Data Breach at Aintree Hospital Following Southport Knife Attack
A hospital trust has acknowledged that nearly 50 staff members accessed the medical records of victims of the Southport knife attack inappropriately.
The breach occurred at Aintree Hospital in Liverpool, where some of the injured were treated in the days following the July 2024 attack, but the incident only came to light this week.
The BBC understands that the three patients affected included a 13-year-old girl who had been helping to supervise the Taylor Swift-themed dance class targeted in the attack, as well as adult teacher Leanne Lucas.
The NHS University Hospitals of Liverpool Group (UHLG), which manages Aintree, described the breach as "inexcusable" and stated that changes have been implemented, although no staff members have been dismissed.
Lucas was stabbed five times during the attack, which resulted in the deaths of three young girls and left eight children and another adult seriously injured.
"I am absolutely devastated and horrified that my privacy has been invaded when I was at my most vulnerable," she said.
"Nothing will take away my gratitude to the staff who saved my life, but 48 people not involved in my care abused their position of trust to access the files of victims who have suffered unspeakable trauma."
The breach was reportedly discovered during a routine information access audit conducted by the trust shortly after the attack.
Nicola Ryan-Donnelly, from Fletcher's Solicitors representing the teenage patient, commented:
"This is a deeply disturbing abuse of power and a shocking breach of privacy into the care of several Southport victims, including a young girl.
Our client, who is now growing into a young woman, is old enough to properly understand what this means: that staff opened her records, not to aid to her recovery but to pry."
James Sumner, chief executive of UHLG, expressed the trust's regret:
"We are sincerely sorry for any distress that may have been caused to the patients."
He added that staff members found to have accessed patient records faced disciplinary measures ranging from informal counselling to final written warnings, but none were dismissed.
Lucas stated:
"The decision to keep this from me for almost two years is a new low.
I am speaking out as I want this scandal and the attempted cover up by senior management exposed for what it is."
She revealed to the BBC that she only learned about the breach on Thursday when the hospital's chief nurse informed her.
Lucas believes the disclosure was prompted by a journalist from the Health Service Journal contacting the hospital.
She added:
"I'm also angry that the Information Commissioner's Office was told about it in August 2024, and I've only been told now because I was about to read about it in a paper."
The trust has denied allegations of a cover-up.
Sumner explained that the decision not to inform patients earlier was based on clinical advice, considering the potential psychological impact at the time.
He also confirmed that relevant regulators and professional bodies were notified.
The Information Commissioner's Office (ICO) stated it does not intend to initiate a criminal investigation "at this time," but reiterated the importance of healthcare organisations maintaining patient data security.
Solicitor Nicola Brook of Broudie Jackson Canter, representing adult survivors of the attack, said:
"This is a truly unbelievable breach of privacy for victims of one of the most horrific attacks this country has ever seen.
This is more than a few bad apples when it was 48 different members of staff who for no legitimate reason, chose to access vulnerable victims' records.
That speaks to a culture, and one that will only change if there are real consequences for those responsible.
For the Trust to then try to hide that it happened is appalling. The Trust has many questions to answer and we will be ensuring our clients get those answers as soon as possible."
Ryan-Donnelly described the two-year delay in informing her client as "absolutely shameful" and called for the trust to provide more answers to the teenage girl's family and ensure staff face appropriate accountability.
Profoundly Troubling Reaction from MPs
The Labour MP for Southport, Patrick Hurley, told the BBC he was "deeply concerned" by the data breach reports.
"The suggestion that confidential records may have been accessed without legitimate reason, particularly at a time when survivors and families were at their most vulnerable, is profoundly troubling."
"We must make sure this doesn't happen again, either here in Southport or in other high profile cases where people are receiving confidential health care."
Layla Moran MP, Chair of the Health and Social Care Committee, said any breach of this nature "fundamentally undermines patient confidence."
The shadow health secretary, Stuart Andrew, stated:
"Any inappropriate access to confidential medical records is a serious violation of that trust and should never have happened.
The vast majority of NHS staff uphold the highest professional standards every day under immense pressure. Where those standards are breached, it is right that disciplinary action is taken."
Trust Statement and Measures Taken
The UHLG issued a statement:
"Breaches of patient confidentiality are inexcusable and undermine the hard work of those teams who sought to provide the highest standard of care to these patients after they experienced such traumatic and life-changing events.
Staff who were found to access patient records were subject to HR disciplinary processes.
When we concluded our investigation into the incident, we consulted the clinical team who had managed the patients' care and made a decision not to inform the patients involved, taking into consideration the potential psychological impact it may have upon them at the time.
We notified the relevant regulators and professional bodies, including the ICO, and were fully transparent about any findings and actions taken. Learning from the incident has led to the introduction of a digital solution which reduces inappropriate access to patient records of this nature."
The patients affected were all treated at Aintree University Hospital in the immediate aftermath of the attack.
Listen to the best of BBC Radio Merseyside on Sounds and follow BBC Merseyside on Facebook, X, and Instagram. You can also send story ideas via Whatsapp to 0808 100 2230.
Leanne Lucas nearly died in the attack.
