The Freedom of information Act 2000 covers any recorded information held by a public authority in England, Wales and Northern Ireland, and by UK-wide public authorities based in Scotland. Information held by Scottish public authorities is covered by the Freedom of information (Scotland) Act 2002.

NHS organisations, including NHS GP practices (under most contracts), are considered to be public authorities for the purposes of freedom of information (FOI) legislation.

Public authorities must:

routinely make information available to the public under the model publication scheme
respond appropriately to freedom of information requests from the public
make sure to respond to FOI requests within 20 working days
respect patient confidentiality and data protection law.

Freedom of information law

Freedom of information legislation aims to make public bodies more accountable and increase public confidence.

Under the law, public bodies, including GP practices, must:

proactively publish and update information about their activities
respond to requests for information from members of the public.

Making information available

Public authorities must produce a guide to information (a publication scheme) setting out:

what information you routinely publish
how this information can be accessed (ideally, it will be available on your website)
what charge, if any, will be made for access to the information (generally only for expenses incurred, such as postage)
contact details, so people can request information.

There should be a process for reviewing and updating published information.

Certain information is exempt from FOI, notably where disclosure is prohibited by law, and where what has been requested constitutes personal data, which is subject to data protection legislation requirements. Exceptions are also made for information that is still in draft form or archived/difficult to access. We would advise you to seek our advice if you're unsure.

England, Wales and NI

The Information Commissioner's Office (ICO) expects you to adopt its model publication scheme and has published guidance and a template for GP practices and healthcare bodies. It covers seven types of information, outlined below.

Who the practice is and what you do - doctors in the practice, contact details, opening hours and other staffing details.
What you spend and how you spend it (current and previous financial year) - total cost to the PCO of contracted services, audit of NHS income.
What your priorities are and how you are doing (current and previous year) - plans for developing and providing NHS services.
How you make decisions (current and previous year) - records of decisions made in the practice affecting the provision of NHS services.
Your policies and procedures (practices should state if policy is 'not held' as well as listing any additional ones) - policies, protocols and procedures concerning staff employment; delivery of services; equality and diversity; health and safety; complaints; and records management (eg retention and destruction), data protection, the handling of requests for information, the patients' charter.
Lists and registers - it's unlikely that practices will have any publicly available register or list and the ICO advises that 'none held' can be entered here.
The services you offer - current NHS services provided and any charges, information leaflets and out-of-hours arrangements.

Scotland

The Scottish Information Commissioner (SIC) has also produced a model publication scheme and general guidance for public authorities. Both are available on this website. The SIC is only responsible for Scotland's freedom of information laws - the ICO retains UK-wide responsibility for data protection matters.

Although similar in scope, the Scottish scheme has nine classes of information. Compliance with the model publication scheme is highly recommended, but not compulsory, and an authority is expected to notify the SIC when it's first adopted.

If a public authority does not use the model publication scheme, then it must seek the approval of the SIC for its chosen publication scheme. It's worth noting that, currently, all Scottish authorities have adopted the SIC model publication scheme.

Responding to requests for information

Under FOI, you must respond to all requests for information from the public and release information if the request falls within the scope FOI legislation, unless you have a good reason not to.

The ICO and the SIC have produced good practice guidance on what to do if you receive a request, which is summarised below.

Refusing a request

There are limited circumstances in which you can refuse an FOI request.

You do not hold the information - the ICO expects you to have made an adequate, documented search and will consider how thorough you have been in the event of a complaint. If you know the information is held by another authority, you should verify this and advise the applicant.
The information is exempt, such as confidential data about a patient.
It would cost too much or take too much staff time to deal with the request.
The request is vexatious. Take care, as you cannot label a request as vexatious because you believe it has little value or you don't like the way it has been made. However, you can take into account the context and history of a request, including the identity of the requester and your previous contact with them. The ICO says: 'The key question to ask yourself is whether the request is likely to cause a disproportionate or unjustifiable level of distress, disruption or irritation.'
The request repeats a previous request from the same person.

If you are refusing an FOI request, send the applicant a written refusal notice explaining why their request is being refused and citing the relevant provision of the FOI Act. You should also give details of your complaints procedure and their right to complain to the ICO or the SIC. However, you should keep a record of the reasons for your decision, as you may be required to justify it. Contact us for advice if you're unsure.

If an applicant is unhappy with how you've managed their request, it's good practice to review it. A review should be carried out by someone senior, who was not involved in responding to the original request. It should usually take no longer than 20 days.

Enforcing FOI law

You may be breaching FOI law if you do any of the following:

fail to respond adequately to a request for information
fail to adopt the model publication scheme (in England, Wales and NI), or do not publish the correct information
deliberately destroy, hide or alter requested information to prevent it being released. This is considered a criminal offence in the Acts.

Compliance with FOI law is enforced by the ICO or SIC, depending on jurisdiction. They have powers to:

serve information notices, requiring you to provide the specified information within a certain time period
serve enforcement notices where there has been a breach of FOI law, requiring you to take (or refrain from taking) specified steps to comply
issue recommendations, eg improving staff training
issue decision notices detailing the outcome of a complaint investigation
prosecute those who commit criminal offences under the Acts.

You have a right to appeal against decisions by the ICO/SIC, but you should obtain expert legal advice.

Freedom of information

Related articles

Membership in your pocket