Maternity Data Exposure At NHS Trust

A administrative error within NHS Forth Valley has compromised the personal information of approximately 150 individuals. The incident occurred when a staff member transferred a spreadsheet containing maternity system data to a personal email address, triggering an official investigation by the health board.

Internal Transfer Of Sensitive Records

The health board, which provides services for the region between Edinburgh and Glasgow, confirmed that the data involved patients who had accessed local maternity services. While officials stated that much of the spreadsheet contained unidentifiable information, the file included sensitive details such as full names, dates of birth, NHS numbers, pregnancy treatment information, and the total number of children for each affected woman.

Investigation Into The Data Breach

The health board has officially notified both Police Scotland and the Information Commissioner’s Office regarding the unauthorized transfer. According to the Trust, the employee involved in the incident was a fully qualified, non-clinical staff member who reportedly intended to use the data for analytical purposes.

An internal investigation is underway after a member of staff transferred a spreadsheet containing an extract of data from our maternity system to their personal email address.

— A spokesperson, NHS Forth Valley

Current Status Of Affected Data

The organization has stated that it has contacted the affected individuals directly. Regarding the security of the information, the Trust noted the following points:

• Approximately 150 women were impacted by the unauthorized data transfer.
• The member of staff involved has confirmed that the data has since been deleted.
• The Trust currently has no evidence that the information has been shared beyond the initial unauthorized location.

Persistent Security Challenges For NHS

The incident at NHS Forth Valley occurs within a broader context of email-related security failures across the UK public sector. Previous administrative errors have included the NHS Digital incident involving a failed BCC attempt during a cybersecurity event, as well as multiple instances where trusts failed to protect sensitive health data during bulk communications. These recurring issues suggest that despite ongoing efforts to improve data handling, the reliance on manual email processes continues to pose significant risks to patient privacy.