Key facts
- NHS Blood and Transplant (NHSBT) sent sensitive medical data, including names and dates of birth, over an unencrypted pager network.
- The data pertained to UK transplant patients, detailing organs being offered or needed.
- The use of pagers for this data continued despite a 2019 directive to phase them out by 2021.
- NHSBT has acknowledged the incident as a data breach, reported it to the Information Commissioner, and ceased the practice.
- Other NHS services, including ambulance trusts and fire services, also utilized the pager network for transmitting various sensitive details.
NHS Blood and Transplant (NHSBT) has admitted to a significant data breach involving the transmission of sensitive medical information of UK transplant patients over an unencrypted pager network. The data, which included patient names, dates of birth, and details about organs being offered or needed, was sent to hospital transplant teams using pagers.
This practice continued despite a 2019 announcement by then-Health Secretary Matt Hancock that NHS services in England should stop using pagers by 2021. NHSBT stated it was "deeply sorry" for the breach and has reported the incident to the Information Commissioner, confirming that it has now ceased sending patient data in this manner.
Investigations revealed that the use of pagers for sensitive data was not isolated to NHSBT. Messages containing various details, including mental health incidents and medication information, were sent by ambulance trusts and fire services over the pager network. While NHSBT does not use pagers itself, it utilized a system that sent messages to them. The company operating the pager network indicated that its terms and conditions advise customers against transmitting sensitive information over radio or public networks, as signals may be intercepted.
Tech experts expressed concern over the inherent privacy risks associated with pager technology, noting they were "never meant for privacy" and could broadcast messages widely, potentially allowing unauthorized reception. The Department for Health and Social Care acknowledged that while progress has been made in replacing outdated technology, efforts are ongoing to ensure staff have secure digital tools.