How to Use Freedom of Information to Investigate NHS Decisions: FOI, Evidence & Transparency

Start here: what evidence are you trying to obtain?

You do not need to know which section of the Freedom of Information Act applies before you start.

Start with the evidence you need.

I want to know why an NHS policy or restriction exists

Do not simply ask:

“Why did you introduce this policy?”

Instead consider requesting existing records such as:

• the decision paper recommending the policy;
• the evidence review;
• committee papers and minutes;
• clinical advice;
• financial or cost-effectiveness analysis;
• legal or ethical analysis, subject to any lawful exemption;
• consultation evidence;
• equality analysis;
• approval records;
• and records explaining departures from national clinical guidance.

FOI is often most useful for obtaining the paper trail behind the decision.

I want to know who approved an NHS decision

Consider requesting:

• the final decision or approval record;
• committee minutes;
• delegated-authority records;
• terms of reference showing who had decision-making authority;
• sign-off records;
• Board or committee papers;
• and the role or job title of the decision-maker.

Whether individual names can be disclosed may depend on data-protection considerations, seniority and the circumstances. Asking for roles and decision-making responsibility can therefore sometimes be more useful than asking only for names.

I want to know whether equality was considered

Consider requesting:

• Equality Impact Assessments;
• Equality and Health Inequalities Impact Assessments;
• Public Sector Equality Duty analysis;
• decision papers discussing protected characteristics;
• records of patient consultation;
• identified adverse impacts;
• mitigation measures;
• approval or panel records;
• and evidence showing how inequalities in access or outcomes were considered.

If no document specifically called an “Equality Impact Assessment” exists, that does not necessarily mean equality was not considered.

Ask for any recorded evidence showing how the relevant equality duties were discharged.

Related guide: NHS Equality, Discrimination and the Public Sector Equality Duty.

I want to know how an NHS service is commissioned or who provides it

Useful records might include:

• current service specifications;
• commissioning specifications;
• patient pathways;
• referral criteria;
• eligibility criteria;
• contracts;
• provider names;
• procurement documents;
• performance requirements;
• contract-monitoring arrangements;
• and decision papers approving the arrangement.

This can be especially important where NHS-funded care is delivered by a private or independent provider.

I want to know whether the NHS actually implemented recommendations it says it implemented

Ask for evidence of implementation rather than another statement that implementation occurred.

That might include:

• action plans;
• action trackers;
• completion records;
• updated policies;
• committee approval;
• audit records;
• assurance reports;
• training records;
• implementation reviews;
• or records showing who verified completion.

There is an important difference between being told that something was “addressed” and seeing the records demonstrating what was actually done.

I think senior leadership knew about a problem and I want to establish what happened afterwards

Depending on the circumstances and lawful exemptions, potentially useful records could include:

• records showing escalation to senior leadership;
• correspondence concerning the issue;
• meeting papers;
• action logs;
• risk-register entries;
• assurance records;
• governance referrals;
• and records showing what action followed.

Keep the request focused on recorded information. FOI does not require an executive to explain their private thoughts or create a new account of why they acted or failed to act.

I think the NHS has not disclosed everything it holds

You may need to challenge whether adequate searches were carried out.

Useful questions for an Internal Review can include:

• which teams and departments were searched;
• which electronic systems were searched;
• which staff were consulted;
• what date ranges were used;
• whether relevant email accounts were searched;
• what search terms were used;
• whether third parties holding information on the NHS body's behalf were considered;
• and how the authority concluded that no further information was held.

The ICO can examine whether, on the balance of probabilities, further recorded information is held.

Read more about “information not held” →

What does Freedom of Information actually give you?

The Freedom of Information Act 2000 gives a general right of access to recorded information held by public authorities, subject to exemptions and other provisions of the Act.

That distinction — recorded information — is fundamental.

FOI can potentially give you:

• documents;
• emails;
• minutes;
• reports;
• spreadsheets;
• policies;
• statistics;
• contracts;
• decision records;
• internal guidance;
• recorded correspondence;
• and information stored in databases or other recorded systems.

FOI does not generally require a public authority to invent an answer, conduct new research, create a new opinion or reconstruct what somebody privately thought.

FOI, Subject Access Request or Environmental Information?

Not every request for NHS information belongs under FOIA.

Freedom of Information request

Use FOI primarily when you want non-personal recorded information about what a public authority does.

