NHS Trust IT blunder overwrites 11 years of maternity records

SerendipityJane · 2026-09-22T14:30:30+00:00

One can't help but speculate whether it would have been treated so lightly had it not been a womens issue ? [[https://www.theregister.com/databases/2026/09/22/nhs-trust-it-blunder-overwrites-11-years-of-maternity-records/5298130 https://www.theregister.com/databases/2026/09/22/nhs-trust-it-blunder-overwrites-11-years-of-maternity-records/5298130]] *^NUH has been unable to completely restore the audit history showing who viewed maternity records during the 11-year period covered by the database. ^*That means the Trust may now be unable, in most cases, to establish whether a particular person looked at a patient's maternity record between September 2011 and November 2022.

pontefractals · 22/09/2026 17:56

One of those occasions when I find it really hard to decide between conspiracy or cock-up, because either seems believable.

NormalityIsOverrated · 22/09/2026 17:58

I think it’s far too convenient in the circumstances for it not to be deliberate. I mean, otherwise people might be held accountable and we can’t have that.

RedToothBrush · 22/09/2026 18:08

How convenient.

Frequency · 22/09/2026 18:13

I'm confused as to what setting they didn't change. I've worked with SQL and Linux, and they're both very pernickety with commands; if a single comma is out of place, they both start screaming in big red letters at you.

endofthelinefinally · 22/09/2026 18:29

pontefractals · 22/09/2026 17:56

One of those occasions when I find it really hard to decide between conspiracy or cock-up, because either seems believable.

I agree. OTOH there have been some sophisticated frauds in the NHS and I can't help wondering if this is an organised attempt to head off another scandal. Maternity care hasn't been subject to decent standards for decades.

Original poster

SerendipityJane · 22/09/2026 18:36

endofthelinefinally · 22/09/2026 18:29

I agree. OTOH there have been some sophisticated frauds in the NHS and I can't help wondering if this is an organised attempt to head off another scandal. Maternity care hasn't been subject to decent standards for decades.

Show quote history

I'd happily see a shift in legal practise so that in cases like this due to the asymmetry of power the onus is on the authority to rebut claims. And if they have managed to destroy lose the evidence they need to do so then ... well bad luck. They have to cough up.

(This is how it works with financial organisations. Which is why you can guarantee your call is being recorded ....)

OP posts:

fsfdl · 22/09/2026 20:31

If you’ve ever had to ring IT support in a NHS hospital like NUH you would have no trouble believing this level of cock up.

CurdinHenry · 22/09/2026 20:33

SerendipityJane · 22/09/2026 18:36

I'd happily see a shift in legal practise so that in cases like this due to the asymmetry of power the onus is on the authority to rebut claims. And if they have managed to destroy lose the evidence they need to do so then ... well bad luck. They have to cough up.

(This is how it works with financial organisations. Which is why you can guarantee your call is being recorded ....)

Show quote history

Until legal responsibility sits with the most senior managers as individuals it won't matter

Other people's money etc

BunfightBetty · 22/09/2026 20:33

SerendipityJane · 22/09/2026 18:36

I'd happily see a shift in legal practise so that in cases like this due to the asymmetry of power the onus is on the authority to rebut claims. And if they have managed to destroy lose the evidence they need to do so then ... well bad luck. They have to cough up.

(This is how it works with financial organisations. Which is why you can guarantee your call is being recorded ....)

Show quote history

Absolutely.

WaterThyme · 22/09/2026 22:53

Frequency · 22/09/2026 18:13

I'm confused as to what setting they didn't change. I've worked with SQL and Linux, and they're both very pernickety with commands; if a single comma is out of place, they both start screaming in big red letters at you.

It’s not just making a command mistake. They must have had backups. Indeed a cycle of backups- not just the last but the previous one. How did they manage to lose all those?

Frequency · 22/09/2026 22:59

WaterThyme · 22/09/2026 22:53

It’s not just making a command mistake. They must have had backups. Indeed a cycle of backups- not just the last but the previous one. How did they manage to lose all those?

Show quote history

Well, yeah, typically a database server would run nightly backups that are kept for X months. And if you're carrying out any big upgrades, you do it in the evening, starting 1 minute after the last backup time.

Fireybricks · 22/09/2026 23:02

There are numerous ways this could have happened. You get what you pay for and if they’ve offshored the work or pay their onshore staff rubbish wages, which they do, that says it all really.

Original poster

SerendipityJane · 23/09/2026 10:26

WaterThyme · 22/09/2026 22:53

It’s not just making a command mistake. They must have had backups. Indeed a cycle of backups- not just the last but the previous one. How did they manage to lose all those?

