NHS Database Scandal

The request was partially successful.

Victoria Dacey

To Lynn Swyny

Freedom of Information Team
Ministerial Business and Parliamentary Accountability
Department of Health

On the 16th of March I sent you the following request under the FOI:

Dear Sir/Madam

I am making this request under the provisions of the FOI the assumptions of which are that information will be released unless there are compelling public interest reasons for not doing so. My FOI enquiry relates to the National NHS Database that is currently being rolled out across the UK. The questions are as follows:

1 How many Summary Care Records had been created as at the 15th of March 2010?

2 Of these how many were created before the patients in question had been sent the relevant written information and given an opportunity to opt out?

3 When was the decision made not to include an opt-out form in the information pack?

4 Who made this decision and what alternatives were considered before this decision was finalised? Why was no opt-out form included? Were any recommendations made that a form should be included? If so please set out exactly when these were made, who they were made by and why they were overruled.

5 When was the decision made to include a pre-paid envelope in the information pack that could result in the contents being destroyed if somebody used it accidentally to try to opt out?

6 Who made this decision and why was it made?

7 Exactly how many people will have access to the NHS Summary Care Records? I am not interested in a response which says "only staff who are caring for you" etc. Please tell me exactly how many users will be able to log onto this system and access the SCRs or if you do not know the exact number then what the nearest approximation is and how this was reached.

8 Of these people how many will be doctors or consultants? How many will be nurses or other directly medically qualified staff? How many will not have medical qualifications? How many will be NHS employees? How many will not be employees of the NHS? By employees I mean staff employed under a contract of service not consultants or contractors.

9 What provisions are there for a person who has had a Summary Care Record created deciding to opt out and have the record deleted? I am not interested in the record being 'hidden' as that is meaningless in database terms. Please set out the mechanism for deletion and the actual rights that citizens will have to ensure this is done. If there is no right to insist on deletion please simply say so.

10 Have the original plans for the roll-out of this new system been altered in the last 12 months? If they have did this relate to the planned speed of roll-out and is the database now being rolled out quicker than was originally planned? Presumably you will have the original GANTT charts and any changes will have been recorded under your project management methodology.

11 If a decision has been made to speed up this roll-out when was this decision made and who was it made by? Did this decision in any way relate to the potential for Labour losing the election and a new government cancelling the scheme? Presumably you will have internal emails and memos between officials at the DOH which could confirm this point.

12 How many people died in NHS care over each of the last 5 years as a direct result of the NHS not having a central database in place? This figure must only relate to the specific point of no central database.

13 How much has the new central database cost up to an including 28 February 2010? Please include all costs including staff costs, the procurement of the database, configuration, local data transfer, the emails, dealing with FOI requests etc. What is the predicted overall cost of the new database in full? What was the original budget for this project? How much will the database cost each year going forward?

14 Why was a decision made to require an opt-out rather than an opt in? An honest answer relating to the actual decision would be appreciated. Who made this decision and when?

15 Please define "health care staff" as set out in the booklet 'Changes to Your Health Care Records' which was sent out to patients. Exactly which categories of staff fall into this category?

16 Exactly what controls are currently in place to control who can see the records on the SCR? If the control system has not yet been activated please say why, when it will be, and what interim arrangements are in place to prevent breaches of security.

17 Please clarify exactly what 'hide your record for you' means. Exactly what categories of users will still be able to access the hidden records?

18 Are there any plans to allow external users such as pharmacists to have access to the system? If so what are these plans, who will then have access and when will this be implemented?

19 How many staff have the effective roll-out and implementation of this system as key performance indicators at work?

20 How many of these staff will receive bonuses relating to this roll-out exercise?

21 What will the value of these bonuses be?

22 What is the name of the senior civil servant in charge of this project? What was their salary in 2008-9 and 2009-10? What was their bonus in 2008-9 and 2009-10? I believe this request conforms with the 6th condition of schedule 2 of the Data Protection Act and that there is a legitimate public interest in knowing the details of the amount of money spent on employing senior staff of public authorities. And is in accordance with the Information Commissioner Awareness Guidance that states where individuals: ‘carry out public functions, hold elective office or spend public funds they must have the expectation that their public actions will be subject to greater scrutiny than would be the case in respect of their private lives’. There can be no legitimate privacy argument for officials being paid with public money to carry out public functions. I also refer you to the ruling in the cases of Corby Borough Council, August 2005 and the House of Commons V Information Commissioner and Brooke, Leapman and Thomas, 26th February 2008 where the information Commissioner ruled that the public interest in disclosure of salaries outweighed the right to privacy under section 40 (2) of the FOIA.

Please can common sense and transparency and not obfuscation and delay rule your response to this legitimate request.

I believe this request conforms with the 6th condition of schedule 2 of the Data Protection Act and that there is an overwhelming public interest in knowing the details relating to this. The request is in accordance with the Information Commissioner Awareness Guidance.

Regards

Victoria Dacey

Victoria Dacey

To Lynn Swyny

Your first response to my request was as follows:

"Subject: Acknowledgement of case DE00000491463 received by the Department of Health.
Date: 16 March 2010 10:46:58 GMT

Thank you for your email.

Where a reply is appropriate we aim to send one within 20 working days.

If your enquiry is about a medical matter, please contact NHS Direct on 0845 4647 or visit NHS Choices, or contact your GP surgery.

For the latest on swine flu, please visit the National Pandemic Flu Service (NPFS) or call 0800 1 513 100.

For general health information you may also find it helpful to refer to Directgov, the UK Government’s Official information website, or the Department of Health website’s Frequently Asked Questions."

Yours faithfully,

Victoria Dacey

Victoria Dacey

To Lynn Swyny

You then sent your first attempted response to the questions asked. That response is copied exactly below:

Our ref: DE00000491463 - Summary Care Records

Dear Ms Dacey,

Please find attached a response to your recent request made under the Freedom of Information (FOI) Act.

Yours sincerely,

FOI Team
Department of Health

Dear Ms Dacey,
Thank you for your email of 15 March to the Department of Health requesting, under the Freedom of Information (FOI) Act, a variety of details about the Summary Care Record (SCR). Your request has been passed to me for reply.

I will address each of your 22 questions in turn. The Department does hold some information relevant to your requests.

1. As at 15 November 2010, 1,313,790 patients’ clinical records had been used to create SCRs.

2. All patients are sent information in writing when SCRs are introduced into their area advising them of their available choices. Before a SCR is created, each patient can decide not to have a SCR at all if they so choose.

3. This decision was taken following a review of experience at the end of the SCR early adopter programme, in May 2008.

4. This information is already available in the public domain. Section 21 of the FOI Act allows public bodies to redirect applicants where the information they have requested is reasonably accessible to them by other means. Please see Q7 in the Q&A provided in Annex A of the ‘Dear Colleagues’ letter from Dr Gillian Braunold published on the Connecting for Health website at: www.connectingforhealth.nhs.uk/systemsan....

