Preparing for the UK COVID-19 Inquiry

Visit the UK COVID-19 Inquiry website for key information and documents relating to the inquiry including updates, reports, notices and letters about the inquiry leads, public consultation, terms of reference and requests for records retention.

This will be decided by the chair of the inquiry and her team. However, it is unlikely that every health and care organisation will be required to participate.

The inquiry chair will be supported by a statutory inquiry team which, working under the direction of the chair, will determine the structure of the inquiry, and develop policies and processes. The chair will have broad legal powers to seek evidence and information and determine how that must be provided, by whom, when and in what format. If organisations are required to supply evidence, that will be a matter for them to address directly with the statutory inquiry team.

Organisations may want to consider:

• identifying inquiry leads and points of contact
• identifying information of potential relevance and ensuring it is not destroyed.
• keeping track of any senior staff / key individuals who are leaving the organisation: maintain contact details and ensure records are transferred before they leave
• ensuring teams across your organisation are managing all records including emails, texts, WhatsApp messages, Microsoft Teams messages, logbooks and other formats so they are securely saved and are retrievable
• following local records management policies and processes.

Health and care organisations can visit the UK COVID-19 Inquiry website for updated information. Any specific information governance (IG) related questions can be directed to the IG policy team in the NHS Transformation Digital Policy Unit at england.igpolicyteam@nhs.net.

There is a document preservation notice (sometimes called a ‘legal hold’ or ‘stop notice’) that has been used within NHS England. Please note that we are not instructing other organisations to use this notice, but it may be a helpful resource and can be adapted as needed.

Organisations are advised to continue to follow your own local staff leaver and exit process for staff leavers responsible for managing records of potential relevance to the inquiry. Any questions will need to be drafted by the organisation as they will relate to the role of that individual in the Covid response.

Information relating to the COVID-19 Inquiry is not necessarily exempt from FOI requests or SARs and blanket exemptions, for example not responding to a request due to the inquiry, are not appropriate. You will need to consider any request received, on a case by case basis, and decide whether any exemptions apply in line with your usual FOI and SAR processes.

Section 21 of the Inquiries Act provides an inquiry with powers to issue a notice to require any person to attend or request any information that the chair sees as relevant.

If you receive one of these notices you must comply or explain to the chair why you cannot comply; for example, if you do not hold the requested information. The chair will then decide whether to maintain, revoke or vary the notice. It is a criminal offence under section 35 to not comply with an information request without good cause or reason, or to deliberately withhold, alter, distort, or destroy evidence relevant to an inquiry.

Responding to a formal request for information from the inquiry does not breach UK GDPR. The legal bases for processing personal information are:

• Article 6 (1) (c) legal obligation, in this case compliance with a notice made under section 21 of the Inquiries Act 2005
• Article 9 (2) (g) substantial public interest on the basis of law, to meet the statutory functions of the Inquiry

With regard to confidentiality, the Inquiries Act 2005 establishes a statutory obligation for health and care organisations to disclose relevant information to the chair of an inquiry when requested. This overrides the duty of confidentiality, allowing the disclosure to take place lawfully.

You should also make sure that your transparency materials cover information that is shared for the purposes of inquiries.

If you receive an informal request for information from the inquiry the legal bases under UK GDPR for processing personal data are:

• Article 6 (1) (e) – public task
• Article 9 (2) (g) – substantial public interest on the basis of law to meet the statutory functions of the Inquiry.

Confidential patient information and employee records (for example, HR records) are subject to a duty of confidentiality. An informal request will not override the duty of confidentiality. Therefore, information will either need to be provided in an effectively de-identified format (for example to provide an aggregated dataset showing numbers of inpatients by age, sex and ethnicity), or a formal section 21 request will need to be made by the inquiry for confidential information.

Many of the documents of interest to the inquiry, in particular internal working documents and communications, may not contain any confidential patient or employee data so you can provide these to the inquiry if requested.

You must only provide the specific information requested by the inquiry.

No, you must retain information that is in scope of the inquiry, as set out in the terms of reference. You can rely upon UK GDPR:

• Article 6 (1) (c) – compliance with a legal obligation (section 35 of the Inquiries Act 2005).
• Article 6 (1) (e) – public task or official authority.
• Article 9 (2) (g) – substantial public interest on the basis of law to meet the statutory functions of the inquiry.

The common law duty of confidentiality does not impose limits on records retention.

Follow your local records management policy and ensure you work closely with your local records management team to ensure all records are identified and securely saved and are retrievable.