In the data security incident trends reports released by the Information Commissioner’s Office (ICO), healthcare was far and away the worst-performing sector, accounting for 32,127 of the 206,140 breaches reported between 2019-2025 - a huge 15.56% of the total.
Why does the health sector suffer so many security breaches?
It’s partly down to its size. The NHS is thought to be the largest employer in Europe, and the sheer amount of confidential data on patients and staff it handles is colossal. Millions of medical records, all containing highly sensitive data, make healthcare a ‘honeypot’ for information thieves. Medical identity theft is a growing problem in the UK, as is medical insurance fraud.
There are also certain ways of dealing with data that are specific to the health sector, which raise particular risks. For example, tablets and mobile devices are often used to record patients’ details in healthcare settings. Because of an expectation that these devices will be used by individual owners, they often have an ‘auto-fill’ function enabled by default, which remembers personal details entered into online forms. If this is not deactivated, the next user of a device might see the previous user’s details appearing in a form.
However, not all the problems are digital in origin. The handling and disposal of paper records is another area where healthcare organisations can run into problems. In addition to patient notes and records, X-ray films and even staff notes can all have value to thieves.
According to the ICO, between 2019 and 2025, there were 3,943 data breaches in the healthcare sector caused by:
The incorrect disposal of paperwork
The incorrect disposal of hardware
Loss/theft of paperwork or data left in an insecure location
Loss/theft of devices containing personal data.
In the same time period, data was posted or faxed to an incorrect recipient no fewer than 3,134 times.
Digital security issues are complex, even for IT professionals. But when it comes to disposing of confidential records held on paper, there’s an easy solution. A professional shredding company such as Shred Station can make sure all used records are securely destroyed, providing a certificate of destruction as proof of secure disposal.
Our trained employees undergo rigorous vetting and security checks in line with BS7858, and we are accredited to the highest standards as a security shredding provider in the UK. Shredding can be carried out on-site or at our own secure premises, with regular collections available if required.
Read more information on how healthcare organisations can keep their data secure in our guidance article.
The source for all statistics quoted in this article is the Information Commissioner’s Office.