Medical regulator drops probe into NHS whistleblower Peter Duffy amid dispute over email evidence

Governor resigns

Computer Weekly can reveal that one governor, herself an ex-whistleblower at UHMBT, has resigned over an alleged lack of transparency she says the governors have encountered when attempting to get answers to their questions on Duffy and the emails.

Sue Allison stepped down from the trust on Tuesday 30 May, citing a bullying culture and the lack of change at UHMBT since she reported patient safety concerns at its breast-screening clinic a decade ago.

She told Computer Weekly that she and other governors had been “suppressed” when asking questions of the trust over the emails and Niche's review.

She said there was a particular obligation on Niche Health & Social Care Consulting to be transparent and accountable about its work at UHMBT, given its investigation had been funded by the taxpayer and there was a considerable public interest in the case’s handling for health-service users across the UK.

Tampering

Duffy alleges that the trust’s official IT record was tampered with. He claims that the disputed email correspondence, which concerns key decisions taken about an elderly patient’s care, was falsified and backdated.

Sue Allison, an ex-whistleblower at UHMBT, resigned from the trust’s board of governors last week, citing a bullying culture and the lack of change at UHMBT since she reported patient safety concerns at its breast-screening clinic a decade ago

The disputed emails relate to the care received by the late Peter Read, an elderly man from Morecambe who died as a result of sepsis at the Royal Lancaster Infirmary in January 2015.

Read’s treatment, which was at the centre of Duffy’s whistleblowing at UHMBT, became the “index case” in the investigation ordered by NHS England and carried out by Niche into the trust’s urology unit.

The probe identified 19 “missed opportunities” in the string of clinical errors that led to Read’s death – one of more than 500 cases in which patients were found to have suffered “actual or potential harm” at UHMBT’s urology department.

The trust, NHS England and Niche Health & Social Care Consulting  – a private firm hired to investigate the trust’s urology services – have maintained that the emails are genuine since they first appeared in 2020. An NHS England spokesperson said two unnamed companies Niche Consult subcontracted to examine Duffy’s email falsification claims undertook “a cyber security assessment, comparison with contemporaneous server logs, and a review of the internet headings”. The spokesperson added that “no evidence” of tampering was found by the two unnamed firms.

Forensic evidence

Two leading experts have pointed out that analysis of the emails’ full database archive and headers would be needed to pass muster in a court setting.

Peter Sommer, digital forensics expert and visiting professor at Birmingham City University, told Computer Weekly that analysis of the full database archive would be “needed” to determine whether tampering of the official NHS IT record had taken place.

“For many years now, email programs have stored emails not as individual items but within a database,” he said. “The purpose is to make it much easier for users to find old emails of interest. In a forensic and litigation situation, what is needed is the full database archive. That makes it much more difficult for inconvenient items to be lost or content to be tampered with.”

Ross Anderson, chair of the Foundation for Information Policy Research and a professor at the University of Cambridge, also said full disclosure of the email headers and metadata was needed to adequately determine whether falsification had taken place.

He told Computer Weekly: “When doing email forensics, you look at all the headers in detail. They’re very complicated and you need specialist knowledge to understand them all. For that reason, they’re fiendishly difficult to forge well enough to fool a real expert.”

Sommer highlighted the lack of robust evidence in the copies of the emails supplied to the GMC, which were in the form of PDF files, adding that Niche would likely be required to disclose its unpublished IT report if any proceedings against Duffy were to be taken forward.

“The PDFs used in this situation are particularly weak as evidence,” he said. “They don’t even include the ‘source’ or header data, which must have been in the original and is an essential tool for spotting forgery. The international standards are: IETF RFC 2076, 2156, 5322.

“The unpublished IT report from the two unnamed cyber security companies should surely fall to be disclosed in any regular civil litigation.”

The GMC’s tribunal process is, however, not subject to the same rules as regular court disputes.

Anderson also said: “The normal practice in a trial is for the best evidence, i.e. the full emails, to be provided to the other side, so that their expert can examine them.

The medical regulator noted in its review that it did not hire independent IT experts to review evidence in relation to the emails’ authenticity.

Full disclosure

Former governor Sue Allison said the lack of transparency from the NHS in Duffy’s case raised serious questions.

“Vast sums of public money have been spent here,” she said. “If neither we nor the family can see these reports or get answers to some of these questions, then I think it sets a really dangerous precedent for future investigations of this kind. It goes completely against the ethos of the NHS.”

