Decision 055/2021: Significant Adverse Event Reviews
Public authority: Greater Glasgow and Clyde Health Board
Case Ref: 202000791
Summary
NHS Greater Glasgow and Clyde (NHSGGC) was asked for copies of 50 Serious Adverse Event Reviews (SAERs) and action plans. NHSGGC stated that that that it was not obliged to comply with the request as the cost of doing so would be more than £600.
NHSGGC provided redacted copies of the SAERs and action plans to the Applicant by way of assistance.
The Commissioner concluded that responding would not cost more than £600. He therefore found that NHSGGC was obliged to comply with the request.
Relevant statutory provisions
Freedom of Information (Scotland) Act 2002 (FOISA) sections 1(1) and (6) (General entitlement); 12(1) (Excessive cost of compliance);
The Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004 (the Fees Regulations) regulations 3 (Projected costs) and 5 (Excessive cost - prescribed amount)
The full text of each of the statutory provisions cited above is reproduced in Appendix 1 to this decision. The Appendix forms part of this decision.
Background
1. On 15 January 2020, the Applicant made a request for information to Greater Glasgow and Clyde Health Board (NHSGGC). It asked for the first 50 serious adverse event reviews (SAERs) from 1 January 2017, together with their action plans.
2. NHSGGC responded on 7 February 2020. It refused the request, stating that to comply with the request it would incur excessive costs (section 12 of FOISA).
3. On 14 February 2020, following further correspondence between the parties, NHSGGC confirmed that its initial response was correct, but it was willing to redact the documents and provide the information to the Applicant within a week.
4. On 23 March 2020, the Applicant wrote to NHSGGC requesting a review of its decision on the basis that the redacted SAERs had not been disclosed.
5. On 3 April 2020, NHSGGC disclosed 11 redacted copies of the reports to the Applicant.
6. On 22 June 2020, the Applicant applied for a decision from the Commissioner, with respect to NHSGGC's failure to respond to its requirement for review.
7. On 8 July 2020, NHSGGC notified the Applicant of the outcome of its review. It upheld its initial response (that it would incur excessive costs to respond to the request), but disclosed redacted versions of all 50 SAERs and action plans.
8. On 14 July 2020, the Applicant applied to the Commissioner for a decision in terms of section 47(1) of FOISA. The Applicant was dissatisfied with the outcome of NHSGGC's review because of the redactions made to the information. It considered the SAERs were learning documents for public consumption, so that organisations can learn from them, and not repeat the mistakes.
Investigation
9. The application was accepted as valid. The Commissioner confirmed that the Applicant made a request for information to a Scottish public authority and asked the authority to review its response to that request before applying to him for a decision.
10. On 20 August 2020, NHSGGC was notified in writing that the Applicant had made a valid application. NHSGGC was asked to send the Commissioner the information withheld from the Applicant. NHSGGC provided the information and the case was allocated to an investigating officer.
11. On 25 November 2020, the investigating officer contacted the Applicant and explained that NHSGGC maintained that it would incur excessive costs to respond to the request, and at the date of the application, it was still of this view.
12. A public authority may, as is the case here, provide the information despite it incurring an excessive cost. However, the Commissioner has no power to order a public authority to disclose information should he find that the cost of responding to a request for that information exceeds the amount prescribed by the Fee Regulations (£600). Consequently, despite the fact that NHS GGC has provided redacted version of the SAERs to the Applicant, the Commissioner is required to considered whether NHSGGC would incur excessive costs to comply with the request.
13. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application. NHSGGC was invited to comment on this application and to provide submissions explaining how it had concluded that it would cost in excess of £600 to provide the information to the Applicant.
14. Aspects of NHSGGC's submissions were questioned during the investigation; specifically, the estimated time taken to redact the SAERs and action plans.
Commissioner's analysis and findings
15. In coming to a decision on this matter, the Commissioner considered all of the relevant submissions, or parts of submissions, made to him by both the Applicant and NHSGGC. He is satisfied that no matter of relevance has been overlooked.
