ipopba - stock.adobe.com

Medical regulator drops probe into NHS whistleblower Peter Duffy amid dispute over email evidence

The General Medical Council has dropped an investigation into an NHS whistleblower who exposed widespread clinical harm at Morecambe Bay Trust amid questions over disputed email evidence

The UK’s chief regulator for doctors has dropped an investigation into an NHS whistleblower who exposed hundreds of cases of harm at a hospital trust in north-west England, following a dispute over the authenticity of emails put forward as evidence by the trust.

Consultant urologist Peter Duffy, 61, has faced disciplinary proceedings at the General Medical Council (GMC), which could have led to him being barred from practice, for over two years. 

The case centred on the contents of two disputed emails that Morecambe Bay Trust (UHMBT) produced as evidence a number of years after Duffy blew the whistle on patient safety at the trust.

The GMC has now found there is no case to answer.

In a 30-page decision letter, the GMC highlighted the “particular regard” it gave to its “inability to place weight” on an IT report that had found there was no evidence of tampering or foul play over the disputed emails.

The GMC said it was unable to assess the report since a company commissioned by the NHS to oversee the exercise, Niche Consult, now known as Niche Health & Social Care Consulting, did not disclose it to the GMC during the 30-month probe.

Niche subcontracted two “independent cyber security firms” to carry out the review “on a blind basis from each other”, according to NHS England.

The review assessed Duffy’s claims that emails apparently sent by him in 2014 – but that were not discovered until 2020 – had been falsified.

The GMC also found that a key interview transcript provided to investigators by the firm was unsigned and that “the deletion of Mr Duffy’s inbox” meant it was not possible to interrogate his email history.

Leading IT experts have told Computer Weekly that the withholding of a secret cyber security report into Duffy’s email allegations from the GMC’s probe and the format of the emails supplied to the regulator, in PDF form, meant there was a “particularly weak” basis to use them as evidence against Duffy.

A picture of Peter Duffy, a consultant urologist who lifted the lid on more than 500 cases of clinical harm at Morecambe Bay NHS Trust

“I think it’s important to highlight, before anything else, just how close we came to a significant miscarriage of justice here”

Peter Duffy, a consultant urologist who lifted the lid on more than 500 cases of clinical harm at Morecambe Bay NHS Trust

The case prompted one of the trust’s governors to resign last week over what she described as a lack of transparency on the part of the trust and attempts to “suppress” governors asking questions about the case.

Duffy told Computer Weekly that the disputed emails, which emerged nearly five years after he lost his job for speaking out on department-wide patient safety harm, could have seen him struck off and potentially facing criminal charges.

“I think it’s important to highlight, before anything else, just how close we came to a significant miscarriage of justice here,” he said.

The firm that oversaw the review into the disputed emails, Niche Health & Social Care Consulting has been paid around £5m by NHS England since it began its work at UHMBT.

Governor resigns

Computer Weekly can reveal that one governor, herself an ex-whistleblower at UHMBT, has resigned over an alleged lack of transparency she says the governors have encountered when attempting to get answers to their questions on Duffy and the emails.

Sue Allison stepped down from the trust on Tuesday 30 May, citing a bullying culture and the lack of change at UHMBT since she reported patient safety concerns at its breast-screening clinic a decade ago.

She told Computer Weekly that she and other governors had been “suppressed” when asking questions of the trust over the emails and Niche's review.

She said there was a particular obligation on Niche Health & Social Care Consulting to be transparent and accountable about its work at UHMBT, given its investigation had been funded by the taxpayer and there was a considerable public interest in the case’s handling for health-service users across the UK.

Tampering

Duffy alleges that the trust’s official IT record was tampered with. He claims that the disputed email correspondence, which concerns key decisions taken about an elderly patient’s care, was falsified and backdated.