5 & 6. This decision was taken following a review of experience at the end of the SCR early adopter programme, in May 2008. The remainder of this information is already available in the public domain. Section 21 of the FOI Act allows public bodies to redirect applicants where the information they have requested is reasonably accessible to them by other means. Please see Qs 5 to 7 in the Q&A provided in Annex A of the ‘Dear Colleagues’ letter from Dr Gillian Braunold published on the Connecting for Health website at:
www.connectingforhealth.nhs.uk/systemsan....

7 & 8. As at 15 March 2010, some 722,600 users were registered and authenticated
for access to the ‘spine’. The ‘spine’ is the colloquial name given to the national
database of key information about patients' health and care which forms the
core of the NHS care records service (NHS CRS), and includes summary care
records. By the time an electronic care record has been created for every NHS
patient in England, we anticipate there may be in the region of some 850,000 spine
users.
Those with access to patient-specific clinical information contained in summary care records will, however, be fewer than this and will be limited to registered and authorised professional staff of organisations involved in delivering care to NHS patients and are of the NHS CRS. They must have a legitimate relationship with the patient in question – that is, be directly involved with the delivery of their care and have a ‘need to know’ relevant to that role. So, for example, a receptionist will see information about an appointment, but would not be able to look at detailed clinical information. We are not aware of any estimate that could put a figure on this number, or of the particular professional groups within it, with any reasonable precision.

9. This information is already available in the public domain. As previously stated, Section 21 of the FOI Act allows public bodies to redirect applicants where the information they have requested is reasonably accessible to them by other means. Please see Qs 28 & 29 on the following page of the Connecting for Health website: www.connectingforhealth.nhs.uk/systemsan...

10. The SCR programme began its early adopter phase in 2006, and Primary Care Trusts (PCTs) were asked to begin planning for the current roll out in early 2008. In the NHS operating framework 2009/10, Strategic Health Authorities were tasked with agreeing the timeline for implementing the SCR, with PCTs as commissioners, and to plan for roll-out of the SCR. This timeline was to be based on a two-year window for the full deployment of SCR from the date on which all GP systems used in the PCT area are compliant with National Programme for IT systems and services.

11. N/A

12. The answer to this question is, literally, unknowable. The Department therefore
holds no information relevant to this part of your query.

13. This information is not available in the form requested. However, the original costing for the overall budget is available in the 2008 National Audit Office (NAO) report at: www.nao.org.uk/publications/nao_reports/....
Information relating to predicted costs are provided in Baroness Thornton’s response to Lord Warner’s questions about the NHS IT strategy on 7 January. This is available online in Hansard at the following link (Column WA117):
www.publications.parliament.uk/pa/ld2009....

14. There has been much debate on the relative merits of the opt-in and opt-out approaches in relation to the creation of SCRs. At the outset of the programme, as long ago as 2004 Ministers concluded that the opt-out model was preferable on the grounds that the alternative approach would:
(1) take considerable time to implement and therefore delay the delivery of the benefits associated with having a SCR;
(2) disadvantage the most vulnerable members of society who may benefit most from the new record but may not be provided with one for a considerable period, or who may be difficult to contact to gain consent;
(3) require everyone to take action when, based on the experience of other countries who have implemented similar electronic records, only a very small minority will request not to have a SCR (as has so far proven to be the case in the NHS in England); and
(4) potentially result in complaints and litigation where health outcomes would have been improved if a SCR had been created.

15 & 16. Local NHS organisations have the responsibility for determining which of their ‘health care staff’ may access care records they hold, and for establishing the working practices that effectively deliver the confidentiality required ethically, and by law. Not all of these will be doctors, and local clinically-led teams will determine who needs to have access to information in particular cases and circumstances.
Guidance on required practice for those who work within or under contract to NHS organisations about the safeguarding of confidentiality, and patients' consent to the use of their health records, exists in the form of the NHS Confidentiality Code of Practice, published in November 2003. Local organisations are and have been responsible for the procedures that are followed.
The security measures controlling access to electronic medical records held on the NHS Care Records Service are set at the Cabinet Office standard e-Government interoperability framework level 3, with access further restricted to only those with a legitimate relationship with the patient, and further role-based access restrictions to specific information.
To access patient records staff will need to:
• have been issued with a smartcard following rigorous identity checks;
• log on to a system with their card and pass code;
• have been assigned a role profile that permits them to use system functions that allow record access; and

• have their membership of a team involved in a patient’s care confirmed by a check against central records, or have special authorisation to satisfy statutory requirements or other exceptional reasons for accessing records.

17. This means that the records will be made inaccessible to staff by technical means. This can be done in a number of ways, the most obvious being by uploading a blank record that has the effect of preventing the previous record from being accessed by NHS users of the system.

18. The role of community pharmacists is evolving to enable them to play a full part in meeting the demands of 21st century healthcare, and we believe that in order to be able to carry out these wider roles safely and effectively community pharmacists will need appropriate access to healthcare records. However, we also recognise, from talking with stakeholders, that there are concerns about how patient consent and confidentiality will be managed in a community pharmacy setting. Information governance standards will need to be strictly adhered to, and appropriate assurance mechanisms put in place before community pharmacists will be permitted access to the NHS care records service.

19 to 21. These questions could relate equally to Department of Health, to the NHS, or suppliers’ staff. There is no way of arriving at meaningful aggregate estimates in answer to these questions. Section 3(a) of the FOI Act states that a public body is not obliged to comply with the person’s request for information where the public body reasonably requires further information in order to identify and locate the information requested, and has informed the applicant of that requirement.
You should note that NHS bodies are separate public bodies for the purposes of FOI, and contact details for all Trusts and Authorities are available online at: www.nhs.uk/ServiceDirectories/Pages/Acut.... You may therefore wish to redirect any future queries about the NHS workforce to Trusts directly.
I should also point out that FOI gives individuals a right to recorded information, and not a right to seek predictions or views on the likelihood of future occurrences.

22. Christine Connelly, who is the Chief Information Officer for Health.
Christine Connelly joined the Department on 22 September 2008, and her annual salary was not therefore included in the Department’s 2008/09 Resource Accounts (available online at: www.official-documents.gov.uk/document/h..., see Table One, Page 21 for other remuneration data). The Resource Accounts reports provide remuneration details of Departmental Board and Corporate Management Board members are published on an annual basis. The 2009/10 Resource Accounts will include Christine Connelly’s salary details and Section 22 of the FOI Act is therefore applicable.
Section 22 is a qualified exemption and is subject to consideration of the public interest test. We recognise that there is a public interest in providing this information to you in order to be helpful, and to promote accountability and transparency of
government. However, in this case, there are strong arguments to support the use of the future publication exemption on the basis that the best use of public resources would be directed to pulling this information together, ensuring the information is accurate and published in a consistent and comprehensive format.
The Resource Accounts for the financial year 2009/10 will be published in due course and made available on the following websites:
www.official-documents.gov.uk
www.dh.gov.uk

If you have any queries about this response, please contact me. Please remember to quote the reference number above in any future communications.
I hope this reply is helpful. If you are dissatisfied with the handling of your request, you have the right to ask for an internal review. Internal review requests should be submitted within two months of the date of receipt of the response to your original letter and should be addressed to:
Head of the Freedom of Information Team
Department of Health

Yours sincerely,

Aimee Gasston
Freedom of Information Officer
Department of Health

Victoria Dacey

To Lynn Swyny

I then sent the following holding response to your unsatisfactory reply:

Dear Aimee

Thank you for this response. On first reading it does appear to be somewhat incomplete. I will get back to you on the main body of your response once I have had time to consider further.

