NUH Restored the Maternity Records. Eleven Years of Accountability Are Still Missing.
The phrase I distrust most in an incident report is “the data was recovered.” Which data? Enough to restart the application, or enough to explain what happened? Nottingham University Hospitals NHS Trust now has a painful example of that distinction.
On August 18, 2026, staff attempting to copy a radiotherapy database for reporting accidentally overwrote the trust’s legacy Medway maternity database. They reused instructions from another hospital system and missed a setting that needed changing, according to [NUH’s statement](https://www.nuh.nhs.uk/news/statement-nuh-data-loss-11205).
One missed setting. A very large blast radius.
The records came back. The witnesses didn’t.
NUH recovered clinical notes, observations, test results, and information needed for patient care. But it could not fully restore the history showing who viewed maternity records covering September 2011 through November 2022.
That is not the same as losing every patient record. Nor does the public evidence establish that every access log is permanently gone. Precision matters here.
The remaining gap is still serious: in most cases, NUH may be unable to confirm whether a particular person accessed a record during that period.
<> Clinical usability and forensic accountability are different recovery outcomes. Restoring one does not restore the other./>
The trust disclosed the incident on September 21, notified the ICO and Nottinghamshire Police, and engaged external recovery specialists. It says current maternity services were unaffected and no patient information was accessed or used inappropriately as a result of this incident.
That qualification matters. It is not proof that every historical access was appropriate.
“Human error” describes the trigger, not the system
I don’t need the exact SQL command to dislike this failure mode. A reporting operation aimed at one system overwrote another system’s sensitive database.
Calling that “human error” is like blaming a dropped match while declining to discuss the petrol storage.
We do not know the database engine, backup architecture, exact permissions, or detailed corrective controls. So claims that NUH lacked a particular safeguard would be speculation. But these are the questions any CTO should demand answers to:
- Could reporting credentials overwrite an unrelated database?
- Was the destination validated against an explicit allowlist?
- Did the operation show its target before execution?
- Had anyone tested restoration of access history, separately from clinical content?
A successful restore test should prove something—not merely produce a green dashboard.
Legacy does not mean disposable
NUH introduced Badger Notes in November 2022, with BadgerNet as its hospital maternity-record system. There is no evidence those products caused this overwrite. Medway was the previous system, but its historical evidence still mattered.
The trust’s maternity services are subject to Donna Ockenden’s independent review and Nottinghamshire Police’s Operation Perth, which investigates deaths and serious injuries involving mothers and babies. Police are assessing whether the missing access history affects that investigation.
The Nottingham Maternity Family Group called the loss “extremely unnerving.” Understandably. Families dealing with harm and bereavement should not also have to wonder whether evidence about their records survived routine maintenance.
A separate file deletion reported in 2025 was considered probably intentional or malicious; that file was recovered. It does not establish sabotage here. Suspicion is not a forensic finding.
Buy recoverability, not backup theatre
For developers and procurement teams, I’d turn this into three acceptance tests:
1. Restore records and attribution. Verify events still map to users and records.
2. Separate the evidence. Protect audit copies from the same privileges and operations that can destroy the source database.
3. Keep logs useful, not invasive. Capture access context without copying clinical details or secrets into another repository.
These align with [OWASP logging guidance](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html), not confirmed findings about NUH’s infrastructure.
My Bet
Healthcare buyers will start demanding explicit audit-history recovery tests. The useful vendors will demonstrate them. Everyone else will rename an existing backup feature “compliance resilience” and hope nobody asks for a restore.