Picture of Sue Allison, an ex-whistleblower at UHMBT, who resigned from the trust’s board of governors last week, citing a bullying culture and the lack of change at UHMBT since she reported patient safety concerns at its breast-screening clinic a decade ago

Sue Allison, an ex-whistleblower at UHMBT, resigned from the trust’s board of governors last week, citing a bullying culture and the lack of change at UHMBT since she reported patient safety concerns at its breast-screening clinic a decade ago

The disputed emails relate to the care received by the late Peter Read, an elderly man from Morecambe who died as a result of sepsis at the Royal Lancaster Infirmary in January 2015.

Read’s treatment, which was at the centre of Duffy’s whistleblowing at UHMBT, became the “index case” in the investigation ordered by NHS England and carried out by Niche into the trust’s urology unit.

The probe identified 19 “missed opportunities” in the string of clinical errors that led to Read’s death – one of more than 500 cases in which patients were found to have suffered “actual or potential harm” at UHMBT’s urology department.

The trust, NHS England and Niche Health & Social Care Consulting  – a private firm hired to investigate the trust’s urology services – have maintained that the emails are genuine since they first appeared in 2020. An NHS England spokesperson said two unnamed companies Niche Consult subcontracted to examine Duffy’s email falsification claims undertook “a cyber security assessment, comparison with contemporaneous server logs, and a review of the internet headings”. The spokesperson added that “no evidence” of tampering was found by the two unnamed firms.

Forensic evidence

Two leading experts have pointed out that analysis of the emails’ full database archive and headers would be needed to pass muster in a court setting.

Peter Sommer, digital forensics expert and visiting professor at Birmingham City University, told Computer Weekly that analysis of the full database archive would be “needed” to determine whether tampering of the official NHS IT record had taken place.

“For many years now, email programs have stored emails not as individual items but within a database,” he said. “The purpose is to make it much easier for users to find old emails of interest. In a forensic and litigation situation, what is needed is the full database archive. That makes it much more difficult for inconvenient items to be lost or content to be tampered with.”

Ross Anderson, chair of the Foundation for Information Policy Research and a professor at the University of Cambridge, also said full disclosure of the email headers and metadata was needed to adequately determine whether falsification had taken place.

He told Computer Weekly: “When doing email forensics, you look at all the headers in detail. They’re very complicated and you need specialist knowledge to understand them all. For that reason, they’re fiendishly difficult to forge well enough to fool a real expert.”

Sommer highlighted the lack of robust evidence in the copies of the emails supplied to the GMC, which were in the form of PDF files, adding that Niche would likely be required to disclose its unpublished IT report if any proceedings against Duffy were to be taken forward.

“The PDFs used in this situation are particularly weak as evidence,” he said. “They don’t even include the ‘source’ or header data, which must have been in the original and is an essential tool for spotting forgery. The international standards are: IETF RFC 2076, 2156, 5322.

“The unpublished IT report from the two unnamed cyber security companies should surely fall to be disclosed in any regular civil litigation.”

The GMC’s tribunal process is, however, not subject to the same rules as regular court disputes.

Anderson also said: “The normal practice in a trial is for the best evidence, i.e. the full emails, to be provided to the other side, so that their expert can examine them.

The medical regulator noted in its review that it did not hire independent IT experts to review evidence in relation to the emails’ authenticity.

Full disclosure

Former governor Sue Allison said the lack of transparency from the NHS in Duffy’s case raised serious questions.

“Vast sums of public money have been spent here,” she said. “If neither we nor the family can see these reports or get answers to some of these questions, then I think it sets a really dangerous precedent for future investigations of this kind. It goes completely against the ethos of the NHS.”

In an October 2022 letter sent by the trust’s chair, Mike Thomas, Allison and two colleagues were told to stop emailing questions about Duffy and UHMBT’s urology service.

“It was agreed at the session with Mary Ann Bruce [of Niche Health & Social Care Consulting] that no further questions regarding urology would be raised until completion of phase 5 of the Niche investigation, which will be commencing in the next few weeks,” Thomas said in his letter to Allison.

