Case: 202300128
NHS organisation: NHS 24
Subject: Patient safety
Date: May 2025
Summary
C raised a formal concern about a number of issues that they had witnessed in their work environment. A number of C’s concerns related to the management of risk during part of a digital transformation programme.
NHS 24 identified four main topics from C’s concern and investigated these under the procedure within the National Whistleblowing Standards (the Standards). NHS 24’s investigation concluded that there was due consideration of the risks involved in the programme. While there was some evidence that an incident during the programme had not been reported correctly, it was noted that the additional support process in place during the programme mitigated this issue. Finally, the investigation did not uphold C’s concerns about actioning a recommendation from an audit, or the working culture within the directorate.
C was not satisfied with the response they received from NHS 24 and they requested an independent review from the INWO.
Our investigation focussed on whether NHS 24 had effectively managed the risks that C had referred to when raising their concern. We obtained independent advice from a professional adviser with expertise in IT. Following a review of the evidence and taking into account the advice we received, we considered that NHS 24’s decision making in relation to the concerns was reasonable. We did not uphold this aspect of C’s complaint.
We also considered whether NHS 24 handled C’s concern in line with the Standards. After reviewing the investigation file, we were satisfied that NHS 24’s investigation was sufficiently thorough and that it involved appropriate witnesses.
However, we identified one area where NHS 24 should improve its processes to ensure that confidentiality is maintained effectively. In view of this, we upheld this aspect of C’s complaint and made recommendations.
Recommendations
What we asked the organisation to do in this case:
- Apologise to C for not protecting their identity within the investigation report. The apology should meet the standards set out in the SPSO guidelines on apology available at www.spso.org.uk/information-leaflets.
- Remove C’s name and identifiable details from the investigation report. Ensure all copies of the investigation report held on NHS 24 systems are replaced with the updated version.
In relation to compliance with the Standards, we recommended:
- Confidentiality must be maintained as far as possible in all aspects of the procedure for raising concerns. Staff need to know that their identity will not be shared with anyone other than the people they have agreed can know it, unless the law says that it can or must be.
- The name of the person raising the concern must not be routinely or automatically shared at any point, either during the investigation or afterwards.