On the specific matter of you relying on the future publications exemption to avoid disclosing the salary and bonus of Christine Connelly I ask now for this decision to be reviewed internally prior to me making a formal complaint to the Information Commissioner.

Given that this information could be obtained by a member of your HR team in around 30 seconds by a simple interrogation of your HR database or payroll database it cannot be argued that providing this would be in any way onerous or that it is in the public interest for this to be withheld until after the general election. Your reliance on this exemption implies that the salary in question is excessive and would not withstand public scrutiny and that you have therefore withheld this to avoid embarrassment for your department and the Secretary of State in advance of the election. It is in the public interest for taxpayers to know the salaries of public servants who are paid from the public purse and I refer you to the decision in Corporate Officer of the House of Commons v Information Commissioner and others [2008] EWHC 1084 (Admin) where it was made clear that the public interest in such issues outweighs matters of individual privacy.

In addition to this HM Treasury has given instructions to all departments and their NDPBs to publish details of the salaries of all of their staff who are earning over £100K by no later than 31 March 2010 and your department must therefore have this information to hand.

In light of the ease of access and the public interest issues in advance of the election I request that this decision be reviewed without delay and the information released in accordance with both the spirit and the letter of the Freedom of Information Act.

I look forward to hearing from you on this point and will respond in due course to the bulk of your initial reply.

Yours sincerely

V Dacey

Victoria Dacey

To Lynn Swyny

Following this I then reviewed your response in detail and finding it severely wanting sent you this:

Dear Amiee

Further to this I have now examined your response and seek further clarification on the following points:

Question 2. You have not answered this question. I asked how many records had actually been created before patients had been sent the relevant information and given the option to opt out. Please answer this with numbers. I want facts not speculation.

Question 4. You directed me to a letter from Gillian Braunold as an answer to this question. I have read the said letter and it does not answer the question as asked. I asked who made this decision (by who I mean who specifically in that I wanted the names of those who made the decision) and this is not included in the letter. I also asked in this question what alternative recommendations had been made, who made these and why they were overruled. The letter does not answer this. Could you please send me a copy of the document(s) that went to the decision-maker on this and copies of the minutes of the meeting(s) at which the final decision was made together with the names of the decision makers as originally requested. From your response to question 3 this document will be the document produced in response to the review of the early adopter programme in May 2008.

Question 5 and 6. This information is not already in the public domain. I have examined the documents to which you pointed me and they do not answer this question. Please provide a copy of the document that went to the decision-maker on the point of the envelope and copies of the minutes of any meetings at which this was discussed. This is an important issue of public interest given that the inclusion of this pre-paid envelope looks on the face to be a deliberate attempt on the part of the DoH to subvert the opt-out process.

Question 7 and 8. Thank you for confirming that your department has absolutely no idea how many people will ultimately be able to see the medical records of members of the public who do not opt out.

Question 9. The document to which you have referred me does not answer this question. Q28/29 of that document include the caveat of "wherever possible" and Q28 implies that records cannot be deleted once they have been accessed for the purpose of medical care. I asked specifically what the mechanism for deletion is and what rights citizens have to insist on this. The document does not answer these points. Could you please either answer these questions properly or provide a copy of documents and minutes of meetings which answer this. This is a simple point and avoiding the issue will not make it go away.

Question 10. You have not answered my question. I asked specifically if any alterations had been made to the original plans for rolling out this system such that the roll-out was now quicker than originally planned. Presumably this project will have been managed using the PRINCE2 methodology and as such there should be a change control order as well as copies of alternative timelines available. Please provide a copy of this change control order and copies of minutes documenting any discussions held by the project board on the matter of the timeline and any alterations to it. If you are unwilling to answer this then please let me have sight of the documents so I can discover the truth myself.

Question 12. I am quite frankly astounded that you cannot answer this question. You claim in the guidance to the opt out form that having a SCR could be life saving. It is hard to see how you could claim this with no objective data on the life-saving effect of this database in general terms. It is useful to know that no studies were ever done on this matter as part of the business case for this database.

Question 13. Are you really expecting me to believe that you are running a project that could cost the public billions of pounds and cannot even tell me how much it is going to cost? I have referred to both the NAO report and the reference in Hansard and it appears from this that you have committed to one of the biggest IT projects in UK history without any idea as to the true ring-fenced cost of the project and no idea of the financial benefit - ie no proper cost/benefit analysis. However if this is the case it is at least useful to have this confirmed officially and for this I thank you.

Question 14. You have not answered my question. I asked specifically who made the decision and 'who' requires a name or names in response. Please provide a copy of the decision document for this point and minutes of the meeting/meetings at which this was debated/decided. if you are unwilling to answer the question yourselves then proper and full disclosure on your part will at least allow this to come to light.

Question 15. From this response I read that although you will issue guidance there will be no central controls on who actually accesses the records and this will be delegated to individual NHS organisations. By this you will be creating a 'Privacy Lottery' across the NHS where in one region only certain classes of staff may have access but in another a wider range of staff could access the records. I asked in this question for a definition of 'health care staff' and you have confirmed by your response that no such definition exists in any national sense and this will be left to the judgement of local managers.

Question 16. You have not answered this question at all. I asked what controls are currently in place (at the date of my query) not what controls will exist in future. I also asked whether or not the final control system has been activated and you have not answered this. Please answer this question as it is a fundamental issue of public interest if records are not fully controlled at this point in time and there will be a time lag before overall controls are fully implemented.

Question 17. You have not answered this question. I asked specifically what 'hidden' means and who will be able to access the hidden records. You cannot 'hide' database contents from your IT staff as they can access everything if it still exists on the database. Please answer this question properly. Using 'technical means' is meaningless. What does this mean - what actual technical means? I am not asking for a response based on what might be done I am asking for a response based on what will actually be done. Please don't tell me that you have not yet decided on this (your answer being in the future tense implies that this is the case and you are making empty promises to patients without having bottomed out the technical issues properly). What actual technical means have you in place now for this? Please do not use the future tense in responses to these questions as I am not in any way interested in what you intend doing I am interested in what you have done and whether or not there are holes in your IT security plans for this database that you have not yet plugged.