Thomas accused the trio of “hampering the board and the council of governors” through their emailed questions and asked them to “refrain” from making further enquiries around urology and other services.

Allison also said governors have been ordered to use only UHMBT email accounts to discuss these matters.

Niche produced two reports – one into the care Read received at UMBHT, and one into the provenance of Duffy’s email. It has supplied confidential copies of the reports to Read’s family and to Duffy.

But Read’s daughter, Karen Beamer, told Computer Weekly that Niche and NHS England were withholding the reports from the trust’s elected governors and from the wider public against the family’s wishes.

“If you believe in the strength of your evidence, you hand it over and you stand over it,” she said. “Nobody ever had the original ‘source’ of those emails.”

Further questions

Duffy said that “an at-times Kafkaesque” quasi-judicial process had been hanging over him for nearly two-and-a-half years due to the way the disputed emails were handled.

He added that a number of crucial questions surrounding the emails’ authenticity had not been adequately addressed by Niche, NHS England or the trust.

One “anomaly” the GMC highlights in its decision letter is that one of the two emails in question, dated 29 December, “appeared” in the inbox of UHMBT’s head of urology, Colin Cutting, “three days before it was sent”.

The GMC’s decision letter reads: “Dr Cutting has given evidence that the email dated 29 December appeared in his inbox dated 26 December (three days before it was sent).

“We have had sight of screen shots of this email showing the date discrepancy. This differs to the email contained in the inbox of others, which is dated 29 December. We are not aware of any explanation having been provided to explain this anomaly.”

Other senior medics copied into the emails said they have no recollection of having received them, nor of a phone call on an urgent stent change that is cited in the second of the two emails.

Duffy also pointed out that the trust combed through 3,000 departmental emails for the 2018 tribunal hearing that considered his constructive dismissal claim against UHMBT.

The judge in that case ordered that all communications and correspondence relating to Read’s care be handed over to the tribunal.

But the two emails in question were not disclosed during those proceedings – in spite of the court order.

Aaron Cummins, UHMBT’s CEO, confirmed to Duffy earlier this year that the trust had not informed Niche that the emails had not been disclosed to the tribunal during its 2019-2021 investigation into the trust’s urology services.

Microsoft 365

NHS England, responding on behalf of Niche, said the reason the two emails were not found earlier was that UHMBT upgraded its IT systems to Microsoft 365 at some point between 2018 and 2020.

Through Microsoft 365’s more advanced search function, NHS England’s spokesperson said the emails could finally be retrieved.

NHS England also said Niche hired “two independent cyber security firms” to review Duffy’s email falsification allegations.

The GMC decision letter notes that only one company held expertise in cyber security, with the other firm “having a background in audit”.

Through NHS England commissions, Niche was paid a total of £1.26m in 2019/20 – the year it began its investigation. The firm was then paid £1.98m in 2020/21 and £1.94m in 2021/22.

NHS England has refused to disclose whether it has other contracts with Niche, or to disclose how much it has paid the firm for its consultancy work in the UHMBT urology department.

Computer Weekly has reported on a number of recent NHS whistleblowing cases that raise serious questions around the approaches taken and regard given by tribunals to assess digital evidence.

Aaron Cummins, chief executive of UHMBT, said: “Whilst we respect Mr Duffy’s right to share his version of events in whatever way he feels appropriate, it is important to remember that the recent and extensive independent investigation by Niche Health and Social Care Consulting, commissioned by NHS England and NHS Improvement, looked into all of the concerns raised about the trust’s urology services, including those concerns outlined in Mr Duffy’s first book. That investigation stated that not all the claims in that book were accurate.

“With regards to the claims that these emails were falsified, the two separate independent, external reviews of those allegations conducted by Niche Health and Social Care Consulting as part of their investigation found no evidence the emails in question were tampered with and no evidence they were not sent from Mr Duffy’s NHS hospital email account.”

Peter Duffy’s whistleblowing journey

December 2014: Peter Read, 76, is admitted to the Royal Lancaster Infirmary with intermittent bowel obstruction, after a series of admissions for vomiting and stomach pain.

