NHS staff accessed Southport victims' records inappropriately, hospital admits
NHS staff accessed Southport victims' records inappropriately, hospital admits
Nearly 50 NHS staff viewed victims' medical records after the Southport knife attack, with families left uninformed for almost two years.
In the days after a July 2024 knife attack in Southport, an audit at the University Hospitals of Liverpool Group revealed a data breach: 48 staff accessed the medical records of victims who were treated at Aintree Hospital in Liverpool. The breach affected several people, including a 13-year-old girl who helped supervise a Taylor Swift-themed dance class and an adult teacher, Leanne Lucas. Leanne was among the injured, stabbed five times, and she required multiple surgeries. The trust said the breach was "inexcusable" and that changes have since been made, though no-one has been sacked. The victims were not told about the breach for almost two years. The information access audit that followed the attack uncovered this inappropriate access to records, prompting the trust to review its safeguarding and privacy measures.
The breach emerged from a standard information access audit carried out by the trust in the days after the attack, highlighting how easily sensitive data can be accessed in care settings. Leanne Lucas spoke of the impact, saying, "I am absolutely devastated and horrified that my privacy has been invaded when I was at my most vulnerable." Nicola Ryan-Donnelly, representing the teenage patient, called it a "deeply disturbing abuse of power". The incident has intensified calls for stronger privacy protections and clearer transparency when breaches occur.
