The UK COVID-19 Inquiry information governance guidance

The government has set up the independent public UK COVID-19 Inquiry to examine the UK’s preparedness and response to the Covid pandemic, and to learn lessons for the future. The official inquiry website provides a reliable source of updated information.

Visit the COVID-19 Inquiry website for all the key information related to the inquiry, including all files and documents published by the UK COVID-19 Inquiry to date.

NHS England has established an inquiry team to support colleagues and oversee the response to and co-operation with the inquiry on behalf of NHS England. The team will lead solely on managing the relationship of NHS England with the public inquiry and not that of the wider health and care sector. NHS England cannot provide detailed advice, instructions, or guidance to other health and care organisations on how they should respond or provide evidence to the Inquiry. NHS organisations are welcome to visit the NHS Futures COVID-19 Inquiry workspace for further information and materials. You will need an NHS Futures account to login. 

These key facts are to support the wider health and social care system to prepare for the COVID-19 Inquiry.

Visit the UK COVID-19 Inquiry website for key information and documents relating to the inquiry including updates, reports, notices and letters about the inquiry leads, public consultation, terms of reference and requests for records retention.

The chair of the inquiry and her team decide which health and care organisations are required to participate in the inquiry.

The inquiry chair is supported by a statutory inquiry team which, working under her direction, determines the structure of the inquiry, and develops policies and processes. The chair has broad legal powers to seek evidence and information and determines how that must be provided, by whom, when, and in what format. If organisations are required to supply evidence, they should address this directly with the statutory inquiry team.

Organisations may want to consider:

• identifying inquiry leads and points of contact
• identifying information of potential relevance and ensuring it is not destroyed
• keeping track of any senior staff / key individuals who are leaving the organisation: maintain contact details and ensure records are transferred before they leave
• ensuring teams across your organisation are managing all records including emails, texts, WhatsApp messages, Microsoft Teams messages, logbooks and other formats so they are securely saved and are retrievable
• following local records management policies and processes

Health and care organisations can visit the UK COVID-19 Inquiry website for updated information. Any specific information governance (IG) related questions can be directed to NHS England's IG engagement team through this online form. 

Organisations are advised to continue to follow your own local staff leaver and exit process for staff leavers responsible for managing records of potential relevance to the inquiry. Any questions need to be drafted by the organisation as they relate to the role of that individual in the COVID-19 response.

Information relating to the COVID-19 Inquiry is not necessarily exempt from FOI requests or SARs and blanket exemptions to responding to requests due to the inquiry, are not appropriate. You will need to consider any request received, on a case by case basis, and decide whether any exemptions apply in line with your usual FOI and SAR processes.       

Section 21 of the Inquiries Act provides an inquiry with powers to issue a notice to require any person to attend or request any information that the chair sees as relevant.

If you receive one of these notices you must comply or explain to the chair why you cannot comply; for example, if you do not hold the requested information. The chair will then decide whether to maintain, revoke or vary the notice. It is a criminal offence under section 35 to not comply with an information request without good cause or reason, or to deliberately withhold, alter, distort, or destroy evidence relevant to an inquiry.

Responding to a formal request for information from the inquiry does not breach UK GDPR. The legal bases for processing personal information are:

• Article 6 (1) (c) legal obligation, in this case compliance with a notice made under section 21 of the Inquiries Act 2005
• Article 9 (2) (g) substantial public interest on the basis of law, to meet the statutory functions of the Inquiry

With regard to confidentiality, the Inquiries Act 2005 establishes a statutory obligation for health and care organisations to disclose relevant information to the chair of an inquiry when requested. This overrides the duty of confidentiality, allowing the disclosure to take place lawfully. 

You should also make sure that your transparency materials cover information that is shared for the purposes of inquiries.     

If you receive an informal request for information from the inquiry, the legal bases under UK GDPR for processing personal data are:

• Article 6 (1) (e) – public task
• Article 9 (2) (g) – substantial public interest on the basis of law to meet the statutory functions of the Inquiry

Confidential patient information and employee records (for example, HR records) are subject to a duty of confidentiality. An informal request will not override the duty of confidentiality. Therefore, information will either need to be provided in an effectively de-identified format (for example to provide an aggregated dataset showing numbers of inpatients by age, sex and ethnicity), or a formal section 21 request will need to be made by the inquiry for confidential information.

Many of the documents of interest to the inquiry, in particular internal working documents and communications, may not contain any confidential patient or employee data so you can provide these to the inquiry if requested. 

You must only provide the specific information requested by the inquiry.

You must retain information that is in scope of the inquiry, as set out in the terms of reference. You can rely upon UK GDPR:

• Article 6 (1) (c) – compliance with a legal obligation (section 35 of the Inquiries Act 2005)
• Article 6 (1) (e) – public task or official authority
• Article 9 (2) (g) – substantial public interest on the basis of law to meet the statutory functions of the inquiry

The common law duty of confidentiality does not impose limits on records retention.

Follow your local records management policy and ensure you work closely with your local records management team to ensure all records are identified, securely saved and retrievable.