of records under FOI must be consistent with the right to privacy). It is also worth noting that the right to privacy has a constitutional dimension, as one of the unenumerated personal rights under the Constitution. Privacy rights, therefore, will be set aside only where the public interest served by granting release (and breaching those rights) is sufficiently strong to outweigh the public interest in protecting privacy. Moreover, I must have regard to the fact that the release of information under FOI must be regarded as, potentially at least, release to the world at large. As I have highlighted above, any decision to grant access to such information would be on the basis that there is an overriding public interest in the release of the records effectively to the world at large that outweighs the privacy rights of the third party individuals concerned. As I have also outlined above, the Supreme Court found that a general principle of openness does not suffice to direct release of records in the public interest and “there must be a sufficiently specific, cogent and fact-based reason to tip the balance in favour of disclosure”.
It seems to me, that the public interest in enhancing the transparency and accountability of the HSE in relation to how it carries out its functions concerning mental health services in this case has been met to a large extent by the release of a significant amount of the information at issue. In processing this FOI request, it seems to me that the HSE has endeavoured to release the records to the greatest extent possible whilst seeking to protect the privacy rights of third-parties. The question I must consider is whether the public interest in ensuring the further transparency and accountability of HSE by releasing the remaining information withheld in the records at issue outweighs, on balance, the public interest in protecting the privacy rights of the third-parties concerned. Having regard to the sensitive nature of the context in which the information is held, to the significant protection afforded to privacy rights, and to that fact that the release of records under section 37(5)(a) must be regarded effectively as release to the world at large, I am satisfied that it does not. I find, therefore, that section 37(5)(a) does not apply.
Having carried out a review under section 22(2) of the FOI Act, I hereby vary the HSE’s decision. I find that the HSE was justified in redacting certain information from the records at issue under section 37(1) of the FOI Act. I find that it was not justified in refusing further access to records under section 15(1)(a) of the Act in so far as the request included a request for the prescription records and I direct the HSE to conduct a fresh decision-making process in respect of those records.
Section 24 of the FOI Act sets out detailed provisions for an appeal to the High Court by a party to a review, or any other person affected by the decision. In summary, such an appeal,
normally on a point of law, must be initiated by the applicant not later than eight weeks after notice of the decision was given, and by any other party not later than four weeks after notice of the decision was given.
Stephen Rafferty
Senior Investigator