For example:

• policies;
• decision papers;
• commissioning arrangements;
• statistics;
• equality analysis;
• contracts;
• governance records;
• or evidence underpinning a healthcare policy.

Subject Access Request

If you are requesting your own personal data, the request generally belongs under data-protection law rather than FOIA.

For example:

• your medical records;
• emails discussing you personally;
• records held about your complaint;
• or other personal data relating to you.

You do not necessarily have to correctly label the request yourself. The authority should recognise the appropriate information-access regime from what you are asking for.

Environmental Information Regulations

Information concerning the environment may instead fall under the Environmental Information Regulations 2004.

For NHS organisations this could potentially arise with matters involving estates, buildings, land, waste, pollution, energy or other environmental information.

The rules are similar in some respects but not identical, including different rules around exceptions, costs and Internal Reviews.

What should you check before filing an FOI?

Before creating a new request, check whether the information has already been published.

Useful places include:

• the NHS organisation's website;
• Board and committee papers;
• meeting minutes;
• policy libraries;
• publication schemes;
• disclosure logs;
• annual reports;
• governance documents;
• and previously published FOI responses.

Every public authority covered by FOIA must adopt a publication scheme and proactively publish specified classes of information.

This commonly includes material such as policies, procedures, meeting information, organisational structures and financial information.

Finding one document before filing your FOI can also help you write a much more precise request.

For example, instead of:

“Please send me everything about female sterilisation.”

you may be able to ask:

“The January 2026 Quality Oversight Group paper refers to a completed review and subsequent approval. Please provide the recorded review, final approval record and documents evidencing that approval.”

What NHS records can you request?

Depending on what exists and whether an exemption applies, useful NHS accountability records can include:

• current and historic policies;
• policy-development papers;
• clinical evidence reviews;
• literature reviews;
• cost-effectiveness assessments;
• business cases;
• Equality Impact Assessments;
• Equality and Health Inequalities Impact Assessments;
• committee agendas and minutes;
• Board papers;
• decision logs;
• approval records;
• terms of reference;
• risk registers;
• audit reports;
• action plans and trackers;
• service specifications;
• patient pathways;
• referral criteria;
• contracts and commissioning specifications;
• provider-performance information;
• consultation records;
• patient-engagement records;
• recorded correspondence;
• and statistical information.

You are requesting information that is held. Disclosure remains subject to the exemptions and other provisions of FOIA.

Why should you ask for records instead of asking “why”?

Compare these two requests.

The second request does something much more useful.

It asks for the evidence that existed when the decision was made.

If the evidence is strong, you can examine it.

If the evidence is weak, you can identify the gaps.

If the authority says no such evidence is held, that may itself become important.

How do you write an effective NHS FOI request?

A valid FOIA request must generally:

• be in writing;
• give your real name;
• provide an address for correspondence, which can be an email address;
• and describe the information you want.

You do not have to use the words “Freedom of Information Act”.

But explicitly identifying the correspondence as an FOI request can reduce ambiguity.

Define the organisation or service

Where organisations have merged or commissioning arrangements have changed, define exactly what you mean.

Define the time period

A request covering nine years is much more likely to encounter cost problems than one covering the period during which a specific decision was actually made.

Define the records

“All information” can be unnecessarily broad.

Where possible, identify:

• the decision;
• the committee;
• the policy;
• the date;
• and the categories of document you want.

Say when you want existing documents only

If appropriate, state:

“I am requesting existing recorded information only. I am not asking the ICB to create a new explanation, opinion or analysis.”

This can make the scope clearer.

Ask for an explicit “not held” answer where appropriate

If the existence or absence of a record matters, consider adding:

“If no recorded information within this category is held, please confirm this expressly.”

A simple NHS FOI request template

How long does the NHS have to respond to an FOI request?

For most public authorities, the normal statutory limit is 20 working days.

The first working day after receipt is normally counted as day one.

The clock starts when the organisation receives the valid request — not when somebody later forwards it to the FOI team, logs it into a system or assigns a reference number.

FOIA also says requests should be answered promptly. Twenty working days is ordinarily the maximum, not a target that authorities are expected to wait for unnecessarily.

Can the deadline ever be extended?

There are limited circumstances where additional time can be taken.

In particular, where a qualified exemption applies and additional time is genuinely needed to consider the public interest test, an authority may take further reasonable time.

