Addenbrooke's hospital apologises after data breaches

The information of more than 20,000 maternity and cancer patients was shared.

The two data breaches happened in 2020 and 2021.

Both were the result of mistakenly including patient information in Excel spreadsheets in response to Freedom of Information Act (FOI) requests. 

The information included the patients’ names, hospital numbers and some medical information.

No home addresses or dates of birth were included, and no evidence has been found in either case of the information being accessed or shared any further.

The first case related to data provided in a FOI request via the What Do They Know website.

In responding to the request, Addenbrooke's mistakenly shared some personal data which was not immediately visible in a spreadsheet provided, but which could be accessed via a ‘pivot table’.

This data related to 22,073 patients booked for maternity care at The Rosie Hospital between 2 January 2016 and 31 December 2019. 

It included the names and hospital numbers of patients and their birth outcomes.

The What Do They Know website group alerted the Trust to the breach and promptly removed the information from their own website.

Following this discovery, Addenbrooke's undertook a review of all the FOI requests (around 8,000) it has responded to in the past 10 years. 

In doing this, one further case was discovered where patient data was mistakenly contained in a spreadsheet sent in 2021 as part of a FOI response to Wilmington PLC. 

The hospital has requested confirmation from Wilmington PLC that it has been deleted.

This data related to 373 cancer patients on clinical trials and included their names, hospital numbers and some medical information.

There is no evidence in either case of the information being accessed or shared beyond the original recipients.

Roland Sinker, the Chief Executive of Cambridge University Hospitals NHS Foundation Trust says he recognises that the errors are unacceptable, and has apologised unreservedly.

Daniel Zeichner, MP for Cambridge:

"This a serious data breach, which should not have happened.

"I am pleased that once they were aware, the Trust has acted swiftly and responsibly, in consultation with patient groups, and has put in place sensible measures to support those affected. 

"Anyone concerned should contact the Trust for support. 

"There now needs to be a full review to ensure that this cannot happen again."

A dedicated freephone helpline has been setup so that any patients who are concerned their data is involved can contact the hospital on 0808 175 6331.

Patients can also email the data helpline.

Addenbrooke's has informed the Information Commissioner’s Office about both data breaches and says it has taken immediate steps to strengthen the FOI processes to ensure that this kind of human error does not take place again.