Section 12(1) - Excessive cost of compliance
16. Under section 12(1) of FOISA, a Scottish public authority is not obliged to comply with a request for information where the estimated cost of doing so would exceed the amount prescribed for that purpose in the Fees Regulations. This amount is currently £600 (regulation 5). As stated above, the Commissioner has no power to order a public authority to disclose information should he find that the cost of responding to a request for that information exceeds this sum.
17. The projected costs the public authority can take into account in relation to a request for information are, according to regulation 3 of the Fees Regulations, the total costs, whether direct or indirect, the authority reasonably estimates it is likely to incur in:
(i) locating,
(ii) retrieving, and
(iii) providing the information requested in accordance with Part 1 of FOISA.
The maximum rate a Scottish public authority can charge for staff time is £15 per hour.
18. An authority can take into account the time taken to redact information in order that a response can be provided when calculating the costs involved, but cannot take account of the cost of determining:
(i) whether it actually holds the information requested, or
(ii) whether or not it should provide the information.
NHSGGC's submissions
19. The information requested relates to SAERs. Within NHSGGC, these are known as Significant Clinical Incidents (SCIs). Such incidents are defined in NHSGGC policy as "those events that have or could have significant or catastrophic impact on the patient and may adversely affect the organisation and its staff and have potential for wider learning". NHSGGC submitted that these would usually rate 4 or 5 on the severity rating of Datix (NHSGGC's incident reporting tool).
20. NHSGCC explained that a robust investigation is conducted into all SCIs to determine whether there are learning points for the organisation. Following an investigation, a report is produced which presents the findings, conclusions and recommendations of the investigation team. An action plan will also be developed, to implement recommendations from the report. It is these reports and their action plans which are the subject of the Applicant's request.
21. NHSGGC explained that, as each SCI relates to an incident involving the treatment, and in some cases the death, of a patient, an SCI report will contain a significant amount of detailed information about the patient's condition and their treatment. NHSGGC explained that, although the reports are anonymised so that patient and any staff members involved are not named, there remains much information, including sensitive personal information, from which individuals could be identified. For this reason, the reports need to be redacted to remove all such information, prior to disclosure.
22. In its submissions, NHSGGC explained that the reports are detailed, complex and contain a significant amount of clinical information, and information relating to the background, medical history and, in some cases, family circumstances of each patient.
23. NHSGGC explained that, due to the high proportion of sensitive clinical information and the complexity of the reports, the marked-up reports were sent to the relevant General Manager responsible for the service or department in which the SCI occurred, to review the proposed redactions and to comment on whether further redactions were required. NHSGGC submitted that the reports were also sent to the Clinical Governance Unit for the same purpose. NHSGCC submitted that the reports required more than one "pass" in order to ensure that sensitive clinical and personal information was not inadvertently and inappropriately placed into the public domain.
24. NHSGGC estimated the time and cost that was incurred to respond to the request was as follows (each hour of work would be costed at £15 per hour, the maximum allowed in terms of regulation 3 of the Fees Regulations):
- Formulate search query in Datix incident reporting system to identify incidents that matched the parameters of the Applicant's request - i.e. where SCI investigation had been carried out and run search; create report template to extract data and run. Check final results to ensure accuracy: 3 hours, at a cost of £45;
- Create spreadsheet and embed reports: 2 hours, at a cost of £30;
- Extract information for action plans and copy into spreadsheet:
2 hours, at a cost of £30;
- Save reports into FOI shared drive files: 1 hour, at a cost of £15;
- Redact reports - based on average time taken to redact of 55 minutes per report:
for 50 files at 55 mins per file, it would take 45 hours, at a cost of £675;
- Redact Action Plans:
would take 2 hours, at a cost of £30;
- Verify redactions:
would take 2 hours, at a cost of £30;
Total estimated cost would be £855
25. NHSGGC explained that the task of retrieving and providing the information required specialist knowledge of the system including use of search terms, and of the categories and sub-categories in use within the system. Extraction of such data also required a higher level of access to the reporting tools within the system than that granted to standard users. A more junior member of staff would not have had sufficient specialist knowledge. NHSGGC submitted that although the individuals required to do this work are paid more, their rate was capped at £15 per hour.