Question 18. You have not answered when you will give pharmacists and their staff access to this database. What is the timeline and what are your actual plans? Please send me a copy of the document that covers this and any minutes of meetings where this has been discussed and decisions have been made. This is an essential point of public interest as the more people who have access to this the weaker the overall controls will be and the greater will be the risk to privacy.

Question 19 to 21. You have not answered this question. I refer you to the guidance issued by the Information Commissioner on the proper answering of FOI requests. You should not attempt to prevent access by responding in this way. If you do not have all of the information then you should provide the information you do have rather than attempting to use this as a reason not to reply. Please provide answers to these questions based on DOH staff alone and please be honest about this and act in the spirit of the legislation.

I have to say I am very disappointed with your answers on this so far. The impression you are giving is that you have something to hide over this database and that you are attempting to establish changes that could affect millions of people's lives irreversibly without having done due diligence on this and without considering properly the interests of your patients or the taxpayer. You need to remember that you are public servants paid from the public purse and as such should act in the interests of your employers (ie the public) not against those interests.

I look forward to hearing from you promptly given that there is an election looming and these matters will be of great interest to the electorate at large.

Yours sincerely

V Dacey

Victoria Dacey

To Lynn Swyny

You then sent the following response to me. Again it was less than convincing:

Dear Ms Dacey

Please find attached the outcome of your internal review, and a document relevant to question 12.

(See attached file: IR 491463R - Dacey.pdf)(See attached file: IR 491463
Dacey Q12 Appendix.pdf)

Regards

Lynn

Lynn Swyny
Freedom of Information Team
Ministerial Business and Parliamentary Accountability

27 April 2010

Dear Ms Dacey

OUTCOME OF A REQUEST UNDER FREEDOM OF INFORMATION [FOI]
ACT 2000 FOR INTERNAL REVIEW: CASE REF: 491463R

Thank you for your three emails of 16 April. As you expressed dissatisfaction with the Department of Health’s response to your FOI request, we have
conducted an internal review to examine our handling of your request.

Freedom of Information Act 2000 (FOIA)

Before I address the points you have raised, I feel it would be helpful to refer
to key provisions of the FOI Act.
1. Section 1(1) of the FOIA states:“(1) Any person making a request for information to a public
authority is entitled—
(a) to be informed in writing by the public authority whether it holds
information of the description specified in the request, and
(b) if that is the case, to have that information communicated to
him”.
In this context, the FOIA only applies to recorded information such as paper or electronic archive material. It does not cover future events, unrecorded
information which officials may remember, official advice (apart from past advice we have given, where a record of this has been kept) or requests for
an official policy statement (again, apart from past policy statements, where a record has been kept).
2. Section 16(1) of the FOIA states:
“It shall be the duty of a public authority to provide advice and assistance, so far as it would be reasonable to expect the authority to do so, to persons who propose to make, or have made, requests
for information to it”.
2 Although parts of your request fell outside the scope of section 1(1) of the FOIA, we endeavoured to provide you with advice and assistance in our initial response to you.
3. Section 12(1) of the FOIA states:
“Section 1(1) does not oblige a public authority to comply with a request for information if the authority estimates that the cost of complying with the request would exceed the appropriate limit”.
We estimated that answering the 22 questions in your original request by direct reference to all recorded information held by the Department of Health on the specific issues raised would far exceed the time and
cost limit laid down under section 12 of the FOIA. It is important to explain that we waived our right to refuse your request in order to provide as full an answer as possible, and advice and assistance,
where possible.

Internal Review

Your original request, our response, and your follow up emails are attached to the end of this document.

However, for the purpose of this internal review, we
have concentrated on the responses which you queried.
In each case we have added further clarification where possible, but I should reiterate that we have waived our right to invoke section 12 for the entirety of
your request in order to answer your questions as helpfully as possible. If you were to make a follow up FOI request based on this response I would ask that
you bear this in mind.

Question 2 asked about the creation of Summary Care Records:
… how many were created before the patients in question had been sent the relevant written information and given an opportunity to opt out?
We replied:
“All patients are sent information in writing when SCRs are introduced into their area advising them of their available choices. Before a SCR is created, each patient can decide not to have a
SCR at all if they so choose”.
On 16 April, you responded:
“You have not answered this question. I asked how many records had actually been created before patients had been sent the relevant information and given the option to opt out. Please answer
this with numbers. I want facts not speculation”.

3 Our clarification:
The original reply was not ‘speculation’, but a simple statement of policy - that all patients will be sent information in writing, advising them of their available choices, to the address held by the NHS locally, when Summary Care Records are to be introduced into their local area. We hold no information on instances where SCRs have been created in contravention of this policy, and know of no evidence to suggest that it has ever been contravened.

Question 4 concerned the decision not to include an opt-out form in the information pack:
Who made this decision and what alternatives were considered before this decision was finalised? Why was no opt-out form included? Were any recommendations made that a form should be included? If so please set out exactly when these were made, who they were made by
and why they were overruled.
We replied:
“This information is already available in the public domain. Section 21 of the FOI Act allows public bodies to redirect applicants where the information they have requested is reasonably accessible to them by other means. Please see Q7 in the Q&A provided in Annex
A of the ‘Dear Colleagues’ letter from Dr Gillian Braunold published on the Connecting for Health website at: www.connectingforhealth.nhs.uk/systemsan....

In your response, you wrote:

“You directed me to a letter from Gillian Braunold as an answer to this question. I have read the said letter and it does not answer the question as asked. I asked who made this decision (by who I mean who specifically in that I wanted the names of those who made the decision) and this is not included in the letter. I also asked in this question what alternative recommendations had been made, who made these and why they were overruled. The letter does not answer this. Could you please send me a copy of the document(s)
that went to the decision-maker on this and copies of the minutes of the meeting(s) at which the final decision was made together with the names of the decision makers as originally requested. From
your response to question 3 this document will be the document produced in response to the review of the early adopter programme in May 2008”.

Our clarification:
There was no single ‘decision maker’. The decision was a corporate one. The public information programme was developed following extensive consultation, and advice from patient and citizen groups, and the Information
Commissioner’s Office. It was launched with the agreement of Ministers. The particular aspect to which you take objection, non-inclusion of an opt-out form
4 in the information pack, was decided in the light of a risk assessment by Gillian Braunold, the Department’s Clinical Director for the SCR and
HealthSpace, that the alternative, that is, including an opt-out form, was likely to have significant downsides. Greatest among these was that people would
believe they had opted out of having a SCR by putting the completed form into, and sending it in, the reply-paid envelope, albeit the latter was included
for altogether different purposes. This assessment was borne out in experience with early adopters. The previously referenced document explains
this. Alternatives for accessing opt-out forms are legion, and are described at Q6 of the Gillian Braunold letter.