Show quote history

The reporting is (possibly deliberately) vague.

It's not the data that has been "lost". It's all the records of who has accessed that data and when Imagine a library where all the books are still there, but the record of who borrowed what and when has been destroyed.

Apparently this now means it's impossible to take action against the trust for any data breaches as they won't have the records to investigate. Or even "investigate".

OP posts:

NormalityIsOverrated · 23/09/2026 10:49

WaterThyme · 22/09/2026 22:53

It’s not just making a command mistake. They must have had backups. Indeed a cycle of backups- not just the last but the previous one. How did they manage to lose all those?

Show quote history

Nothing has been 'lost'
As others have said, a series of sequential backups would be saved but I assume that at some point the specific files that contain the access records have been deliberately removed from the backup script. So eventually no backups contained that information.

Original poster

SerendipityJane · 23/09/2026 10:51

NormalityIsOverrated · 23/09/2026 10:49

Nothing has been 'lost'
As others have said, a series of sequential backups would be saved but I assume that at some point the specific files that contain the access records have been deliberately removed from the backup script. So eventually no backups contained that information.

Show quote history

Nothing has been 'lost'

That's not what the story says.

OP posts:

tanstaafl · 23/09/2026 11:04

The audit trail - who was accessing the patient information - should also be kept in the database and backed up along with the database.

I wonder what the legal requirement is for the retention of database backups of patient data, I’d expect it’s years , though you might only keep daily backups for a month to restore business operations and after that weekly and monthly backups for legal purposes.

They’re saying the lost data isn’t recoverable from any of the backups?

PollyNomial · 23/09/2026 11:13

tanstaafl · 23/09/2026 11:04

The audit trail - who was accessing the patient information - should also be kept in the database and backed up along with the database.

I wonder what the legal requirement is for the retention of database backups of patient data, I’d expect it’s years , though you might only keep daily backups for a month to restore business operations and after that weekly and monthly backups for legal purposes.

They’re saying the lost data isn’t recoverable from any of the backups?

The audit trail isn't recoverable, the clinical data has been recovered.

The NHS retention schedules for different classes of data are listed exhaustively here: https://digital.nhs.uk/data-and-information/information-governance/guidance/records-management-code-of-practice/appendix-ii

For care records it's a minimum of 8 years but in practice this is often much longer. e.g. if you had cancer as a child, it's important to keep the records of what radiotherapy you had as it will inform future options if you need it again as an adult.

tanstaafl · 23/09/2026 11:22

PollyNomial · 23/09/2026 11:13

The audit trail isn't recoverable, the clinical data has been recovered.

The NHS retention schedules for different classes of data are listed exhaustively here: https://digital.nhs.uk/data-and-information/information-governance/guidance/records-management-code-of-practice/appendix-ii

For care records it's a minimum of 8 years but in practice this is often much longer. e.g. if you had cancer as a child, it's important to keep the records of what radiotherapy you had as it will inform future options if you need it again as an adult.

Edited

Show quote history

Now I’ve read the article it seems the lost audit trail is from the old IT system and they changed to the new one in November ‘22?

Original poster

SerendipityJane · 23/09/2026 11:41

tanstaafl · 23/09/2026 11:04

The audit trail - who was accessing the patient information - should also be kept in the database and backed up along with the database.

I wonder what the legal requirement is for the retention of database backups of patient data, I’d expect it’s years , though you might only keep daily backups for a month to restore business operations and after that weekly and monthly backups for legal purposes.

They’re saying the lost data isn’t recoverable from any of the backups?

Non trivial database design is an art in itself. And separating out the data from a history of the actions performed upon is would make sense in a lot of situations.

However we all know the script here. No one will be found culpable. Lessons will be learned. And the affected (patients in this case) can go fuck themselves.

As ever. this isn't a "failure" of technology. Which did what it was asked. It's a failure of people and processes.

You can start to see what a lot of people aren't so bothered about AI, if this is the supposed golden age it's threatening.

OP posts:

NormalityIsOverrated · 23/09/2026 11:47

SerendipityJane · 23/09/2026 10:51

Nothing has been 'lost'

That's not what the story says.

Show quote history

Apologies for not being clear, what I meant was deliberately discarded rather than accidentally lost.

Original poster

SerendipityJane · 23/09/2026 12:01

NormalityIsOverrated · 23/09/2026 11:47

Apologies for not being clear, what I meant was deliberately discarded rather than accidentally lost.

Show quote history

Well yes. The system did exactly what was asked of it. If the present situation was not what was wanted then it should not have been actioned.

OP posts: