Request

1. All pharmacy or contractor staff involved

2. DPIA documentation or data sharing agreements relevant to this case.

The NHS Business Services Authority (NHSBSA) received your request on 22 May 2025.

We have handled your request under the Freedom of Information Act 2000 (FOIA).

Our response

Question 1 - All pharmacy or contractor staff involved

I am writing to advise you that the information you requested is not held by the NHSBSA. The NHSBSA does not receive information about which staff were involved in the issuing of your prescription, as this is not information which we need to process the prescription. You may wish to ask the pharmacy directly for this information.

Question 2 - DPIA documentation or data sharing agreements relevant to this case

I can confirm that the NHSBSA holds the information you have requested and a copy of the data sharing agreement between the NHSBSA and the Department of Work and Pensions (DWP) which covers data shared in connection with checking the validity of exemptions claimed by patients.

Exempt Information

Some of the information contained in the document is exempt from disclosure. Please see below explanation of the exemptions which apply. When reading the document, all redactions are made under Section 40, with the exception of two which are made under section 31 of FOIA, which are labelled as such.

Section 40(2) – Personal Data

Please be aware that I have decided not to release full details of all staff as this information falls under the exemption in Section 40 subsections 2 and 3(A)(a) of the Freedom of Information Act.

This is because it would breach the first data protection principle as:

a) It is not fair to disclose these people’s personal details to the world and is likely to cause damage or distress to staff.

b) These details are
not of sufficient interest to the public to warrant an intrusion into the privacy of those staff.

Please click the below web link to see the exemption in full.

https://www.legislation.gov.uk/ukpga/2000/36/section/40

Section 31 – Crime Prevention

The information you requested is being withheld as it falls under the exemption in sections 31(1)(a) of the Freedom of Information Act. In applying this exemption we have balanced the public interest in withholding the information against the public interest in disclosing the information.

The below sets out the factors considered when deciding that in all the circumstances of the case, the public interest in maintaining the exemption outweighs the public interest in disclosing the information.

Factors for disclosure

It is in the public interest to know that the appropriate measures are being used to secure personal data.

Factors for withholding

• Disclosure of information on security measures used would allow would-be cyber criminals to target their attacks in a way which allow an increased chance of success.

• A successful cyber-attack could lead to a loss of personal data, some of which is sensitive.

• A successful cyber-attack and subsequent data loss would cause substantial damage and distress to data subjects.

• Such a data loss would lead to a loss of service, which would impact on the general public.

• Disclosure of phone numbers would leave the department exposed to vishing, that is a type of scam where a fraudster tries to trick you into giving away personal or financial information over the phone.

• Disclosure of the phone number in question would enable the public to contact them, distracting them from important work in keeping our information secure.

• The phone number withheld is not a public number, intended for internal use only.

Reasons why public interest favours withholding information

I consider that the public transparency in releasing this information is outweighed by the potential detrimental effect on the prevention or detection of crime and the increased cost to the tax payer that this would represent.

Please click the below web link to see the exemption in full.

https://www.legislation.gov.uk/ukpga/2000/36/section/31

Links in the Document

The links within the document are no longer “clickable” following our redactions. Please see those links below:

Paragraph 14 – Legal Gateways

The NHS Business Services Authority (Payments, charges, Recovery of Charges and Penalty Charges) Directions 2015 - https://www.nhsbsa.nhs.uk/sites/default/files/2017-02/Section_2_-_B5_NHS_BSA_2015_Directions_payments_and_charges.pdf

Social Security (Information-sharing) (NHS Payments and Remission of Charges etc.) (England)) Regulations 2015 SI 2015/124 - https://www.legislation.gov.uk/uksi/2015/124/contents/made

Paragraph 17 - Transparency

https://www.gov.uk/government/organisations/department-for-work-pensions/about/personal-information-charter

Personal information charter - Public Health England - GOV.UK (www.gov.uk)

Paragraph 28 – rights of data subjects

https://www.gov.uk/government/organisations/department-for-work-pensions/about/personal-information-charter#your-rights-when-dwp-uses-your-information

https://www.gov.uk/government/organisations/department-for-work-pensions/about/personal-information-charter

Right to rectification form – https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fassets.publishing.service.gov.uk%2Fgovernment%2Fuploads%2Fsystem%2Fuploads%2Fattachment_data%2Ffile%2F710547%2Fmake-an-information-rights-request-to-dwp.odt&wdOrigin=BROWSELINK

Right to restrict processing – https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fassets.publishing.service.gov.uk%2Fgovernment%2Fuploads%2Fsystem%2Fuploads%2Fattachment_data%2Ffile%2F710547%2Fmake-an-information-rights-request-to-dwp.odt&wdOrigin=BROWSELINK

Right to object form – https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fassets.publishing.service.gov.uk%2Fgovernment%2Fuploads%2Fsystem%2Fuploads%2Fattachment_data%2Ffile%2F710547%2Fmake-an-information-rights-request-to-dwp.odt&wdOrigin=BROWSELINK

Data Queries

Please contact foirequests@nhsbsa.nhs.uk ensuring you quote the above reference if you have any specific questions regarding this response; or, if you feel you may be misunderstanding or misinterpreting the information; or, if you plan on publishing the data. Reusing the data and copyright

If you plan on producing a press or broadcast story based upon the data please contact communicationsteam@nhsbsa.nhs.uk. This is important to ensure that the figures are not misunderstood or misrepresented.

The information supplied to you continues to be protected by the Copyright, Designs and Patents Act 1988 and is subject to NHSBSA copyright. This information is licenced under the terms of the Open Government Licence detailed at:

http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/

Should you wish to re-use the information you must include the following statement: “NHSBSA Copyright 2025”. Failure to do so is a breach of the terms of the licence.

Information you receive which is not subject to NHSBSA Copyright continues to be protected by the copyright of the person, or organisation, from which the information originated. Please obtain their permission before reproducing any third party (non NHSBSA Copyright) information.