The ICO's position is that this should ordinarily mean no more than an additional 20 working days.

The authority should still identify the exemption within the original response period and tell you that additional time is required to determine the public-interest balance.

A general statement such as “we are very busy”, restructuring, staff shortages or administrative backlog does not itself rewrite the statutory deadline.

What must happen if the NHS refuses your FOI request?

If information is being withheld, the authority will usually need to issue a formal refusal notice under Section 17.

Depending on the circumstances, that notice should identify:

• the relevant exemption or statutory provision;
• why it applies;
• the public-interest reasoning where the exemption requires one;
• details of any Internal Review process;
• and your right to complain to the Information Commissioner's Office.

A response should allow you to understand what has been:

provided → withheld → said not to be held → or refused.

What if the NHS says your request costs too much? — Section 12

Section 12 FOIA allows a public authority to refuse a request where it reasonably estimates that complying would exceed the statutory appropriate limit.

For non-central-government public authorities, the limit is currently:

The authority can count specified activities such as:

• determining whether the information is held;
• locating it;
• retrieving it;
• and extracting the relevant information.

It cannot simply put every aspect of handling an FOI into the Section 12 calculation.

For example, time spent considering exemptions or redacting documents is not one of the permitted cost activities.

Does the authority need to prove the estimate exactly?

No precise calculation is required.

But the estimate must be reasonable.

ICO and Tribunal guidance describes an appropriate estimate as one that is sensible, realistic and supported by cogent evidence.

Sampling can be used to support an estimate.

Can related requests be added together?

In certain circumstances, requests from the same person — or people acting together — concerning the same or similar information can be aggregated for cost purposes if they are received within the relevant 60-working-day period.

Aggregation is governed by specific rules and should not simply be assumed whenever someone submits more than one FOI.

What is the NHS required to do under Section 16?

Section 16 creates a statutory duty to provide reasonable advice and assistance to people making or proposing to make FOI requests.

This becomes particularly important when a request is refused under Section 12.

The objective should not simply be:

“Your request is too broad. Try again.”

The ICO says authorities should consider what information could be provided within the cost limit and whether they can help the applicant refine or refocus the request.

Depending on the circumstances, useful assistance could include:

• identifying the part of the request causing the largest search burden;
• suggesting a shorter time period;
• identifying records that are centrally held;
• explaining which teams would need to be searched;
• suggesting particular categories that could be supplied;
• or indicating what information could realistically be located within the limit.

There are limits. An authority is not required to invent endless possible requests, and in some circumstances there genuinely may be no meaningful refinement that would bring useful information within the limit.

If that is the authority's position, ICO guidance says it should explain that.

What happens when you submit a narrower FOI request?

This distinction is important.

If Section 16 assistance leads you to submit a substantially refined request, ICO guidance says that the refined request should be treated as a new request.

That means:

• a new statutory response period begins when the refined request is received;
• the new request should be considered on its own wording;
• and the cost of dealing with it cannot simply be added to the work carried out on the original request in order to defeat the refinement process.

The ICO explicitly explains that aggregating the cost of the refined request with the original in those circumstances would frustrate the purpose of Sections 12 and 16.

What if the NHS says the information is not held?

FOIA does not require a public authority to create information it does not hold.

If the requested recorded information genuinely does not exist or is not held by the authority, the authority can comply by telling you that.

But sometimes the real dispute is:

Did they search properly?

If there is evidence suggesting more information should exist, ask for an Internal Review and challenge the adequacy of the searches.

What can the ICO examine?

Where there is a dispute over whether further information is held, the ICO applies the civil standard:

the balance of probabilities.

It may examine questions including:

• how the request was interpreted;
• what searches were undertaken;
• which systems were searched;
• which staff were consulted;
• whether the search terms were appropriate;
• whether there is a business reason the information should exist;
• whether records-management policies suggest it should exist;
• and whether someone else holds it on the authority's behalf.

Evidence from another document can also matter.

If a Board paper says:

“The Equality Assessment was completed in March”

but your FOI response says no Equality Assessment is held, that inconsistency is potentially relevant to challenging the adequacy of the searches.

What if the records apparently should exist — but do not?

This is where FOI and governance separate.

The ICO's job is normally to determine whether the requested information is actually held.

