Medical regulator drops probe into NHS whistleblower Peter Duffy amid dispute over email evidence

Governor resigns

Computer Weekly can reveal that one governor, herself an ex-whistleblower at UHMBT, has resigned over an alleged lack of transparency she says the governors have encountered when trying to get solutions to their questions on Duffy and the emails.

She mentioned there was a specific obligation on Niche Consult to be clear and accountable about its work at UHMBT, given its investigation had been funded by the taxpayer and there was a substantial public curiosity within the case’s dealing with for health-service customers throughout the UK.

The agency that oversaw the evaluation into the disputed emails, Niche Consult, has been paid round £5m by NHS England because it started its work at UHMBT.

Tampering

Duffy alleges that the belief’s official IT document was tampered with. He claims that the disputed email correspondence, which considerations key choices taken about an aged affected person’s care, was falsified and backdated.

Sue Allison, an ex-whistleblower at UHMBT, resigned from the belief’s board of governors final week, citing a bullying tradition and the shortage of change at UHMBT since she reported affected person security considerations at its breast-screening clinic a decade in the past

The disputed emails relate to the care obtained by the late Peter Read, an aged man from Morecambe who died on account of sepsis on the Royal Lancaster Infirmary in January 2015.

Read’s therapy, which was on the centre of Duffy’s whistleblowing at UHMBT, grew to become the “index case” within the investigation ordered by NHS England and carried out by Niche Consult into the belief’s urology unit.

The probe recognized 19 “missed opportunities” within the string of medical errors that led to Read’s loss of life – one among greater than 500 circumstances by which sufferers had been discovered to have suffered “actual or potential harm” at UHMBT’s urology division.

The belief, NHS England and Niche Consult – a personal agency employed to analyze the belief’s urology companies – have maintained that the emails are real since they first appeared in 2020. An NHS England spokesperson mentioned two unnamed corporations Niche Consult subcontracted to look at Duffy’s email falsification claims undertook “a cyber security assessment, comparison with contemporaneous server logs, and a review of the internet headings”. The spokesperson added that “no evidence” of tampering was discovered by the 2 unnamed corporations.

Forensic evidence

Two main specialists have identified that evaluation of the emails’ full database archive and headers could be wanted to move muster in a court docket setting.

Peter Sommer, digital forensics skilled and visiting professor at Birmingham City University, advised Computer Weekly that evaluation of the total database archive could be “needed” to find out whether or not tampering of the official NHS IT document had taken place.

“For many years now, email programs have stored emails not as individual items but within a database,” he mentioned. “The purpose is to make it much easier for users to find old emails of interest. In a forensic and litigation situation, what is needed is the full database archive. That makes it much more difficult for inconvenient items to be lost or content to be tampered with.”

Ross Anderson, chair of the Foundation for Information Policy Research and a professor on the University of Cambridge, additionally mentioned full disclosure of the email headers and metadata was wanted to adequately decide whether or not falsification had taken place.

He advised Computer Weekly: “When doing email forensics, you look at all the headers in detail. They’re very complicated and you need specialist knowledge to understand them all. For that reason, they’re fiendishly difficult to forge well enough to fool a real expert.”

Sommer highlighted the shortage of sturdy evidence within the copies of the emails equipped to the GMC, which had been within the type of PDF information, including that Niche would probably be required to reveal its unpublished IT report if any proceedings in opposition to Duffy had been to be taken ahead.

The GMC’s tribunal course of is, nonetheless, not topic to the identical guidelines as common court docket disputes.

Full disclosure

Former governor Sue Allison mentioned the shortage of transparency from the NHS in Duffy’s case raised critical questions.

“Vast sums of public money have been spent here,” she mentioned. “If neither we nor the family can see these reports or get answers to some of these questions, then I think it sets a really dangerous precedent for future investigations of this kind. It goes completely against the ethos of the NHS.”

In an October 2022 letter despatched by the belief’s chair, Mike Thomas, Allison and two colleagues had been advised to cease emailing questions on Duffy and UHMBT’s urology service.

“It was agreed at the session with Mary Ann Bruce [of Niche Consult] that no further questions regarding urology would be raised until completion of phase 5 of the Niche investigation, which will be commencing in the next few weeks,” Thomas mentioned in his letter to Allison.

