Second trust’s delay telling Southport victims of data breaches was ‘appalling’

An ambulance trust waited nearly two months before informing victims of the 2024 Southport attack that their patient records may have been accessed inappropriately by staff, HSJ has discovered.

North West Ambulance Service Trust began a formal investigation into potential breaches of privacy in May after HSJ  revealed that University Hospitals of Liverpool Group had discovered 48 staff had accessed the records of Southport victims. 

By 20 May, NWAS had identified 14 staff whose accessing of the records of 13 patients might not have been justified. The trust alerted the Information Commissioner’s Office to the potential breaches on 6 July.

HSJ has obtained the trust’s communications with the regulator.

It said “FOIs, public investigations and press release[s]” about unauthorised access over the Southport attack had “prompted a review” of its own systems.

The claim was made despite evidence that NWAS became aware in early 2025 that its staff might also have breached patient confidentiality.

Read full story (paywalled)

Source: HSJ, 2 September 2026