Health prevented family from finding out about abuse of vulnerable family member

Monday 18 December 2023

Health & Social Care blocked a family from finding out what had happened, after a safeguarding review was carried out into alleged physical and emotional abuse of a vulnerable adult in its care.

The family only properly found out what had happened when the Data Protection Authority served the committee with an enforcement order, but it has still failed to recognise “the prolonged distress caused by the approach they adopted.”

“The vulnerable adult’s appointed guardian made a data subject access request on their behalf asking for an HSC investigation report into the alleged physical and emotional abuse,” said the DPA in a public statement.

“HSC provided a heavily redacted version of the report and left out the report’s appendices. This made it very difficult for the family to understand what had happened and what would be done to protect their family member.” 

The DPA issued HSC with an Enforcement Order which compelled them to release the full report to the family, five months after their initial request, with only minimal redactions.

Whenever someone asks an organisation for information about them, or in this case, on behalf of a vulnerable adult, the organisation must usually provide it within a month, but organisations can request more time if needed.   

There are exemptions to withhold some information.

Following the Authority’s investigation, HSC were found to have breached two sections of the law relating to data subject rights: It unreasonably withheld information and resisted attempts by the family to obtain the full report.

“While a basic apology was provided by HSC initially and prior to the Authority’s involvement, the lack of the safeguarding report meant it was difficult for the family to be assured that what had happened would not happen again. 

“HSC have now released the report as required by the Enforcement Order but without any recognition of the prolonged distress caused by the approach they adopted.” 

The DPA said that any organisation responsible for the care of others should demonstrate compassion, transparency, accountability and the highest standards of information governance. 

“These requirements are of particular importance where there are legitimate questions over someone’s treatment.  

“What this means in practice is giving people the information they ask for quickly, and not seeking to protect your organisation’s interests by withholding information by applying exemptions. 

“This was a very stressful experience for the family who wanted to make sure that their loved one was safe. This case is a reminder to all organisations that the Authority can legally compel information to be disclosed in certain circumstances, and that this sanction will be deployed where appropriate.”

HSC has not appealed the ruling and complied with the enforcement notice.

It declined to comment on the case.

This is the fourth public statement issued by the Authority in relation to HSC.