FOI-03818

##Request

You asked us:

‘2. Quality Audit – Missing Documentation
You state:
“Your claim has also been through a quality audit… the assessor was asked to clarify their report.”
You have not provided:
•           the audit report
•           the audit findings
•           the assessor’s clarification
•           the instructions given to the assessor
•           the assessor’s response
These documents are material to the decision and must be disclosed.
Please confirm whether these documents exist, and if so, provide them immediately.
If they do not exist, please confirm this explicitly.

4. Medical Assessor Identity – Misapplication of Data Protection Law
You state that assessor names and GMC numbers cannot be disclosed because they are “personal data”.
This is incorrect.
Under UK GDPR, professional identifiers used in an official capacity are not exempt from disclosure where:
•           the individual is acting in a public function, and
•           disclosure is necessary for accountability, audit, or challenge of a decision.
This is supported by:
•           ICO guidance on “professional information”
•           Case law on public facing professional roles
•           NHS transparency obligations
Please confirm:
1.         The legal exemption you are relying on (Article and Schedule reference).
2.         The specific harm test applied.
3.         Whether the assessor was informed their identity is withheld from claimants.
4.         Whether the assessor is aware their decision is being challenged.’

##Our response

###Question 2 - Quality Audit – Missing Documentation
You state:
“Your claim has also been through a quality audit… the assessor was asked to clarify their report.”
You have not provided:
•           the audit report
•           the audit findings
•           the assessor’s clarification
•           the instructions given to the assessor
•           the assessor’s response
These documents are material to the decision and must be disclosed.
Please confirm whether these documents exist, and if so, provide them immediately.
If they do not exist, please confirm this explicitly.

The following response does not relate to a specific claim or claimant. This request is being answered on a general basis as requests under FOIA are requester-blind, therefore the identity of the requester is not taken into account when considering a request for information under FOIA.

I can confirm that this information  is held by the NHSBSA. 

A selection of medical assessment reports are quality assured by the NHSBSA and measured against the principles and standards expressed in the Principles of Medical Assessment. This is to ensure that the principles are consistently and appropriately applied. An Integrated Quality Assurance (IQA) form is completed by NHSBSA.

I am unable to provide a copy of the IQA forms as this is personal information and falls under the exemption in section 40 subsections 2 and 3(A)(a) of the FOIA. As the requested information contains personal information including special category personal data, I consider this information is exempt. This is because it would breach the first data protection principle as:

a) it is not fair to disclose their personal details to the world and is likely to cause damage or distress.
b) these details are not of sufficient interest to the public to warrant an intrusion into their privacy.

The requested information is exempt if disclosure would contravene any of the data protection principles. For disclosure to comply with the lawfulness, fairness, and transparency principle, we either need the consent of the data subject(s) or there must be a legitimate interest in disclosure. In addition, the disclosure must be necessary to meet the legitimate interest and finally, the disclosure must not cause unwarranted harm.
This means that the NHSBSA is therefore required to conduct a balancing exercise between the legitimate interest of the applicant in disclosure against the rights and freedoms of those identified in the IQA reports.

While I acknowledge that you have a legitimate interest in disclosure of the information, the disclosure of the requested information would cause unwarranted harm. Disclosing this information would be unfair and as such this would breach the UK General Data Protection Regulation first data protection principle.

Please see the following link to view the section 40 exemption in full: https://www.legislation.gov.uk/ukpga/2000/36/section/40

In addition, disclosure of the requested information is also a breach of the common law duty of confidence. An individual who has been identified could make a claim against the NHSBSA for the disclosure of the confidential information.

