A Reused Script Wiped 11 Years of Access Logs at an NHS Trust

A reused script with one setting left unchanged has wiped out 11 years of access history at Nottingham University Hospitals NHS Trust in England. Staff doing routine work on Aug. 18 to copy a radiotherapy database for reporting ran a set of pre-written instructions that had been used on another hospital system. A setting that should have been changed first was missed, and the job overwrote the trust’s old Medway maternity records database instead, The Register reported.

That database covered women and babies treated between September 2011 and November 2022. The trust said the error was escalated within minutes of being found, and with help from external specialists and other data sources it recovered the clinical information needed for care, including notes, observations and test results. Current maternity patients and services weren’t affected, and the trust said no patient information was accessed or used inappropriately.

The part that didn’t come back

What NUH couldn’t fully restore is the audit history showing who viewed maternity records during those 11 years. In most cases, the trust may now be unable to confirm whether a particular person looked at a given record.

“The information needed to support patient care has been restored and there has been no impact on current maternity services or the care provided to women and babies today,” said Andy Callow, the trust’s chief digital and information officer. “However, to date, we have been unable to fully restore the historical record showing who viewed maternity records between September 2011 and November 2022.”

Those logs carry extra weight at this trust. NUH is at the center of the largest maternity scandal in NHS history, and Nottinghamshire Police is assessing whether the loss affects Operation Perth, its investigation into deaths and injuries in maternity care at the trust’s two main hospitals. Deputy Chief Constable Rob Griffin told the BBC that “at present, no crime has been identified,” and that police were awaiting analysis of the digital process used and a copy of the database before any further recovery attempts. A police probe last year into a separate missing maternity data file found it was most likely deleted “intentionally or maliciously,” the BBC noted.

A familiar failure mode

The trust notified the Information Commissioner’s Office, completed a patient safety incident investigation and says it has strengthened its technical controls and processes. For anyone who runs databases, the sequence is a familiar one: a copied runbook, a hard-coded target that should have been parameterized, no confirmation step before a destructive write and audit logs stored in the same place as the data they audit. Keeping access logs in a separate, append-only store would have left them intact even after the main database was overwritten.