NHS admits transplant patient data sent over unencrypted pagers

In the quiet coordination of life-and-death medical decisions, NHS Blood and Transplant was doing something it should never have done: broadcasting the names, dates of birth, and organ details of transplant patients across an unencrypted pager network, visible to anyone with the right frequency tuned in.

A BBC investigation uncovered the practice, which had continued despite a 2019 directive from then-Health Secretary Matt Hancock that the NHS in England should abandon pagers by 2021. The service admitted the breach after being contacted by journalists, acknowledging that sensitive information—tissue-match scores, immunosuppression risk factors, the identities of people waiting for organs—had been transmitted in plain text to hospital transplant teams using these antiquated devices. No one at NHSBT could say whether the data had been intercepted, or how many people had been affected, because pagers are one-way receivers that leave no auditable trail.

The problem ran deeper than transplant coordination. Over a ten-day period, the BBC found hundreds of messages crossing the same pager network from ambulance trusts, hospitals, and fire services. Mental health incidents were logged. Medication details were shared. The name of a patient in suicidal crisis was transmitted. The North West Ambulance Service and Northern Ireland Ambulance Service both used the system to send crew information including patient ages and medical details, though they said patient names were excluded from those messages. NWAS has since withdrawn pagers entirely; NIAS has largely done so.

Pagers were chosen for a reason. They work at low frequencies that penetrate buildings and elevators—particularly useful in hospitals with thick walls designed to shield against radiation. They have long battery lives and allow rapid information sharing when speed matters. But that same broadcast nature that makes them useful in hospitals makes them catastrophically insecure for sensitive data. Luca Arnaboldi, a technology expert at the University of Birmingham, put it plainly: pagers were never designed for privacy. Messages broadcast to a large area—potentially an entire building, or even nationwide—and anyone on the right frequency could receive them. There is no way to know who is listening, and no log of who accessed what.

Anthony Clarkson, NHSBT's head of organ transplantation, said the service had been surprised to learn the messages were not encrypted. "We accept it was a data breach," he stated, adding that NHSBT has now stopped sending any sensitive information to pagers and launched an internal investigation. The service reported the breach to the Information Commissioner's Office, which confirmed it is making inquiries. The Department for Health and Social Care said the NHS has been working to replace outdated technology, though it offered no timeline or explanation for why this particular vulnerability persisted years after the 2019 directive.

The pager network operator said it provides encrypted solutions and that customers determine how services are deployed. Its terms and conditions warn that radio signals may be intercepted and advise against transmitting sensitive information over radio or public networks—a warning NHSBT apparently did not heed. The Information Commissioner's Office noted that medical data is highly sensitive and that organisations have a legal responsibility to handle it securely. The full scope of exposure remains unknown, and likely will remain so. Pager broadcasts leave no trail. Whoever was listening—if anyone was—left no fingerprints.