NHS service admits data breach due to pager use

Pager Network Exposed UK Transplant Patient Records

Ninoda.com – Medical information belonging to transplant recipients throughout Britain was regularly transmitted through a pager system lacking encryption, according to an NHS organization. A BBC examination revealed that NHS Blood and Transplant distributed patient names, birth dates, and organ classifications to hospital transplant staff utilizing pagers, without realizing the transmissions were unprotected.

Timeline and Response

Back in 2019, Matt Hancock, who served as Health Secretary at the time, declared that English NHS facilities ought to discontinue pager usage by 2021. Nevertheless, certain organizational divisions maintained their pager operations. The organization expressed sincere regret and formally notified the Information Commissioner regarding the security incident. Furthermore, it confirmed that patient data transmissions via this method have ceased.

Understanding Pager Technology

These compact radio receivers, powered by batteries, gained popularity during the 1980s and 1990s. They accept brief text communications, callback numbers, and notification alerts. Operating as a one-directional system, pagers only receive rather than transmit messages, which contributed to their decline as mobile phones became ubiquitous. Although NHSBT maintains no physical pagers within its facilities, it utilizes a messaging infrastructure that delivers communications to pager devices.

Since pager message recipients remain untraceable, the organization stated uncertainty about whether the unprotected information was accessed and could not determine the total number of individuals impacted. Originally adopted for swift information distribution, pagers operate on low frequencies enabling signals to pass through structures, elevators, and hospitals with reinforced walls designed to shield against X-ray and radiation exposure. Extended battery performance represents another advantage.

Broader Network Impact

Our investigation uncovered that communications extended beyond NHSBT boundaries. Over a ten-day period, hundreds of transmissions traveled across the pager network involving ambulance services, healthcare facilities, and fire departments. Various information types appeared in these messages, encompassing psychiatric emergencies, pharmaceutical details, and the identity of an individual attempting suicide.

The NHS maintains legal obligations to safeguard patient information. Where legacy technologies persist, the Department for Health emphasized that all patient data must be managed securely and comply with data protection standards.

Expert Perspectives

Anthony Clarkson, who leads organ transplantation at NHS Blood and Transplant, explained that the organization employed a system designed for urgent communications to transplant teams where timing proves essential. Communications traveled through email, SMS text, and until recently, pagers.

“We accept it was a data breach,” Clarkson stated. “We were surprised that these messages were not encrypted, and that vulnerability was there.”

Clarkson noted that immediate actions have been implemented to halt sensitive information transmission to the pager network, alongside an internal review to prevent recurrence.

Tech specialist Luca Arnaboldi, assistant professor at the University of Birmingham, characterized pager technology—originating in the 1950s but predominantly utilized from the 1980s—as “never meant for privacy.” He expressed significant concern regarding potential risks to the NHS.

“It broadcast messages to a large area – potentially a whole building – but even nationwide, and anybody can receive it as long as they’re on the right frequency,” Arnaboldi explained. “If any information on it were to be private, anybody could be listening to it. It could cause some serious security issues.”

He continued, noting that worst-case scenarios involve unauditable records of compromised information, with uncertainty about potential misuse.

NHSBT acknowledged the security failure following BBC notification. The organization’s organ transplantation leadership confirmed that transmitted messages contained organ availability information alongside recipient names, birth dates, tissue-matching scores, and immunosuppression risk factors designated as cRF.