Questions 5 and 6 asked:
When was the decision made to include a pre-paid envelope in the information pack that could result in the contents being destroyed if somebody used it accidentally to try to opt out? Who made this decision and why was it made?

We responded:
“This decision was taken following a review of experience at the end of the SCR early adopter programme, in May 2008. The remainder of this information is already available in the public
domain. Section 21 of the FOI Act allows public bodies to redirect applicants where the information they have requested is reasonably accessible to them by other means. Please see Qs 5 to 7 in theQ&A provided in A of the ‘Dear Colleagues’ letter from Dr
Gillian Braunold published on the Connecting for Health website at: www.connectingforhealth.nhs.uk/systemsan....

You replied:
“This information is not already in the public domain. I haveexamined the documents to which you pointed me and they do not answer this question. Please provide a copy of the document that went to the decision-maker on the point of the envelope and copies
of the minutes of any meetings at which this was discussed. This is an important issue of public interest given that the inclusion of this pre-paid envelope looks on the face to be a deliberate attempt on the part of the DoH to subvert the opt-out process”.

Our clarification:
The inclusion of a reply paid envelope in information packs was in fact a measure genuinely intended to facilitate requests for further information rather
than “a deliberate attempt to on the part of the DH to subvert the opt-out process”. The fact that some recipients of information packs used it for
purposes for which it was not intended (including ‘returning’ opt-out forms) 5 was the very reason why opt-out forms were not included in the pack – see
Q4 above.

Questions 7 and 8 asked:
Exactly how many people will have access to the NHS Summary Care Records? I am not interested in a response which says "only staff who are caring for you" etc. Please tell me exactly how many users will be
able to log onto this system and access the SCRs or if you do not know the exact number then what the nearest approximation is and how this was reached. Of these people how many will be doctors or consultants? How many will be nurses or other directly medically qualified staff? How many will not have medical qualifications? How many will be NHS employees?
How many will not be employees of the NHS? By employees I mean staff employed under a contract of service not consultants or contractors.

We replied:
“As at 15 March 2010, some 722,600 users were registered and authenticated for access to the ‘spine’. The ‘spine’ is the colloquial name given to the national database of key information about
patients' health and care which forms the core of the NHS care records service (NHS CRS), and includes summary care records. By the time an electronic care record has been created for every NHS patient in England, we anticipate there may be in the
region of some 850,000 spine users. Those with access to patient-specific clinical information contained
in summary care records will, however, be fewer than this and will be limited to registered and authorised professional staff of organisations involved in delivering care to NHS patients and are of
the NHS CRS. They must have a legitimate relationship with the patient in question – that is, be directly involved with the delivery of their care and have a ‘need to know’ relevant to that role. So, for
example, a receptionist will see information about an appointment, but would not be able to look at detailed clinical information. We are not aware of any estimate that could put a figure on this number, or of the particular professional groups within it, with any reasonable precision”.
You responded:
“Thank you for confirming that your department has absolutely no idea how many people will ultimately be able to see the medical records of members of the public who do not opt out”.

Our clarification:
This part of your request falls outside the scope of section1(1) of FOIA. For obvious reasons we cannot predict precisely how many people will
ultimately be able to see the medical records of members of the public 6 who do not opt out; the reasons for this were fully explained in our
previous response. However, it may be helpful to restate that while we can describe the roles of employees who will have access, this can
never be a precise figure because the circumstances of every case will be different and the overall number of people employed in the NHS is a dynamic one.

Question 9 asked:
What provisions are there for a person who has had a Summary Care Record created deciding to opt out and have the record deleted? I am not interested in the record being 'hidden' as that is meaningless in
database terms. Please set out the mechanism for deletion and the actual rights that citizens will have to ensure this is done. If there is no
right to insist on deletion please simply say so.
We replied:
“This information is already available in the public domain. As previously stated, Section 21 of the FOI Act allows public bodies to redirect applicants where the information they have requested is reasonably accessible to them by other means. Please see Qs 28 &
29 on the following page of the Connecting for Health website: www.connectingforhealth.nhs.uk/systemsan...
You replied:
“The document to which you have referred me does not answer this question. Q28/29 of that document include the caveat of "wherever possible" and Q28 implies that records cannot be deleted once they have been accessed for the purpose of medical care. I asked specifically what the mechanism for deletion is and what rights
citizens have to insist on this. The document does not answer these points. Could you please either answer these questions properly or provide a copy of documents and minutes of meetings which answer this. This is a simple point and avoiding the issue will
not make it go away”.

Our clarification:
SCRs will be deleted if a patient asks for this to be done, excepting only where the SCR has been used by a healthcare professional in the course of treatment, or should have been so used. The key issue here is a medico-legal one - the potential need to be able to demonstrate the reasons for treatment decisions. In the event that a SCR was accessed as part of someone’s
healthcare, a record of that access needs to be kept in case there was a subsequent investigation of the performance of a clinician or a dispute about
the facts – this is in the best interests of both patients and clinicians. This can be a matter of vital importance where, for example, clinical negligence is
alleged, and where the unfettered right of a patient to have the SCR deleted 7 could leave clinicians exposed to false accusations of incompetence or
wrongdoing. The ‘mechanism’ for deletion in these circumstances involves a physical cleansing of the relevant hard drive by ‘back office’ IT staff.

Question 10 asked:
Have the original plans for the roll-out of this new system been altered in the last 12 months? If they have did this relate to the planned speed of roll-out and is the database now being rolled out quicker than was originally planned? Presumably you will have the original GANTT charts and any changes will have been recorded under your project management methodology.
We replied
“The SCR programme began its early adopter phase in 2006, and Primary Care Trusts (PCTs) were asked to begin planning for the current roll out in early 2008. In the NHS operating framework 2009/10, Strategic Health Authorities were tasked with agreeing the
timeline for implementing the SCR, with PCTs as commissioners, and to plan for roll-out of the SCR. This timeline was to be based on a two-year window for the full deployment of SCR from the date on
which all GP systems used in the PCT area are compliant with National Programme for IT systems and services”.
You responded:
“You have not answered my question. I asked specifically if any alterations had been made to the original plans for rolling out this system such that the roll-out was now quicker than originally
planned. Presumably this project will have been managed using the PRINCE2 methodology and as such there should be a change control order as well as copies of alternative timelines available. Please provide a copy of this change control order and copies of minutes documenting any discussions held by the project board on the matter of the timeline and any alterations to it. If you are unwilling to answer this then please let me have sight of the documents so I can discover the truth myself”.

Our clarification:
For avoidance of doubt, there has been no alteration to the ‘original plans’, as described, for rollout of SCRs such that rollout should now happen more
quickly.

