Case study from public reports
When the record of who viewed a record was lost.
Nottingham University Hospitals NHS Trust lost the history of who had viewed old maternity records. This page sets out what is publicly known, and what an independent signed record would and would not have changed.
What was reported
- On 18 August 2026 a reused database script, run during routine IT work, overwrote the maternity records database. It had been meant for a different database.
- The records themselves were restored. The trust could not restore the history of who had viewed or amended maternity records between September 2011 and November 2022, covering about 215,000 patients.
- The trust reported the incident to the Information Commissioner’s Office, which said it is making inquiries. The trust says current patient care is not affected.
Sources: the trust’s own statement and reporting by the BBC (30 September 2026), Ars Technica and The Register.
What the trust said publicly
“There should have been checks and balances in place to mitigate against an accident.”
“What we haven’t got at the moment is the audit trail, if someone has been into those records to make an amendment or add a comment.”
“I apologise that this data has gone missing. It’s unacceptable.”
What a separate signed record would have changed
The record sits outside the system
The access history was stored in the same database the script overwrote. A signed record kept somewhere else is untouched when the database is wiped.
It is made at the moment of access
Each view produces its own signed record when it happens. There is no single history to lose in one overwrite.
Anyone can check it afterwards
A regulator, an auditor or the trust itself can check a record without asking the system that failed and without trusting us.
The result would not be a prevented error. It would be a trust able to answer the question it could not: who viewed these records, and when.
What it would not have done
- Metrecept would not have stopped the script from running, and it would not have warned anyone beforehand. It records what happened; it does not block or approve anything.
- It does not replace a hospital’s own access logging. It is an independent second record.
- We have no knowledge of how the trust’s systems are built, and this page is our reading of public reports, not a review of the trust.