The information requested is therefore being withheld as it falls under the exemption in section 41(1) ‘Information provided in confidence’ of the FOIA.
Please click the below web link to see the exemption in full: 

https://www.legislation.gov.uk/ukpga/2000/36/section/41

The following exemptions apply to anonymised or summarised IQA reports

###Section 21 of the FOIA – Information which is already reasonably available to you

The Principles of Medical Assessment outlines the quality standards expected within the Vaccine Damage Payment Scheme (VDPS) medical assessment reports. As mentioned in this document, it also incorporates previous learning that may be useful to consider in the preparation of medical assessment reports written by Medical Assessors. Any feedback provided as part of the quality assurance process is measured against the principles and standards contained within this document.

The Principles of Medical Assessment is available on our website at the following link:
https://www.nhsbsa.nhs.uk/sites/default/files/2025-04/Principles%20of%20medical%20assessment.docx

Additionally, the NHSBSA has made available in our response to FOI 02581 training materials which is has provided to the medical assessors based on the feedback it has provided during the IQA process.

You can view our response and this information by clicking the weblink below and scrolling down to the end of the page:

https://opendata.nhsbsa.net/dataset/foi-02581

###Section 43(2) - Information which is considered to be commercially sensitive
The specific quality assurance findings you requested are being withheld as they fall under the exemption in section 43(2) of the FOIA, as releasing the information would be likely to prejudice the commercial interests of the NHSBSA and our third-party medical assessor, Crawfords & Company.

Please be advised that we have consulted with our third-party supplier, Crawfords & Company, for their views in relation to disclosure of the requested information and how this would adversely affect their commercial interests. Feedback from this consultation has been incorporated into the public interest test detailed below.

In applying this exemption, we have balanced the public interest in withholding the information against the public interest in disclosing the information.

Please see the below web link to see the exemption in full -
https://www.legislation.gov.uk/ukpga/2000/36/section/43

###Public Interest Test:
###Considerations in favour of disclosure:

Public accountability and increased trust from members of the public in relation to transparency of information regarding Covid-19 vaccines and the Vaccine Damage Payment Scheme.

Public interest in citizens being confident in making informed decisions in relation to vaccines and that these decisions are taken based on the best publicly available information.

###Considerations against disclosure:
The requested information includes the proprietary information of Crawford & Company. Disclosing this information in the public domain would enable competitors to replicate or exploit these methods, giving them an unfair advantage in future tendering rounds.
Protecting fair competition ensures value for money in procurement and tendering processes. Disclosure would distort the market and potentially increase costs to the taxpayer if competition is compromised.

In a commercial environment, the timing of a disclosure is of critical importance. Information relating to commercial activity is at its most sensitive when the procurement activity is still underway. This FOI request was received when this contract was being reprocured.

Potentially serious detrimental effect on the commercial interests of the NHSBSA due to a reduction in the effectiveness of the competitive tendering process should the NHSBSA choose to re-test the market at a later time. This is because potential suppliers would not have the confidence that the NHSBSA would publicly disclose proprietary information. Disclosing information that is commercially sensitive to a particular supplier during a live procurement where it could be viewed by a competing supplier would put that supplier at a disadvantage whilst potentially creating a competitive advantage for other suppliers. As such the procurement would not meet transparency and equal treatment obligations and could introduce the risk of a successful procurement challenge had the information been disclosed under FOIA.

The NHSBSA believes that disclosing the requested information may decrease the effectiveness of any future competitive tender as it may prejudice the NHSBSA’s ability to obtain best quality of service and value.

Training materials on effective report writing have been released under FOI. As such, the NHSBSA are meeting transparency requirements without needing to release additional commercially sensitive information.

Quality standards and principles are publicly available on the NHSBSA website, and these incorporate lessons learnt from the Quality Assurance process. As such, there is transparency in the quality standards expected of the NHSBSA with it’s suppliers.
Maintaining confidentiality of proprietary methods safeguards innovation and efficiency.

Conclusion of public interest test:
The NHSBSA recognises that there is a public interest in the disclosure of information which facilitates openness, transparency, and accountability in public authority dealings; however, there is an inherent public interest in the NHSBSA being able to work in competitive markets, whereby the financial and reputational benefit is in to the wider public interest.

