NHS Blood and Transplant service admits data breach due to unsecured pager network

Sensitive medical data belonging to transplant patients across the UK was routinely transmitted over an unencrypted pager network, an investigation by the BBC has revealed.

NHS Blood and Transplant (NHSBT) acknowledged that patient names, dates of birth, organ details, tissue-match scores, and calculated reaction frequency (cRF) factors were sent to hospital teams using unencrypted pagers. NHSBT has apologised, ceased sending patient information via this method, and reported the data breach to the Information Commissioner's Office (ICO).

The investigation also discovered that other public bodies transmitted unencrypted messages, including the North West Ambulance Service (NWAS) and Northern Ireland Ambulance Service (NIAS), which shared addresses and medical details. Although the NHS had committed to phasing out pagers in England by 2021, legacy use persisted due to strong building signal penetration and battery life.

The network operator stated that secure options exist, noting that customers decide deployment and are advised against sending sensitive data over unencrypted radio networks. 

The ICO has confirmed it is investigating the incident.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.