Nottingham University Hospital maternity data deleted methodically and selectively

Files relating to hundreds of maternity cases at Nottingham University Hospitals NHS Trust (NUH) were methodically and selectively deleted in an intentional act, according to independent and police investigations.

NUH, which was subject to the largest independent review into maternity failings in NHS history, launched in 2022, first discovered that electronic files held by the Medical Examiner's Office, including records of child, neonatal, and maternal deaths between 2019 and 2022, had disappeared 

While the files were restored within weeks, neither the affected families nor the public were informed about the security incident until early 2025.

An investigation by Nottinghamshire Police concluded in June 2025 that the deletion was probably an intentional or malicious act by an individual rather than systemic corruption. A subsequent independent investigation led by a barrister found the deleted data would have been relevant to the independent review into maternity failings. However, even after the records were restored, investigators could not identify the culprit because audit trails were missing. The barrister noted the motive may have involved fears of scrutiny of historical records or an attempt to falsely implicate another individual.

Families campaigning for accountability have condemned the findings, warning that unidentified staff who deliberately destroyed vital medical records could still be delivering clinical care. NUH Chief Executive Anthony May apologised for the distress caused, saying the trust took immediate steps to recover data and implement record-keeping recommendations.

The disclosures follow a separate data incident in August, when maternity records spanning September 2011 to November 2022 were overwritten. An internal investigation attributed the loss to weaknesses in technical controls and human error rather than malicious intent. While patient care files were recovered, the trust acknowledged it could not fully retrieve audit logs tracking who had accessed historical maternity records over those eleven years. 

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.