26. It was explained that the requested information is held in a shared file accessed by Clinical Risk staff. A copy of each investigation report is also attached to the relevant incident record within the Datix Incident Reporting system.
27. A member of the Clinical Risk team formulated a search query in the Datix Incident Reporting system in order to retrieve those incidents that fell within scope of the request. The investigation reports were then retrieved from the shared file and embedded into the report spreadsheet. The action plans were retrieved from each incident record and copied into the spreadsheet.
28. As NHSGGC provided the information to the Applicant, it stated that the initial mark-up of proposed redactions was recorded as 15.75 hours (945 minutes) for 17 reports. Therefore, it was estimated that it would take 55 minutes to redact each of the 50 reports.
29. The redactions made to the reports were reviewed by two managers, to ensure all relevant redactions were made.
30. NHSGGC confirmed that the time to redact each report is calculated on the administrative time in making redactions within each report. Time spent by relevant clinical, administrative and Clinical Governance Unit staff in considering the information to be redacted had not been included in any estimate of staff time applied in the calculation.
Discussion with NHSGGC
31. NHSGGC provided copies of the redacted and unredacted SAERs and action plans.
32. It was noted that the SAERs ranged in length from two pages to 22 pages, and the average number of pages per report is 8.5. The investigating officer completed a timed redaction exercise to assess how long it would take to redact a number of the SAERs/SCIs. The time to redact ranged between 20 and 30 minutes for each. It was noted that the SAERs/SCIs generally followed a standard template, with summary of events, background and context containing much of the personal data about the patients. Taking account of the general template used in most instances, the somewhat formulaic approach and her own sampling exercise, the investigating officer was not satisfied with the suggested average time taken to redact the reports.
33. The Commissioner's guidance on section 12[1] provides that public authorities are not allowed to charge for any costs incurred in determining whether information should or should not be disclosed. An authority is not entitled to charge for the time spent deciding whether a report should be disclosed in full or whether parts of the report should be redacted.
34. However, an authority is entitled to charge for the costs incurred in physically redacting a document. The actual process of redacting is chargeable once the decision is taken about whether the information can be disclosed or not.
35. In discussion with NHSGGC, the investigating officer commented that the estimated time to redact the SAERs and action plans seemed long; she noted that it had taken her between 20 and 30 minutes to redact the sample of reports.
36. NHSGGC was directed to the Commissioner's briefing on section 12 of FOISA specifically, paragraph 10, which states:
If Office A decides to carry out the redactions herself, she will only be able to charge for the time spent redacting - this won't always be easy as deciding whether to apply an exemption will often be done at the same time as the redaction. However, Officer A will need to make a reasonable estimate of the time taken only to redact the information.
37. It was also put to NHSGGC that redaction consideration time had been included in the estimate of the time to redact the reports. On the basis of the above, NHSGGC was asked to review its estimate.
38. NHSGGC was also advised that, for the reasoning set above, the time taken to verify the redactions (i.e. checking the appropriateness of the redactions made) could not be taken into account, when estimating the time to provide information under FOISA.
39. NHSGGC did not provided any further response.
The Commissioner's conclusion
40. The Commissioner notes that NHSGGC has already provided the Applicant with redacted copies of the SAERs and action plans, free of charge. This decision focusses on whether NHSGGC was correct to advise the Applicant that it would incur excessive costs to provide the information.
41. Having considered the cost estimate, in particular the time taken to redact the SAERs and action plans, and having reviewed copies of the redacted and unredacted versions of these documents that has been provided to his office, the Commissioner is not satisfied that it would take 55 minutes to redact each report.