It does not ordinarily decide that an NHS organisation must have created a particular record merely because good governance suggests it should exist.

That second question may belong with:

• the organisation's Board or governance structures;
• NHS England regional oversight;
• the Ombudsman;
• health scrutiny;
• an equality route;
• an auditor or regulator;
• or legal proceedings, depending on the circumstances.

Related guide: How to Escalate an NHS Concern.

What if NHS documents are heavily redacted or withheld?

FOIA contains exemptions allowing information to be withheld in particular circumstances.

Examples that may arise in NHS accountability requests include provisions concerning:

• information already reasonably accessible;
• information intended for future publication;
• personal data;
• information provided in confidence;
• legal professional privilege;
• commercial interests;
• and, in appropriate cases, the effective conduct of public affairs.

Different exemptions have different legal tests.

Some are absolute.

Others are qualified and require the authority to consider whether the public interest favours maintaining the exemption or disclosing the information.

Do not assume every redaction is automatically lawful

You can ask:

• which exemption covers each withheld category;
• why the exemption applies;
• whether the exemption is absolute or qualified;
• what public-interest factors were considered where relevant;
• and whether less information could have been withheld.

A refusal should be sufficiently explained for you to understand the legal basis on which access has been denied.

What if your NHS FOI request is called vexatious?

Section 14 allows public authorities to refuse vexatious requests.

It is not simply a rule that says:

“This person has complained a lot, therefore we can stop answering them.”

The ICO takes a holistic approach, considering the circumstances of the particular request.

Relevant themes can include:

• burden;
• motive;
• the value or serious purpose of the request;
• harassment or distress;
• the wider pattern of correspondence;
• and whether the request represents a disproportionate or unjustified use of FOIA.

Importantly, ICO guidance also recognises that the authority's own previous handling can matter.

If repeated requests have arisen because previous requests were poorly handled, unanswered, contradictory or confusing, that context may weigh against treating the latest request as vexatious.

How can you reduce the risk?

Keep FOI correspondence focused on obtaining information.

Where possible, keep:

the complaint about what happened

separate from:

the FOI request for the records proving what happened.

You may feel angry about what you are investigating. But adding pages of argument to every FOI can obscure the information request itself and create unnecessary disputes about burden or tone.

How do you challenge an NHS FOI response through Internal Review?

If you are dissatisfied with an FOI response, the normal next step before approaching the ICO is to request an Internal Review.

FOIA itself does not make an Internal Review procedure mandatory in the same way that the Environmental Information Regulations do, but the statutory Code of Practice recommends that public authorities provide one, and the ICO normally expects requesters to use it where available.

The ICO says Internal Reviews should normally be completed within 20 working days and no more than 40 working days in exceptional circumstances.

The reviewer should make a fresh decision based on the relevant evidence and, where possible, should not be the person who made the original decision.

What can you challenge?

Examples include:

• a missed part of the request;
• an exemption you believe does not apply;
• an inadequate public-interest test;
• Section 12 calculations;
• failure to provide meaningful Section 16 assistance;
• inadequate searches;
• information incorrectly said not to be held;
• unexplained redactions;
• or an incorrect interpretation of the scope.

A simple Internal Review structure

When and how do you complain to the Information Commissioner's Office?

If you remain dissatisfied after the Internal Review, you can ask the Information Commissioner's Office (ICO) to consider the authority's handling of the request.

If no response was received after 20 working days, ICO guidance asks you first to follow up directly with the public authority.

If an Internal Review has still not been provided after 40 working days, the ICO says you can complain and it may either require the authority to complete the review or investigate without one.

Do not leave the ICO complaint indefinitely

Current ICO guidance asks people to complain within six weeks of the final response or last substantive contact with the public authority.

Waiting too long can result in the ICO declining to consider the complaint.

What should you send the ICO?

Usually prepare:

• the original FOI request;
• the authority's response;
• your Internal Review request;
• the Internal Review outcome;
• and a concise explanation of the issues you want the ICO to determine.

What should the complaint focus on?

Again, match the issue to the ICO's role.

For example:

What can the ICO actually do?

The ICO can investigate eligible information-rights complaints and may issue a formal Decision Notice.

A Decision Notice can determine whether the public authority complied with FOIA and can require specified steps to be taken where appropriate.

The ICO may also use wider regulatory and enforcement powers where systemic information-rights problems arise.