Question 12 asked:
How many people died in NHS care over each of the last 5 years as a direct result of the NHS not having a central database in place? This figure must only relate to the specific point of no central database.
8 We replied:
“The answer to this question is, literally, unknowable. The Department therefore holds no information relevant to this part of
your query”.
You replied:
“I am quite frankly astounded that you cannot answer this question. You claim in the guidance to the opt out form that having a SCR could be life saving. It is hard to see how you could claim this with
no objective data on the life-saving effect of this database in general terms. It is useful to know that no studies were ever done on this matter as part of the business case for this database”.
Our clarification:
It is one thing to assert, and to adduce evidence to demonstrate, that having a SCR could be life saving. It is quite another to seek to put a precise figure on
the number of deaths in a defined period that have resulted from the absence of a SCR. That would indeed be ‘speculation’. For a discussion, citing evidence, of how the new NHS IT systems, including
the SCR, will contribute to greater patient safety and reduction in avoidable deaths, please see the attached Appendix (based on a paper created some two to three years ago for another purpose).

Question 13 asked:
How much has the new central database cost up to an including 28 February 2010? Please include all costs including staff costs, the procurement of the database, configuration, local data transfer, the
emails, dealing with FOI requests etc. What is the predicted overall cost of the new database in full? What was the original budget for this project? How much will the database cost each year going forward?
We replied:
“This information is not available in the form requested. However, the original costing for the overall budget is available in the 2008
National Audit Office (NAO) report at: www.nao.org.uk/publications/nao_reports/....
Information relating to predicted costs are provided in Baroness Thornton’s response to Lord Warner’s questions about the NHS IT strategy on 7 January. This is available online in Hansard at the
following link (Column WA117):
www.publications.parliament.uk/pa/ld2009...

You responded:
“Are you really expecting me to believe that you are running a project that could cost the public billions of pounds and cannot even 9 tell me how much it is going to cost? I have referred to both the
NAO report and the reference in Hansard and it appears from this that you have committed to one of the biggest IT projects in UK history without any idea as to the true ring-fenced cost of the project and no idea of the financial benefit - ie no proper cost/benefit analysis. However if this is the case it is at least useful to have this confirmed officially and for this I thank you”.

Our clarification:
The NHS Care Record Service (NHS CRS), of which the SCR forms only one component, comprises a number of national services and compliant local applications. Costs specific to the individual components of the NHS CRS are not separately identified within the relevant
contracts.

Question 14 asked:
Why was a decision made to require an opt-out rather than an opt in? An honest answer relating to the actual decision would be appreciated. Who made this decision and when?
We replied:
“There has been much debate on the relative merits of the opt-in and opt-out approaches in relation to the creation of SCRs. At the outset of the programme, as long ago as 2004 Ministers concluded that the opt-out model was preferable on the grounds that the
alternative approach would:
(1) take considerable time to implement and therefore delay the
delivery of the benefits associated with having a SCR;
(2) disadvantage the most vulnerable members of society who may benefit most from the new record but may not be provided with one for a considerable period, or who may be difficult to contact to gain
consent;
(3) require everyone to take action when, based on the experience of other countries who have implemented similar electronic records, only a very small minority will request not to have a SCR (as has so
far proven to be the case in the NHS in England); and
(4) potentially result in complaints and litigation where health outcomes would have been improved if a SCR had been created”.
Your response:
“You have not answered my question. I asked specifically who made the decision and 'who' requires a name or names in response. Please provide a copy of the decision document for this point and minutes of the meeting/meetings at which this was
debated/decided. if you are unwilling to answer the question yourselves then proper and full disclosure on your part will at least allow this to come to light”.
10 Our clarification:
The decision was made in 2004 by the then relevant Department of Health Ministers, and subsequently re-affirmed by successive Ministers from that date.

Questions 15 and 16 asked:
Please define "health care staff" as set out in the booklet 'Changes to Your Health Care Records' which was sent out to patients. Exactly which categories of staff fall into this category? Exactly what controls are currently in place to control who can see the
records on the SCR? If the control system has not yet been activated please say why, when it will be, and what interim arrangements are in place to prevent breaches of security.
We replied:
“Local NHS organisations have the responsibility for determining which of their ‘health care staff’ may access care records they hold, and for establishing the working practices that effectively deliver the
confidentiality required ethically, and by law. Not all of these will be doctors, and local clinically-led teams will determine who needs to have access to information in particular cases and circumstances.
Guidance on required practice for those who work within or under contract to NHS organisations about the safeguarding of confidentiality, and patients' consent to the use of their health records, exists in the form of the NHS Confidentiality Code of Practice, published in November 2003. Local organisations are and
have been responsible for the procedures that are followed. The security measures controlling access to electronic medical records held on the NHS Care Records Service are set at the Cabinet Office standard e-Government interoperability framework level 3, with access further restricted to only those with a legitimate relationship with the patient, and further role-based access restrictions to specific information.
To access patient records staff will need to:
• have been issued with a smartcard following rigorous identity
checks;
• log on to a system with their card and pass code;
• have been assigned a role profile that permits them to use
system functions that allow record access; and
• have their membership of a team involved in a patient’s care
confirmed by a check against central records, or have special
authorisation to satisfy statutory requirements or other
exceptional reasons for accessing records”.
11
You responded:
“From this response I read that although you will issue guidance there will be no central controls on who actually accesses the records and this will be delegated to individual NHS organisations.
By this you will be creating a 'Privacy Lottery' across the NHS where in one region only certain classes of staff may have access but in another a wider range of staff could access the records. I asked in this question for a definition of 'health care staff' and you have confirmed by your response that no
such definition exists in any national sense and this will be left to the judgement of local managers.
Question 16. You have not answered this question at all. I asked what controls are currently in place (at the date of my query) not what controls will exist in future. I also asked whether or not the final control system has been activated and you have not answered
this. Please answer this question as it is a fundamental issue of public interest if records are not fully controlled at this point in time
and there will be a time lag before overall controls are fully implemented”.

Our clarification:
Controls currently in place are as described. Any confusion is due to choice of language in the earlier reply i.e. use of ‘will’ (‘will need to’) to describe all occasions and circumstances.

Question 17 asked:
Please clarify exactly what 'hide your record for you' means. Exactly what categories of users will still be able to access the hidden records?
We answered:
“This means that the records will be made inaccessible to staff by technical means. This can be done in a number of ways, the most obvious being by uploading a blank record that has the effect of preventing the previous record from being accessed by NHS users
of the system”.
You responded:
“You have not answered this question. I asked specifically what 'hidden' means and who will be able to access the hidden records. You cannot 'hide' database contents from your IT staff as they can
access everything if it still exists on the database. Please answer this question properly. Using 'technical means' is meaningless. What does this mean - what actual technical means? I am not asking for a response based on what might be done I am asking for a response based on what will actually be done. Please don't tell
me that you have not yet decided on this (your answer being in the future tense implies that this is the case and you are making empty promises to patients without having bottomed out the technical issues properly). What actual technical means have you in place now for this? Please do not use the future tense in responses to these questions as I am not in any way interested in what you intend doing I am interested in what you have done and whether or not there are holes in your IT security plans for this database that
you have not yet plugged”.

