Key facts
- Nearly 50 NHS staff members inappropriately accessed medical records of Southport knife attack victims.
- The data breach occurred at Aintree Hospital in Liverpool, run by University Hospitals of Liverpool Group (UHLG).
- Victims affected included a 13-year-old girl and teacher Leanne Lucas.
- The breach was discovered through a standard information access audit in the days after the July 2024 attack.
- Patients were not informed of the breach until this week, almost two years later.
- UHLG stated that staff involved faced disciplinary processes ranging from counselling to written warnings, with no dismissals.
Nearly 50 staff members at Aintree Hospital in Liverpool inappropriately accessed the medical records of victims of the July 2024 Southport knife attack, the hospital trust has admitted. The data breach, which occurred in the days following the attack, only emerged this week. Some of the injured, including a 13-year-old girl and teacher Leanne Lucas, were only informed of the breach almost two years later.
The University Hospitals of Liverpool Group (UHLG), which runs Aintree, stated the breach was 'inexcusable'. The incident came to light through a standard information access audit conducted by the trust shortly after the attack. Leanne Lucas, who was critically injured in the attack, expressed her devastation and horror at her privacy being invaded, and anger that the decision to keep the breach from her for almost two years was a 'new low'.
James Sumner, chief executive of UHLG, apologized for the distress caused and said staff involved faced disciplinary processes ranging from informal counselling to final written warnings, with none being dismissed. He stated that the decision not to inform patients earlier was based on clinical advice regarding potential psychological impact. The Information Commissioner's Office confirmed it was aware of the breach but is not currently launching a criminal investigation.