Healthcare data is among the most sensitive category of personal data. It includes diagnoses, mental health records, treatment histories, medication, genetic information, and intimate clinical details. When it is stolen in a ransomware attack, the consequences for patients are not limited to embarrassment or financial risk — they can include discrimination, insurance difficulties, and in extreme cases, physical safety risks.
Why NHS Data Is Particularly Valuable
Medical records command high prices on criminal marketplaces — typically five to ten times the price of payment card data. The reason is the breadth and permanence of the information. A stolen payment card can be cancelled; a medical history cannot be amended. Health data can be used for identity fraud (combining date of birth, address, and insurance number with a name and medical history creates a highly credible identity package), for insurance fraud, and — in the case of sensitive conditions — for targeted extortion of individuals.
NHS data is also valuable because of its aggregation. A single NHS trust may hold records for hundreds of thousands of patients. A successful attack extracts data at a scale that would require hundreds of separate attacks against individuals to replicate.
Notification Obligations
Under UK GDPR, a data controller — the NHS trust or organisation responsible for the data — must notify the Information Commissioner’s Office of a personal data breach within 72 hours of becoming aware of it, if the breach is likely to result in a risk to the rights and freedoms of individuals. For a significant healthcare ransomware attack, this threshold is almost certain to be met.
Notification to affected individuals is required where the breach is likely to result in a “high risk” to those individuals — a stricter standard than the ICO notification threshold. In practice, NHS trusts have been criticised for slow and incomplete individual notification following major incidents. After the Synnovis attack in 2024, formal notifications to affected patients were significantly delayed relative to the statutory requirement, a failure the ICO noted in its preliminary review.
What the ICO Can Do
The ICO is the supervisory authority for data protection in the UK. Following a significant breach, it can investigate, issue reprimands, impose fines, and make enforcement orders requiring changes to data handling practices. NHS trusts are not immune from ICO fines, but the ICO has historically been cautious about imposing large fines on public bodies, including NHS organisations, because fines effectively reduce resources available for patient care.
The ICO issued a reprimand to an NHS trust following one of the largest ransomware incidents in recent NHS history but did not impose a financial penalty, citing the trust’s “limited financial position” and the steps taken to improve security following the incident. Critics argued this created a weaker deterrent for the NHS than for private healthcare organisations facing the same risk.
What Patients Can Do
If you believe your NHS data has been involved in a breach, you have several options. You can submit a Subject Access Request (SAR) to the relevant trust asking what data they hold about you and how it is being processed. You can complain to the ICO if you believe your data has not been handled lawfully. You can contact your GP or trust to understand whether your records have been affected by a specific incident.
There is no automatic compensation from the NHS for data breaches. However, you may have a legal claim for compensation if you suffered material damage or significant distress as a result of an unlawful breach of your data. Legal action can be taken through the courts; several group litigation claims related to NHS data breaches are currently proceeding.
The Notification Gap
A structural problem in patient notification is that trusts often do not know precisely which records were accessed or exfiltrated during an attack. Ransomware groups frequently encrypt and exfiltrate simultaneously, and determining the exact scope of what was stolen requires forensic analysis that can take months. This creates a dilemma: notify patients quickly with incomplete information, or delay until the scope is known and risk breaching notification timelines.
NHS England’s incident response guidance recommends early notification with an acknowledgment of uncertainty, rather than delayed notification for completeness. The evidence from recent incidents suggests trusts have not consistently followed this approach, with some opting for delayed comprehensive notification over timely partial notification. The ICO has indicated it considers this approach in breach of the notification obligation for high-risk breaches.