Our clarification:
Please see the previous question regarding the use of language. You are right that the process involves ‘logical’ rather than physical deletion of records.
As existing SCRs currently contain only GP summaries, this is most easily achieved by the GP ‘overwriting’ the existing SCR with a blank record. The consequence of doing this is that they are made inaccessible to all staff who would otherwise have access to SCRs for the purpose of providing, or managing the provision of, care. They would not then be made accessible
other than in exceptional circumstances. See the Parliamentary reply given to
Norman Lamb MP of 29 January 2009 at: http://www.publications.parliament.uk/pa...
for a discussion of what these might be.

Question 18 asked:
Are there any plans to allow external users such as pharmacists to have access to the system? If so what are these plans, who will then have access and when will this be implemented?
We replied:
“The role of community pharmacists is evolving to enable them to play a full part in meeting the demands of 21st century healthcare, and we believe that in order to be able to carry out these wider
roles safely and effectively community pharmacists will need appropriate access to healthcare records. However, we also recognise, from talking with stakeholders, that there are concerns about how patient consent and confidentiality will be managed in a community pharmacy setting. Information governance standards will need to be strictly adhered to, and appropriate assurance mechanisms put in place before community pharmacists will be permitted access to the NHS care records service”.
You responded:
“You have not answered when you will give pharmacists and their staff access to this database. What is the timeline and what are your actual plans? Please send me a copy of the document that covers this and any minutes of meetings where this has been discussed and decisions have been made. This is an essential
point of public interest as the more people who have access to this the weaker the overall controls will be and the greater will be the risk to privacy”.

Our clarification:
The intention from the outset has been that the SCR should be potentially available to all staff responsible for providing NHS care where access is capable of contributing to improved clinical outcomes for their NHS patients. This naturally includes community pharmacists. A pilot to provide SCR access to community pharmacists is currently under way in
Bradford. The purpose of the pilot is to explore potential benefits, to address practical issues surrounding information governance, to consider changes in clinical or business processes, and to assess acceptability to patients. Decisions about extension of these arrangements more widely will only be taken when the lessons of the pilot have been carefully considered.

Questions 19 to 21 asked:
How many staff have the effective roll-out and implementation of this system as key performance indicators at work? How many of these staff will receive bonuses relating to this roll-out
exercise? What will the value of these bonuses be?
We replied:
“These questions could relate equally to Department of Health, to the NHS, or suppliers’ staff. There is no way of arriving at meaningful aggregate estimates in answer to these questions.
Section 3(a) of the FOI Act states that a public body is not obliged to comply with the person’s request for information where the public
body reasonably requires further information in order to identify and locate the information requested, and has informed the applicant of
that requirement. You should note that NHS bodies are separate public bodies for the
purposes of FOI, and contact details for all Trusts and Authorities are available online at:
www.nhs.uk/ServiceDirectories/Pages/Acut.... You
may therefore wish to redirect any future queries about the NHS workforce to Trusts directly.
I should also point out that FOI gives individuals a right to recorded information, and not a right to seek predictions or views on the likelihood of future occurrences”.

You responded:
“You have not answered this question. I refer you to the guidance issued by the Information Commissioner on the proper answering of FOI requests. You should not attempt to prevent access by responding in this way. If you do not have all of the information
then you should provide the information you do have rather than attempting to use this as a reason not to reply. Please provide answers to these questions based on DOH staff alone and please be honest about this and act in the spirit of the legislation.

I have to say I am very disappointed with your answers on this so far. The impression you are giving is that you have something to hide over this database and that you are attempting to establish changes that could affect millions of people's lives irreversibly
without having done due diligence on this and without considering properly the interests of your patients or the taxpayer. You need to remember that you are public servants paid from the public purse and as such should act in the interests of your employers (ie the
public) not against those interests. I look forward to hearing from you promptly given that there is an
election looming and these matters will be of great interest to the electorate at large”.

Our clarification:
Question 19: To answer this question based on DH staff alone would involve establishing which staff fall within scope of this request and then making
enquiries about the personal performance management objectives of everyone in scope. Performance management objectives are essentially private 'contracts' between staff members and their line managers, whose disclosure to another colleague, let alone to a third party, would constitute
unfair processing of personal information and therefore engage s40(2) of the
FOIA. The disclosure of these details is, in our view, covered by the exemption under Section 40 of the Freedom of Information Act (FOIA). S40(3)(a)(i)
exempts personal data from disclosure under the FOIA where this would contravene the data protection principles in the Data Protection Act 1998.
The first data protection principle requires data controllers to process personal data "fairly and lawfully".

The Information Commissioner has issued specific guidance as to how to apply the fairness test when considering disclosures that may contravene the
first data protection principle. The judgment to be made is "whether it would be unfair to someone to pass on their information without consent", taking into
account, among other factors:
• would the person expect that his or her information might be disclosed to
others; and
• had the person been led to believe that his or her information would be kept
secret
In our judgement it would be unfair to the staff concerned to pass on the personal information you have asked for since they will have a reasonable expectation that the information should remain confidential and not be readily disclosed to a third party on request.

Questions 20 and 21: These ask for information about an unknowable future outcome and we therefore cannot provide an answer.

Question 22 asked:
What is the name of the senior civil servant in charge of this project?
What was their salary in 2008-9 and 2009-10? What was their bonus in 2008-9 and 2009-10? I believe this request conforms with the 6th condition of schedule 2 of the Data Protection Act and that there is a
legitimate public interest in knowing the details of the amount of money spent on employing senior staff of public authorities. And is in accordance with the Information Commissioner Awareness Guidance
that states where individuals:
‘carry out public functions, hold elective office or spend public funds they must have the expectation that their public actions will be subject to greater scrutiny than would be the case in respect
of their private lives’. There can be no legitimate privacy argument for officials being paid with public money to carry out public functions. I also refer you to the ruling in the cases of Corby Borough Council, August 2005 and the House of Commons V Information Commissioner and Brooke, Leapman and Thomas,
26th February 2008 where the information Commissioner ruled that the public interest in disclosure of salaries outweighed the right to privacy under section 40 (2) of the FOIA. Please can common sense and transparency and not obfuscation and delay rule your response to this legitimate request. I believe this request conforms with the 6th condition of schedule
of the Data Protection Act and that there is an overwhelming public interest in knowing the details relating to this. The request is in accordance with the Information Commissioner Awareness Guidance..”

We replied:
“Christine Connelly, who is the Chief Information Officer for Health. Christine Connelly joined the Department on 22 September 2008, and her annual salary was not therefore included in the Department’s 2008/09 Resource Accounts (available online at:
www.officialdocuments.gov.uk/document/hc..., see Table One, Page 21 for other remuneration data). The Resource Accounts reports provide remuneration details of Departmental
Board and Corporate Management Board members are published on an annual basis. The 2009/10 Resource Accounts will include Christine Connelly’s salary details and Section 22 of the FOI Act is
therefore applicable.
Section 22 is a qualified exemption and is subject to consideration of the public interest test. We recognise that there is a public
interest in providing this information to you in order to be helpful, and to promote accountability and transparency of government. However, in this case, there are strong arguments to support the use of the future publication exemption on the basis that the best
use of public resources would be directed to pulling this information together, ensuring the information is accurate and published in a consistent and comprehensive format. The Resource Accounts for the financial year 2009/10 will be published in due course and made available on the followingwebsites:
www.official-documents.gov.uk
www.dh.gov.uk”.

You responded:
“On the specific matter of you relying on the future publications exemption to avoid disclosing the salary and bonus of Christine Connelly I ask now for this decision to be reviewed internally prior to me making a formal complaint to the Information Commissioner.
Given that this information could be obtained by a member of your HR team in around 30 seconds by a simple interrogation of your HR database or payroll database it cannot be argued that providing this
would be in any way onerous or that it is in the public interest for this to be withheld until after the general election. Your reliance on this exemption implies that the salary in question is excessive and
would not withstand public scrutiny and that you have therefore withheld this to avoid embarrassment for your department and the Secretary of State in advance of the election. It is in the public interest for taxpayers to know the salaries of public servants who
are paid from the public purse and I refer you to the decision in Corporate Officer of the House of Commons
v Information Commissioner and others [2008] EWHC 1084
(Admin) where it was made clear that the public interest in such issues outweighs matters of individual privacy. In addition to this HM Treasury has given instructions to all departments and their NDPBs to publish details of the salaries of all
of their staff who are earning over £100K by no later than 31 March 2010 and your department must therefore have this information to hand”.

Our clarification:
As we stated in our previous response, remuneration details of Departmental Board and Corporate Management Board members are published on an annual basis, and the Department’s 2009/10 Resource Accounts are being prepared for publication. We uphold the application
of section 22, as there is a clear public interest in ensuring the information is accurate and published in a consistent and comprehensive format.
However, in our previous response we provided a link to the Department’s 2008/09 Resource Accounts (available online at: www.officialdocuments.gov.uk/document/hc... and stated that as Christine Connelly joined the Department on 22 September 2008, her annual
salary was therefore not included in these accounts. On page 29 of this publication, details of both her Salary (including non-consolidated performance pay) and her Full Year Equivalent Salary (including nonconsolidated performance pay) were provided.

The internal review is now complete.
If you are not content with the outcome of your complaint, you may apply directly to the Information Commissioner’s Office (ICO) for a decision.
Generally, the ICO cannot make a decision unless you have exhausted the complaints procedure provided by the Department.

Yours sincerely
Lynn Swyny
Freedom of Information Case Manager

Victoria Dacey

Dear Lynn

Further to this request I will now be contacting the Information Commissioner to lodge an appeal.

This request relates to a number of fundamental issues of public interest in the UK. The National NHS Database represents probably the biggest threat to public privacy in modern history. You have confirmed that 850,000 people will have access to this database and the Information Commissioner's Office has recently confirmed that one third of all reported cases of data loss in the public sector occurred in the NHS.

It is difficult to see how the public can have confidence that your department is being transparent over this issue when you have refused to release documents necessary to be able to determine the truth and reveal exactly what is going on behind the scenes at the DOH with regard to this database and the means of introduction.

Your refusal to release information on the staff salaries relating to this project implies that DOH staff are lining their pockets with taxpayers' money while planning to make their medical records virtually public.

This will not do and I promise you this - I will not rest until I have revealed what you and your staff are up to in this regard. It is worth remembering in life that a half truth is no more or less than a whole lie.

At least members of the public will now be able to make up their own minds re your intentions given that our correspondence is now in the public domain.

Yours sincerely

Victoria Dacey

Department of Health and Social Care

Dear Ms Dacey,

Thank you for your emails relating to this FOI request.

You are of course free to take your complaint about our handling of your
FOI request to the Information Commissioner's Office (ICO). Just for
clarity, I should highlight that we have tried to answer your questions as
helpfully as possible, noting that some of them - for example those asking
"why...?" are not requests for recorded information. I should also
highlight that, in order to be helpful, we have waived our right to invoke
section 12 in relation to the entirety of your request. Finally, I should
highlight that we have said that we will be happy to consider a follow-up
FOI request if there are any aspects of the response where you would like
request further information from the Department.

A link to the ICO's "How to make a request guidance" is below, and I hope
this will be helpful in framing any future requests to the Department,
particularly the "How should I word my request" section.

http://www.ico.gov.uk/upload/documents/l...

Kind regards,

Graeme Tunbridge
Head of Freedom of Information
Department of Health


Victoria Dacey
<request-34618-e4
c872f5@whatdothey To
know.com> FreedomofInformation/OIS/DOH@DOH
cc
03/05/2010 20:15
Subject
Re: Freedom of Information request
- NHS Database Scandal





Dear Lynn

Further to this request I will now be contacting the Information
Commissioner to lodge an appeal.

This request relates to a number of fundamental issues of public
interest in the UK. The National NHS Database represents probably
the biggest threat to public privacy in modern history. You have
confirmed that 850,000 people will have access to this database and
the Information Commissioner's Office has recently confirmed that
one third of all reported cases of data loss in the public sector
occurred in the NHS.

It is difficult to see how the public can have confidence that your
department is being transparent over this issue when you have
refused to release documents necessary to be able to determine the
truth and reveal exactly what is going on behind the scenes at the
DOH with regard to this database and the means of introduction.

Your refusal to release information on the staff salaries relating
to this project implies that DOH staff are lining their pockets
with taxpayers' money while planning to make their medical records
virtually public.

This will not do and I promise you this - I will not rest until I
have revealed what you and your staff are up to in this regard. It
is worth remembering in life that a half truth is no more or less
than a whole lie.

At least members of the public will now be able to make up their
own minds re your intentions given that our correspondence is now
in the public domain.

Yours sincerely

Victoria Dacey

show quoted sections

Richard Taylor left an annotation ()

Another individual has made an FOI request asking for the release of information related to the way this FOI request has been handled.

http://www.whatdotheyknow.com/request/nh...

Francis Irving left an annotation ()

Our policy is that we are not trying to be a complete archive of FOI requests, and we do not host requests made off site. See here:

http://www.whatdotheyknow.com/help/about...

Trying to add an off site request via sending a series of long emails to the original department, is for one thing very confusing.

We've written to Victoria Dacey asking her not to do it again, but have left this up as it included a helpful response from the authority.

Making a new request about a request is, of course, fine! It shouldn't attempt to include the full body of the original correspondence though - a hyperlink to it hosted elsewhere would make more sense.