CQC demands answers over Southport attack data breach

The Care Quality Commission is investigating whether the trust where staff inappropriately viewed the records of Southport attack victims met its “duty of candour” after the provider was accused of a “cover up”, HSJ can reveal.

The regulator is understood to be asking further questions to determine whether University Hospitals of Liverpool Group met its statutory transparency regulations when it decided not to tell the patients about the breach. 

It is understood the regulator’s fresh intervention was prompted by HSJ  revealing last week that 48 hospital staff had inappropriately accessed files of victims who had survived a stabbing at a children’s dance studio in Southport in 2024. 

UHLG decided not to inform victims of the breach the following year. The trust said this was because they were concerned it could retraumatise patients.  

But the patients responded furiously when HSJ revealed the trust had decided it would not inform impacted patients about the breach and accused the trust of  an “attempted cover-up”.  

One of those impacted, Leanne Lucas, said discovering patients had not been told about the data breach was a “new low”. 

The Care Quality Commission was originally informed about the breach “at the time of the incident”. But the regulator took no action at this stage.

However, since HSJ’s story last week, it has now emerged that the regulator is in fresh contact with the trust “to follow-up with regards to their review of the duty of candour”. 

Read full story (paywalled)

Source: HSJ, 22 May 2026