But there are limits.

The ICO does not:

• award compensation for an FOI breach;
• discipline an NHS Chief Executive for poor organisational leadership;
• decide whether a healthcare policy is clinically appropriate;
• determine whether somebody passes the NHS Fit and Proper Person Test;
• or investigate every wider governance failure surrounding the information request.

If you disagree with an ICO Decision Notice, there is a statutory appeal route to the First-tier Tribunal (Information Rights), subject to the applicable rules and deadlines.

When does an FOI problem become an NHS governance problem?

One missed deadline can be an administrative failure.

A wider pattern may raise different questions.

For example:

• repeated statutory deadlines are missed;
• records repeatedly cannot be located;
• different departments give contradictory accounts;
• Internal Reviews identify failed controls but the problem continues;
• senior leaders are notified and the failures remain unresolved;
• important decision records appear not to exist;
• or the organisation cannot demonstrate how significant public decisions were approved.

The ICO may investigate the information-law part of that story.

But the wider question may become:

That question may potentially engage:

• NHS organisational governance;
• the Board or Audit Committee;
• NHS England regional oversight;
• health scrutiny;
• the Ombudsman;
• or other accountability routes depending on the evidence.

This distinction is important:

An FOI breach can be the evidence of a governance problem without the ICO being the body responsible for investigating every part of that governance problem.

Read next: Who Oversees the NHS? and How to Escalate an NHS Concern.

How should you organise your NHS FOI evidence?

Once you begin making several information requests, organisation becomes extremely important.

For every request, keep:

• the exact request;
• date sent;
• proof of delivery or email transmission;
• reference number;
• calculated statutory deadline;
• acknowledgements;
• follow-ups;
• the disclosure;
• attachments;
• refusal notices;
• Internal Review request;
• Internal Review outcome;
• ICO complaint;
• and any ICO decision.

It can also help to maintain a simple table:

This becomes particularly valuable if you later need to demonstrate a pattern rather than one isolated failure.

What weakens an NHS Freedom of Information request?

Asking questions instead of requesting information

“Why did you do this?” may invite an explanation rather than reveal the contemporaneous evidence.

Ask for the recorded material behind the decision.

Requesting “everything”

Huge searches create Section 12 risk and make it harder to identify what actually matters.

Using an unnecessarily long date range

If the policy was approved in 2026, decide whether you genuinely need records going back to 2014.

Combining too many investigations into one request

Breaking a very large investigation into logically distinct information needs can make searches clearer and responses easier to scrutinise.

But remember that related requests can sometimes be aggregated for Section 12 purposes.

Mixing the complaint and FOI into the same document

You may absolutely explain context where necessary.

But the FOI team primarily needs to understand:

What recorded information are you asking for?

Not defining terminology

This becomes especially important after NHS reorganisations, mergers and changes of provider.

If you mean former BOB ICB arrangements that remain current under NHS Thames Valley ICB, say so.

Accepting “not held” without looking at the surrounding evidence

If another official document refers directly to the missing record, that can provide a basis for challenging the search.

Assuming that the ICO can resolve every accountability problem

The ICO can determine information-rights questions.

If the documents reveal maladministration, discrimination, unsafe care, unlawful policy or governance failure, the next stage may belong somewhere else.

Other Fighting Back guides

• Who Oversees the NHS? — regulators, Ombudsmen and accountability bodies
• How to Escalate an NHS Concern — identify the problem and match it to the right accountability route
• NHS Equality — discrimination, PSED and Equality Impact Assessments
• Human Rights & the NHS — consent, bodily autonomy and the NHS Constitution
• Advocacy & NGOs — reproductive-rights and patient-support organisations
• Legal Routes — judicial review, negligence, equality and human-rights claims

Official sources used for this guide

The principal sources for this guide are the Freedom of Information Act 2000, the statutory Fees Regulations and current Information Commissioner's Office guidance.

• Freedom of Information Act 2000
• Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2004
• ICO — How to access information from a public authority
• ICO — What makes a valid FOI request?
• ICO — FOI timescales
• ICO — Section 12: requests exceeding the appropriate limit
• ICO — Section 16: advice and assistance
• ICO — Section 17 refusal notices
• ICO — Internal Reviews
• ICO — Determining whether information is held
• ICO — Publication schemes and proactive transparency
• ICO — Make an FOI or EIR complaint