In an October 2022 letter sent by the trust’s chair, Mike Thomas, Allison and two colleagues were told to stop emailing questions about Duffy and UHMBT’s urology service.

“It was agreed at the session with Mary Ann Bruce [of Niche Health & Social Care Consulting] that no further questions regarding urology would be raised until completion of phase 5 of the Niche investigation, which will be commencing in the next few weeks,” Thomas said in his letter to Allison.

Thomas accused the trio of “hampering the board and the council of governors” through their emailed questions and asked them to “refrain” from making further enquiries around urology and other services.

Allison also said governors have been ordered to use only UHMBT email accounts to discuss these matters.

Niche produced two reports – one into the care Read received at UMBHT, and one into the provenance of Duffy’s email. It has supplied confidential copies of the reports to Read’s family and to Duffy.

But Read’s daughter, Karen Beamer, told Computer Weekly that Niche and NHS England were withholding the reports from the trust’s elected governors and from the wider public against the family’s wishes.

“If you believe in the strength of your evidence, you hand it over and you stand over it,” she said. “Nobody ever had the original ‘source’ of those emails.”

Further questions

Duffy said that “an at-times Kafkaesque” quasi-judicial process had been hanging over him for nearly two-and-a-half years due to the way the disputed emails were handled.

He added that a number of crucial questions surrounding the emails’ authenticity had not been adequately addressed by Niche, NHS England or the trust.

One “anomaly” the GMC highlights in its decision letter is that one of the two emails in question, dated 29 December, “appeared” in the inbox of UHMBT’s head of urology, Colin Cutting, “three days before it was sent”.

The GMC’s decision letter reads: “Dr Cutting has given evidence that the email dated 29 December appeared in his inbox dated 26 December (three days before it was sent).

“We have had sight of screen shots of this email showing the date discrepancy. This differs to the email contained in the inbox of others, which is dated 29 December. We are not aware of any explanation having been provided to explain this anomaly.”

Other senior medics copied into the emails said they have no recollection of having received them, nor of a phone call on an urgent stent change that is cited in the second of the two emails.

Duffy also pointed out that the trust combed through 3,000 departmental emails for the 2018 tribunal hearing that considered his constructive dismissal claim against UHMBT.

The judge in that case ordered that all communications and correspondence relating to Read’s care be handed over to the tribunal.

But the two emails in question were not disclosed during those proceedings – in spite of the court order.

Aaron Cummins, UHMBT’s CEO, confirmed to Duffy earlier this year that the trust had not informed Niche that the emails had not been disclosed to the tribunal during its 2019-2021 investigation into the trust’s urology services.

Microsoft 365

NHS England, responding on behalf of Niche, said the reason the two emails were not found earlier was that UHMBT upgraded its IT systems to Microsoft 365 at some point between 2018 and 2020.

Through Microsoft 365’s more advanced search function, NHS England’s spokesperson said the emails could finally be retrieved.

NHS England also said Niche hired “two independent cyber security firms” to review Duffy’s email falsification allegations.

The GMC decision letter notes that only one company held expertise in cyber security, with the other firm “having a background in audit”.

Through NHS England commissions, Niche was paid a total of £1.26m in 2019/20 – the year it began its investigation. The firm was then paid £1.98m in 2020/21 and £1.94m in 2021/22.

NHS England has refused to disclose whether it has other contracts with Niche, or to disclose how much it has paid the firm for its consultancy work in the UHMBT urology department.

Computer Weekly has reported on a number of recent NHS whistleblowing cases that raise serious questions around the approaches taken and regard given by tribunals to assess digital evidence.

Aaron Cummins, chief executive of UHMBT, said: “Whilst we respect Mr Duffy’s right to share his version of events in whatever way he feels appropriate, it is important to remember that the recent and extensive independent investigation by Niche Health and Social Care Consulting, commissioned by NHS England and NHS Improvement, looked into all of the concerns raised about the trust’s urology services, including those concerns outlined in Mr Duffy’s first book. That investigation stated that not all the claims in that book were accurate.

“With regards to the claims that these emails were falsified, the two separate independent, external reviews of those allegations conducted by Niche Health and Social Care Consulting as part of their investigation found no evidence the emails in question were tampered with and no evidence they were not sent from Mr Duffy’s NHS hospital email account.”