Last reviewed: Next review due:
Who is subject to NHS FOI requests?
All NHS trusts (acute, mental health, ambulance, and community), NHS foundation trusts, Integrated Care Boards (ICBs), NHS England, NHS Digital (now NHS England Digital), and NHS Improvement are public authorities subject to FOIA 2000. Special Health Authorities, NHS Blood and Transplant, NHS Resolution, and the Care Quality Commission (CQC) are also covered.
Crucially, GP practices and pharmacy contractors are not directly subject to FOIA — they are independent contractors. If you need primary care data, you must request it from NHS England or the relevant ICB, which commission and oversee GP services and hold aggregate performance and spend data.
In Scotland, NHS bodies are subject to FOISA 2002 and the Scottish Information Commissioner oversees compliance. In Wales, NHS Wales bodies are subject to FOIA 2000 and the UK ICO. In Northern Ireland, Health and Social Care Trusts are subject to FOIA 2000.
NHS structure in England (post-2022)
- NHS England — national commissioner, policy, and oversight
- 42 Integrated Care Boards (ICBs) — replaced CCGs from July 2022; commission local services
- NHS Trusts & Foundation Trusts — provide acute, mental health, ambulance, and community services
- CQC — independent regulator; holds inspection reports and ratings data
- NHS Digital / NHSE Digital — holds national datasets including hospital activity, prescribing, and workforce
- GP practices / pharmacies — NOT subject to FOIA directly
High-value NHS FOI topics
- 1Waiting times by specialty or department — go beyond the published RTT data to get trust-level breakdowns by consultant or ward.
- 2Mortality data — Hospital Standardised Mortality Ratios (HSMR) and Summary Hospital Mortality Indicator (SHMI) at specialty level.
- 3Never events — counts by category per trust per year; what corrective actions were taken.
- 4Infection rates — MRSA, C. difficile, and surgical site infections by ward or specialty.
- 5Complaints data — total complaints received, upheld rate, and most complained-about departments.
- 6Expenditure on locum and agency staff by specialty and financial year.
- 7IT system procurement and project costs — particularly EPR (electronic patient record) implementations.
- 8Mixed-sex ward accommodation breaches — counts and penalties paid.
- 9Ambulance response time data broken down below the published national category averages.
- 10Mental health: number of patients detained under the Mental Health Act by section and outcome; out-of-area placements and costs.
Red flags in an NHS FOI refusal
- S.40 personal data claimed for aggregate statistics — aggregate counts are not personal data unless the cell size is so small the individual could be identified.
- S.41 (information provided in confidence) used for internal reports — challenge whether the duty of confidence was properly established.
- S.43 commercial interests cited for an agency staffing framework contract that was publicly tendered.
- S.22 (information intended for future publication) used to delay disclosure of data that has no scheduled publication date.
- A blanket "not held" response when the data is clearly part of mandatory national reporting to NHS England.
- A trust redirecting you to NHS England or NHS Digital for data that the trust itself holds locally.
- The response arrives more than 20 working days after the request was received.
NHS FOI request checklist
- Confirmed the body I am requesting from is an NHS public authority (not a GP practice or pharmacy).
- Checked NHS Digital / NHS England published datasets before filing — the data may already be public.
- Searched WhatDoTheyKnow for previous requests to the same trust on the same topic.
- Specified data by financial year (April to March) to match NHS reporting cycles.
- Asked for aggregate counts, not patient-identifiable data, to avoid s.40 issues.
- Identified the trust's FOI officer or information governance team as the correct recipient.
- For Scotland: confirmed the body is subject to FOISA and the Scottish Information Commissioner.
- Set a 20-working-day diary reminder from the date of confirmed receipt.
- Prepared a data comparison using NHS Digital benchmarking data to contextualise the response.
- If refused: drafted an internal review citing the specific exemption and requesting the public interest analysis.
Generate an NHS FOI request in minutes
Our FOI Request Builder includes NHS-specific templates for trusts and ICBs, pre-formatted for common health data requests.