42. As stated in the section 12 briefing, time taken to consider whether a redaction should be made or not, cannot be included in the estimate time and costs. The Commissioner considers that NHSGGC included consideration of redactions in its calculations.
43. He notes that, in its review report, NHSGGC states that:
The time spent in deciding the level of information to be redacted, in order to preserve anonymity and patient confidentiality, is usually lengthy, and may involve a number of passes, including different individuals looking at each report to ensure that there is a consensus about the level of information being provided. This is the part which takes the most time but is not something that can be taken into account when estimating costs.
44. The Commissioner also concludes that the time to verify the redactions, cannot be included in the estimate of time and cost.
45. If the above points are applied to the costing, and a revised costing applied, it would be less than £600. Reducing the time taken to apply redactions from 55 minutes to 30 minutes and removing the costs of verifying the redactions, would reduce the cost of complying with this request to £525.
46. Therefore, the Commissioner finds that NHSGGC has failed to justify its application of section 12(1) of FOISA in this case, as the estimated cost of complying with the Applicant's request is less than the amount specified in the Fees Regulations (£600).
47. As noted above, NHSGGC provided the information to the Applicant on the understanding that it was under no legal obligation to do so. The Commissioner requires NHSGGC to respond anew to the Applicant's requirement for review in accordance with Part 1 of FOISA (other than in terms of section 12(1)). This will give NHSGGC an opportunity to consider more formally the exemptions it applied to the information and to explain to the Applicant the basis on which the exemptions were applied.
Decision
The Commissioner finds that Greater Glasgow and Clyde Health Board (NHSGGC) failed to comply with Part 1 of the Freedom of Information (Scotland) Act 2002 (FOISA) in responding to the information request made by the Applicant.
The Commissioner is not satisfied that NHSGGC was entitled to inform the Applicant that it would incur excessive costs in line with section 12(1) of FOISA to respond to the request.
The Commissioner requires NHSGGC to provide a new response to the Applicant's requirement for review, in terms of section 21(4)(b) of FOISA and other than in terms of section 12(1) of FOISA, by Monday, 14 June 2021.
Appeal
Should either the Applicant or NHSGGC wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only. Any such appeal must be made within 42 days after the date of intimation of this decision.
Enforcement
If NHSGGC fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that NHSGGC has failed to comply. The Court has the right to inquire into the matter and may deal with NHSGGC as if it had committed a contempt of court.
Margaret Keyse
Head of Enforcement
28 April 2021
Appendix 1: Relevant statutory provisions
Freedom of Information (Scotland) Act 2002
1 General entitlement
(1) A person who requests information from a Scottish public authority which holds it is entitled to be given it by the authority.
…
(6) This section is subject to sections 2, 9, 12 and 14.
12 Excessive cost of compliance
(1) Section 1(1) does not oblige a Scottish public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed such amount as may be prescribed in regulations made by the Scottish Ministers; and different amounts may be so prescribed in relation to different cases.
…
Freedom of Information (Fees for Required Disclosure) (Scotland) Regulations 2004
3 Projected costs
(1) In these Regulations, "projected costs" in relation to a request for information means the total costs, whether direct or indirect, which a Scottish public authority reasonably estimates in accordance with this regulation that it is likely to incur in locating, retrieving and providing such information in accordance with the Act.
(2) In estimating projected costs-
(a) no account shall be taken of costs incurred in determining-
(i) whether the authority holds the information specified in the request; or
(ii) whether the person seeking the information is entitled to receive the requested information or, if not so entitled, should nevertheless be provided with it or should be refused it; and
(b) any estimate of the cost of staff time in locating, retrieving or providing the information shall not exceed £15 per hour per member of staff.
5 Excessive cost - prescribed amount
The amount prescribed for the purposes of section 12(1) of the Act (excessive cost of compliance) is £600.