Thomas accused the trio of “hampering the board and the council of governors” by way of their emailed questions and requested them to “refrain” from making additional enquiries round urology and different companies.

Allison additionally mentioned governors have been ordered to make use of solely UHMBT email accounts to debate these issues.

Niche produced two stories – one into the care Read obtained at UMBHT, and one into the provenance of Duffy’s email. It has equipped confidential copies of the stories to Read’s household and to Duffy.

But Read’s daughter, Karen Beamer, advised Computer Weekly that Niche and NHS England had been withholding the stories from the belief’s elected governors and from the broader public in opposition to the household’s needs.

“If you believe in the strength of your evidence, you hand it over and you stand over it,” she mentioned. “Nobody ever had the original ‘source’ of those emails.”

Further questions

Duffy mentioned that “an at-times Kafkaesque” quasi-judicial course of had been hanging over him for almost two-and-a-half years as a result of manner the disputed emails had been dealt with.

He added that plenty of essential questions surrounding the emails’ authenticity had not been adequately addressed by Niche, NHS England or the belief.

One “anomaly” the GMC highlights in its determination letter is that one of many two emails in query, dated 29 December, “appeared” within the inbox of UHMBT’s head of urology, Colin Cutting, “three days before it was sent”.

The GMC’s determination letter reads: “Dr Cutting has given evidence that the email dated 29 December appeared in his inbox dated 26 December (three days earlier than it was despatched).

“We have had sight of screen shots of this email showing the date discrepancy. This differs to the email contained in the inbox of others, which is dated 29 December. We are not aware of any explanation having been provided to explain this anomaly.”

Other senior medics copied into the emails mentioned they haven’t any recollection of getting obtained them, nor of a telephone name on an pressing stent change that’s cited within the second of the 2 emails.

Duffy additionally identified that the belief combed by way of 3,000 departmental emails for the 2018 tribunal listening to that thought of his constructive dismissal declare in opposition to UHMBT.

The choose in that case ordered that each one communications and correspondence referring to Read’s care be handed over to the tribunal.

But the 2 emails in query weren’t disclosed throughout these proceedings – despite the court docket order.

Aaron Cummins, UHMBT’s CEO, confirmed to Duffy earlier this 12 months that the belief had not knowledgeable Niche Consult that the emails had not been disclosed to the tribunal throughout its 2019-2021 investigation into the belief’s urology companies.

Microsoft 365

NHS England, responding on behalf of Niche Consult, mentioned the explanation the 2 emails weren’t discovered earlier was that UHMBT upgraded its IT methods to Microsoft 365 in some unspecified time in the future between 2018 and 2020.

Through Microsoft 365’s extra superior search perform, NHS England’s spokesperson mentioned the emails might lastly be retrieved.

NHS England additionally mentioned Niche employed “two independent cyber security firms” to evaluation Duffy’s email falsification allegations.

The GMC determination letter notes that just one firm held experience in cyber safety, with the opposite agency “having a background in audit”.

Through NHS England commissions, Niche was paid a complete of £1.26m in 2019/20 – the 12 months it started its investigation. The agency was then paid £1.98m in 2020/21 and £1.94m in 2021/22.

NHS England has refused to reveal whether or not it has different contracts with Niche, or to reveal how a lot it has paid the agency for its consultancy work within the UHMBT urology division.

Computer Weekly has reported on plenty of current NHS whistleblowing circumstances that elevate critical questions across the approaches taken and regard given by tribunals to evaluate digital evidence.

Aaron Cummins, chief government of UHMBT, mentioned: “Whilst we respect Mr Duffy’s proper to share his model of occasions in no matter manner he feels acceptable, it is very important do not forget that the current and intensive impartial investigation by Niche Health and Social Care Consulting, commissioned by NHS England and NHS Improvement, seemed into the entire considerations raised concerning the belief’s urology companies, together with these considerations outlined in Mr Duffy’s first e book. That investigation said that not all of the claims in that e book had been correct.

“With regards to the claims that these emails were falsified, the two separate independent, external reviews of those allegations conducted by Niche Health and Social Care Consulting as part of their investigation found no evidence the emails in question were tampered with and no evidence they were not sent from Mr Duffy’s NHS hospital email account.”