NHS Blood & Transplant apologizes for patient data breach via unencrypted pagers
A BBC investigation revealed that NHS Blood & Transplant sent sensitive patient data over an unencrypted pager network, prompting an apology from the organization.
The Full Story
A plain summary built from the channels that reported this story.
A BBC investigation has found that NHS Blood & Transplant, the organisation responsible for matching organ donors with patients, sent sensitive medical data over an unencrypted pager network. The organisation, based in Filton near Bristol, has apologised for the data breach and referred itself to the Information Commissioner.
The investigation discovered that donor and recipient names, dates of birth and medical details were routinely transmitted to staff carrying pagers. The pagers in use were first released in 1995, and the NHS in England was told by the government to stop using them by 2021. However, NHS Blood & Transplant and some other parts of the health service continued to send messages via the open and unencrypted national pager network, which has multiple users.
NHS Blood & Transplant said the information was being sent as part of urgent communications to transplant teams, but it did not realise the messages were not encrypted until the BBC told them. The organisation has now changed its system and started an internal investigation. In a statement, it said: "We're deeply sorry that this has happened and that their information may have been intercepted. And we're deeply sorry for any concern that it may cause."
The BBC also found that over a 10-day period, hundreds of messages were sent to pagers via the same network by ambulance trusts, hospitals and fire services. These included details of mental health incidents, medication, and the name of a patient trying to take their own life. The Department of Health said any patient information should be handled securely and in line with data protection requirements.
Experts said pagers were never designed to keep information private. One expert noted that pagers are reliable, cheap and effective in buildings with thick walls, but "the problem is when you start broadcasting to the world potentially, private information, and that's when it gets hairy."
For an organisation responsible for some of the most sophisticated medicine in the country, many will question why sensitive patient information continued to be broadcast on technology from another era.
On screen
Stills are sampled automatically at 60-second intervals. Where shown, the still is the nearest available frame from the relevant broadcast segment and is included to show what was on screen during that part of the broadcast. A still may not correspond to the exact second of a quoted phrase.
Key Claims
Claims reported during this story's coverage, mapped by channel. Ordered by how many channels carried each claim.
| Claim | BBC One |
|---|---|
| Hundreds of messages from ambulance trusts, hospitals and fire services were sent over the same network in a 10-day period. | |
| NHS Blood & Transplant sent sensitive patient data over an unencrypted pager network. | |
| The organisation referred itself to the Information Commissioner and started an internal investigation. |
Channel Perspectives
What each channel focused on, with key quotes.
Sky News did not cover the pager data breach story at all. Its broadcast focused on other NHS-related news, specifically the waste of medicines and the estimated cost to the health service, as well as international news about Gaza. The channel's editorial tone on NHS matters was about financial waste and efficiency, not data security.
- “It has warned that wasted medicines could be costing the NHS £480 million a year.”
- “So it's a lot of waste for the NHS.”
BBC ONE West provided the sole detailed coverage of the pager data breach. The report highlighted the contrast between the organisation's state-of-the-art headquarters and its reliance on outdated technology, and emphasised the seriousness of the breach, the apology, and the wider use of unencrypted pagers across the NHS. The tone was investigative and critical, with expert commentary on the risks.
- “We're deeply sorry that this has happened and that their information may have been intercepted.”
- “Pagers have a lot of advantages... The problem is when you start broadcasting to the world potentially, private information, and that's when it gets hairy.”
Broadcast Timeline
News broadcasts tracked for this story, in time order.