Having undertaken the balancing exercise, the NHSBSA concludes that the public interest in maintaining the exemption outweighs the public interest in disclosure.

###Question 4 - Medical Assessor Identity – Misapplication of Data Protection Law
You state that assessor names and GMC numbers cannot be disclosed because they are “personal data”.
This is incorrect.
Under UK GDPR, professional identifiers used in an official capacity are not exempt from disclosure where:
•           the individual is acting in a public function, and
•           disclosure is necessary for accountability, audit, or challenge of a decision.
This is supported by:
•           ICO guidance on “professional information”
•           Case law on public facing professional roles
•           NHS transparency obligations
Please confirm:
1.         The legal exemption you are relying on (Article and Schedule reference).
2.         The specific harm test applied.
3.         Whether the assessor was informed their identity is withheld from claimants.
4.         Whether the assessor is aware their decision is being challenged.’

The assertion made in your request that professional identifiers are “not exempt from disclosure” is incorrect. The UK GDPR does not include requirements about what specific personal data can or cannot be disclosed in response to a FOIA request. 

Please be aware that I have decided not to release the details of any medical assessors as this information falls under the exemption in section 40 subsections 2 and 3(A)(a) of the FOIA. This is because disclosure of their details would result in their identification. As the requested information would allow a medical assessor to be identified, I consider this information is exempt. This is because it would breach the first data protection principle as:

a)	it is not fair to disclose their personal details to the world and is likely to cause damage or distress

b)	these details are not of sufficient interest to the public to warrant an intrusion into their privacy

The requested information is exempt if disclosure would contravene any of the data protection principles. For disclosure to comply with the lawfulness, fairness, and transparency principle, we either need the consent of the data subject(s) or there must be a legitimate interest in disclosure. In addition, the disclosure must be necessary to meet the legitimate interest and finally, the disclosure must not cause unwarranted harm.

This means that the NHSBSA is therefore required to conduct a balancing exercise between the legitimate interest of the applicant in disclosure against the rights and freedoms of the medical assessor.

While I acknowledge that you have a legitimate interest in disclosure of the information, the disclosure of the requested information could cause unwarranted harm.

Information disclosed under FOIA is available to everyone and therefore the NHSBSA has to consider the overall impact of the disclosure and its duty of care. The expectation of the medical assessors is that they will remain anonymous and will therefore not be subject to contact or pressure from claimants or campaigning groups.

Given the certainty that disclosure of their name will identify them, there is a reasonable expectation that this information will not be disclosed under the FOIA.

Disclosing this information would be unfair and as such this would breach the UK General Data Protection Regulation first data protection principle.

Please see the following link to view the section 40 exemption in full: 
https://www.legislation.gov.uk/ukpga/2000/36/section/40

##Data Queries

Please contact foirequests@nhsbsa.nhs.uk ensuring you quote the above reference if you have any specific questions regarding this response; or, if you feel you may be misunderstanding or misinterpreting the information; or, if you plan on publishing the data.
Reusing the data and copyright

If you plan on producing a press or broadcast story based upon the data please contact communicationsteam@nhsbsa.nhs.uk. This is important to ensure that the figures are not misunderstood or misrepresented.

The information supplied to you continues to be protected by the Copyright, Designs and Patents Act 1988 and is subject to NHSBSA copyright. This information is licenced under the terms of the Open Government Licence detailed at:
http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/ 

Should you wish to re-use the information you must include the following statement:
“NHSBSA Copyright 2026” This information is licenced under the terms of the Open Government Licence:

http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/ 

Failure to do so is a breach of the terms of the licence.

Information you receive which is not subject to NHSBSA Copyright continues to be protected by the copyright of the person, or organisation, from which the information originated.  Please obtain their permission before reproducing any third party (non NHSBSA Copyright) information.




Organization: Freedom of Information Disclosure Log