January 2015: Read dies of a stroke brought on by sepsis at the Royal Lancaster Infirmary, after delays in changing an overdue kidney stent.

August 2016: Peter Duffy, a consultant urologist surgeon who blew the whistle on Peter Read’s care and clinical follow-up, loses his job at the University Hospitals of Morecambe Bay NHS Foundation Trust (UHMBT) after he said “a clear and sustained campaign of victimisation, vilification and disinformation was aimed at me by the clinicians who were responsible for the clinical errors and avoidable deaths”.

August 2017: Then health secretary Jeremy Hunt hails UHMBT as “an example to the rest of the NHS” and notes its “remarkable transformation into a leading light of patient safety”, following what was then the NHS’s biggest ever maternity scandal (2004-2013), which led to national reforms.

June 2018: Duffy wins payout of more than £100,000 at an employment tribunal through a constructive dismissal claim against UHMBT.

July 2019: Duffy self-publishes a book, entitled Whistle in the wind, which lifts the lid on departmental failings at UHMBT going back 10-15 years.

September 2019: NHS England undertakes an “external review” of UHMBT’s urology service, following the widely publicised disclosures of Duffy’s book.

November 2019: Niche Consult, now known as Niche Health & Social Care Consulting is commissioned by NHS England to carry out the investigation and the private firm begins work on a two-year exercise.

February 2020: Duffy receives an anonymous letter, purportedly from a UHMBT employee, informing him that senior managers have ordered trust staff to hide files on Duffy’s whistleblowing from the main NHS regulator and scrutiny bodies. The letter adds that one senior manager has said of Duffy: “He had damages us [sic] and I will make sure to bring him to court and will not sit until he is jailed.”

August-September 2020: Two emails surface that appear to implicate Duffy in the string of clinical errors that led to Read’s avoidable death.

September 2020: The General Medical Council (GMC) receives two separate PDF copies of the emails in question from two of Duffy’s former colleagues who featured in his whistleblowing claims of poor care.

September 2020: According to Duffy, Niche “springs” the emails on him “without warning” during one of two interviews the firm carries out with him via Microsoft Teams. They go on to form a significant part of its developing urology report.

October 2020: Niche commissions two unnamed firms to review the emails in question, after Duffy raises concerns that they had been falsified, or that the IT record had been tampered with. The review finds no evidence of the suspected tampering. Niche determines that there was no evidence the emails were not sent by Duffy and proceeds to use them in the main report it is developing into UHMBT’s urology service.

January 2021: The then medical director at UHMBT corresponds with GMC over Duffy and the contents of the emails. UHMBT does not notify the GMC that Duffy had been a whistleblower at the trust, going against recommended NHS practice.

May 2021: GMC notifies Duffy of the formal investigation it has opened into him.

August 2021: UHMBT is placed in the NHS equivalent of “special measures” for the first time since 2014.

November 2021: Niche publishes its main report into UHMBT’s urology services, finding that there were 19 “missed opportunities” in respect of Read’s care and that his case was one of more than 500 in which patients were found to have suffered “actual or potential harm” at the trust’s urology department.

November 2021: Two reports, which deal with Duffy’s allegations concerning the disputed emails and with the care of the late Peter Read, respectively, are completed. The reports are not published and are not provided to the GMC to aid its ongoing investigation.

November 2021: Duffy self-publishes his second book, Smoke and mirrors, which deals directly with the email allegations.

October 2022: UHMBT chair Mike Thomas writes to elected governors informing them they should stop sending emails asking questions around Duffy and the disputed emails since dealing with them is “hampering the board and council of governors”. He says this is in line with an agreement reached between Niche and UHMBT. Governors are ordered to use only UHMBT electronic communications systems to discuss these matters.

May 2023: GMC drops investigation into Duffy due to conflicting evidence over emails.

Read more on Healthcare and NHS IT

CIO
Security
Networking
Data Center
Data Management
Close