Open FOI Request BuilderCommon mistakes
- Filing an FOI to a GP practice — they are not subject to FOIA. Go to the ICB instead.
- Requesting data that is already published nationally by NHS Digital — it will be refused as accessible by other means (s.21).
- Asking for identifiable patient information — this will be refused under s.40 and rightly so. Always ask for aggregate counts.
- Not specifying a date range — broad undated requests are likely to hit the cost limit.
- Treating ICBs as CCGs — CCGs were abolished in July 2022. Check the current ICB boundaries.
- Forgetting that Scottish NHS bodies go to the Scottish Information Commissioner, not the ICO.
- Accepting a "commercially sensitive" refusal for NHS agency rate information without challenging the public interest test.
Related guides
Police FOI Requests
Forces, statistics, and misconduct data — scope, tactics, and common refusals.
Local Authority FOI Requests
Council data strategy including social care and housing.
Data Journalism for Beginners
How to find, clean, and analyse NHS open data.
FOI Request Builder
NHS-specific templates ready to send to trusts and ICBs.
Primary sources
- Freedom of Information Act 2000 — Schedule 1 public authorities (legislation.gov.uk)
- NHS England — FOI disclosure log (england.nhs.uk)
- NHS Digital — published statistical datasets (digital.nhs.uk)
- Scottish Information Commissioner (itspublicknowledge.info)
- Care Quality Commission — inspection reports and ratings (cqc.org.uk)
- NHS England — never events data (england.nhs.uk)
- WhatDoTheyKnow — NHS FOI requests (whatdotheyknow.com)
Frequently asked questions
Are GP practices subject to FOIA?
Generally no. GP practices are independent contractors, not NHS bodies, and are not listed in Schedule 1 of FOIA 2000. Pharmacy contractors are also excluded on the same basis. However, NHS England (which commissions primary care) and Integrated Care Boards (ICBs) are subject to FOIA and hold data about primary care contracts, performance, and spend. If you need aggregate data about GP practices in an area, ask the relevant ICB rather than the practice itself.
What is an Integrated Care Board (ICB) and how does it replace CCGs?
Integrated Care Boards replaced Clinical Commissioning Groups (CCGs) in England in July 2022 under the Health and Care Act 2022. There are 42 ICBs covering England, each responsible for commissioning NHS services for a geographic area. ICBs are public bodies subject to FOIA. They hold data on commissioned services, contracts with NHS providers and independent sector providers, workforce plans, and financial allocations. If your pre-2022 FOI was sent to a CCG, you would now send it to the relevant ICB.
What are "never events" and can I obtain data on them via FOI?
Never events are serious, largely preventable patient safety incidents that should never occur if the correct protocols are followed — for example, wrong-site surgery, retained foreign objects after surgery, or medication given by the wrong route. NHS England publishes aggregate never event data nationally, but individual trusts hold data on their own never events. Via FOI you can request the number of never events by category from a specific trust for a specified period. Trusts sometimes cite s.40 (personal data) or s.41 (information provided in confidence) as reasons to withhold detail — you should request aggregate counts, not patient-identifiable information.
What data can I get about agency and locum staff costs?
Agency and locum staff spending has been a persistent NHS pressure point. Via FOI you can request: total spend on agency nursing staff by financial year; number of agency shifts by ward or specialty; spend on locum medical staff; any controls or caps applied to agency rates; and the names of agencies the trust has a framework contract with (aggregate spend by agency name is usually disclosable). Trusts sometimes claim commercial sensitivity under s.43 for individual agency rates — challenge this if the framework contract has been publicly tendered.
Is there a separate FOI regime for Scottish NHS bodies?
Yes. NHS Scotland bodies — including Health Boards, NHS National Services Scotland, the Scottish Ambulance Service, and NHS 24 — are subject to the Freedom of Information (Scotland) Act 2002 (FOISA), overseen by the Scottish Information Commissioner rather than the ICO. The substantive rights are similar but there are procedural differences: you make an internal review request to the authority, and if unsatisfied you apply to the Scottish Information Commissioner (not the ICO). Scottish NHS bodies also have a 20-working-day response deadline.