The NHS has paid out £1.5m in data breach claims. ‘Unauthorised access’ to personal data is the most prevalent breach in the UK’s health sector.

NHS Trusts have forked out more than £1.5million in data breach claims since 2021 amid a ‘worrying’ rise in both cyber and non-cyber security attacks across the UK.

An investigation by Legal Expert has revealed a stark increase both in terms of human error and cyber-attacks throughout the NHS.

Data Breach specialist at LE, Eleanor Coleman says: “This rise in the Health Sector is worrying and we hope that organisations are ensuring that they have sufficient security in place to protect people’s personal information.”

The NHS is expected to collect, store, use, share and dispose of personal information or data about individuals, in line with the General Data Protection Regulation (GDPR) and the Data Protection Act (DPA).

Under data protection law, organisations must have appropriate technical and organisational systems in place to ensure personal data is kept safe and not inappropriately disclosed to others.

According to the ICO (Information Commissioner’s Office), data breaches within the health sector have risen by 21% between 2022 and 2023.

The most common of which are recorded as ‘unauthorised access’ - this is when an unauthorised individual has gained access to personal data and can include prohibited disclosures.

It describes instances where an individual has unlawfully accessed or disclosed information and where a third party has forcibly accessed a system.

Given the extremely sensitive nature of information health by the NHS, data breaches within its systems can have concerning impacts.

Most recently, South Tees Hospital NHS Foundation Trust was reprimanded for a “serious, harmful data breach” by the ICO which resulted in a disclosure containing sensitive information to an unauthorised family member.

Legal Expert conducted an investigation following an influx of enquiries about data breaches in the healthcare sector, particularly within the NHS.

In 2022, a total of 1,607 data breaches were reported to ICO from the health sector, this soared to 1,949 incidents the following year.

So far this year, between January 1 – March 20, 2024, a total of 505 data breaches have been reported by the health sector to ICO. That’s an average of 168 incidents a month. If the trajectory continues, figures could reach record highs this year of around 2,020.

Data obtained through a series of Freedom of Information Requests to every NHS Trust in the UK revealed those that have had the most data breach claims lodged against them as well as the trusts forking out the most in compensation for such claims.

All NHS Trusts provided the requested information. A total of 897 Data Breach claims were lodged against NHS Trusts between the financial years 2020/21 and 2022/23.

In this time period, 418 claims were closed with a compensation payment. The total amount of damages paid by the NHS for these claims was £1,537,295.

Some 212 data breach claims were closed during this period with NIL damages paid out.

Legal Expert’s investigation reveals a total of 20 NHS Trusts paid out thousands in data breach compensation claims in the last three years.

Wrightington, Wigan and Leigh NHS Trust came far and above any other in the UK, with a hefty compensation pay-out total of £79,650 in the last three years.

Between the financial years, 2020/21 and 2022/23, the trust had 61 claims lodged against it.

During this time, it settled 47 claims, paying out a total of nearly £80K.

The second highest amount was paid out by Norfolk and Norwich University Hospitals NHS Foundation Trust.

It forked out a total of £46,875 since 2020 but this was for a total of five data breach claims.

The trust came under fire in 2019 after sending personal details of patients to wrong addresses.

Victims of a breach may be able to claim compensation providing a certain set of criteria is met.

Expert Eleanor Coleman says: “We have noticed an increase in data breaches generally over the last year, both in terms of human error and cyber-attacks.

“We understand that this is worrying and hope that organisations are ensuring that they have sufficient security in place to protect people’s personal information.

“In terms of compensation, this is dependent upon what has happened, the information which has been subject to the data breach and the distress it has caused. A lot of cases can be settled without the need to issue Court proceedings, but if this is necessary, then we would advise clients accordingly.”

Legal Expert has a team of experts on hand to offer free guidance and advice for anyone with concerns following a data breach.

They operate a 24-hour helpline and live chat service which you can access on their website.

ENDS

Notes to Editors

This data was gathered by FOI requests to all NHS Trusts, available upon request.

Information into data breach incident types and figures was obtained via an FOI request to the ICO.

Press release terms of use:

A hyperlink to (https://www.legalexpert.co.uk/data-breach-compensation/medical-data-breach-compensation-claims/research-statistics-on-nhs-data-breach-compensation-claims) must be inserted when using our research/release.

Infographic copyright: Legalexpert.co.uk

For queries,collaboration or further information contact journalism@billionmedia.co.uk

Logo

Images

Tags

More Like This

New data laws unveiled to improve public services and boost UK economy by £10 billion

IBM Report: Escalating Data Breach Disruption Pushes Costs to New Highs

8 million Brits lose sleep over healthcare fears as NHS league tables show 80% of Trusts ‘off track’

Cyber insurance claims fall as businesses refuse ransom payments and recover themselves, according to Databarracks

Over Half of UK Organisations Experienced a Security Breach Resulting from Third-Party Access in the Past Year, Imprivata Study Finds

Tough new laws to strengthen the UK's defences against cyber attacks on NHS, transport and energy

NHS Tops Public Trust Rankings for AI Use

IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls