Nottingham Hospital Trust Wiped 11 Years of Maternity Record Access Logs After IT Worker Ran Wrong Script

An IT worker at Nottingham University Hospitals NHS Trust (NUH) ran the wrong script on August 18, 2026. The result: 11 years of records showing who accessed maternity data got wiped out.

According to NUH's own account, published in a blog post Monday, September 21, and reported by the Nottingham Post, the trust was trying to copy a radiotherapy database for reporting purposes. The technician used a set of pre-written computer instructions built for a different hospital system entirely. A setting that should have been changed before running it was missed. Instead of copying the radiotherapy database, the process ran against the maternity records database and overwrote it.

That database held maternity records for women and babies treated at NUH from September 2011 to November 2022, pulled from the trust's previous system, known as Medway, according to NUH and confirmed by ITV.

What Got Lost, What Didn't

NUH says clinical data survived. Notes, observations, test results, and other information tied to a patient's actual care were restored after the trust worked with outside specialists, per the Ars Technica report on NUH's blog post.

What didn't survive: the audit trail. NUH says it "may be unable to confirm whether a maternity record was viewed by a particular person" during that 11-year window. In plain terms, if someone accessed a mother's or baby's file between 2011 and 2022, and it wasn't supposed to happen, there's now no reliable way to prove it.

NUH insists this doesn't touch current patients. "No patient information was accessed or used inappropriately as a result of this incident," the trust said, and stressed the error doesn't affect maternity care being delivered today.

Andy Callow, NUH's Chief Digital and Information Officer, apologized directly: "I am sorry for the concern and distress this incident may cause to women and families affected." The trust says it completed a patient safety investigation and has since strengthened its technical controls, though it hasn't detailed what those changes are.

NUH also says it notified the Information Commissioner's Office within the required timeframe and alerted Nottinghamshire Police, which is assessing whether the loss affects Operation Perth, its ongoing criminal investigation into NUH's maternity care.

Why This Lands Differently at NUH

This isn't an isolated IT hiccup at a random hospital. NUH is at the center of the Donna Ockenden review, the largest maternity care investigation in NHS history, published in June 2026. ITV reports the review examined 2,500 families over 20 years and found more than 500 mothers and babies suffered potentially avoidable harm, with 162 deaths linked to substandard care.

Families from that review are furious, and their concern is legitimate on its face. Carl Everson, whose baby was wrongly diagnosed with a fatal fetal abnormality leading to a termination at City Hospital in 2019, told West Bridgford Wire the news left him and partner Carly Wesson "deeply distressed." He said they found out through a third party, not directly from the trust. "For some of the families, all they have left is police investigations," Everson said. "We don't know the answer to this at the moment or if it could impact families' cases."

Access logs are how you prove or disprove whether someone inappropriately viewed a deceased or harmed patient's file. NUH has a documented history on that exact front: the trust previously dismissed 11 staff members after they were found to have inappropriately accessed records of victims of the 2023 Nottingham attacks, according to ITV. So this isn't a hypothetical risk. It's happened before at this trust, with unrelated records.

A skeptic might reasonably ask whether "human error" is the full story, given NUH's track record. The two prior incidents should be separated cleanly. A separate case, reported by Ars Technica, involved a different file that Nottinghamshire Police concluded in June 2025 was likely erased "intentionally or maliciously" — and that file was recovered days later. This new incident is a distinct event, roughly 14 months later, and NUH's account, corroborated across NUH's own blog, the Nottingham Post, and ITV, describes it as a script misconfiguration, not a deliberate act. No source in this reporting disputes that characterization or presents evidence of intent.

What's Unresolved

Nottinghamshire Police has not yet said whether the lost access logs will hamper Operation Perth. NUH has not detailed exactly what "technical controls" it strengthened, nor said how many individual patient records were affected by the audit-trail gap. The ICO has not issued a public finding on this specific incident, and no timeline has been given for when families will be individually notified about whether their records fall inside the affected window. Everson said the trust should have contacted affected families directly before the story became public; NUH's public statements so far don't address that criticism.