NHS Transplant Service Sent Patients' Private Medical Data Over an Open Radio Network for Years
NHS Blood and Transplant used a pager system that broadcast donor names, birth dates and organ-matching scores without any encryption, meaning anyone with basic radio equipment could have been listening.
Key points
- NHS Blood and Transplant (NHSBT), the body that coordinates organ transplants across the UK, admitted it sent sensitive patient data over an unencrypted pager network for an unspecified number of years.
- Intercepted information included donor names, recipient dates of birth, organ types and tissue-match scores alongside immunosuppression risk ratings.
- The UK government told the NHS to stop using pagers by 2021; parts of the health service never did.
- NHSBT has now stopped sending patient data via pagers and reported the breach to the Information Commissioner's Office, the UK's data-protection regulator.
- A BBC investigation also found hundreds of unencrypted messages from ambulance trusts and hospitals covering mental health crises, medication details and a patient's suicide attempt.
The NHS body responsible for matching organ donors with recipients has been broadcasting transplant patients' private medical records over a radio network with no encryption, meaning the signals were readable by anyone tuned to the right frequency. NHS Blood and Transplant confirmed the breach to the BBC, which first uncovered it, and has since reported the incident to the Information Commissioner's Office.
Encryption is the process of scrambling data so that only the intended recipient, holding the right digital key, can read it. Without it, a radio message is like a postcard: open to anyone who picks it up. Our story on Apple's ongoing UK encryption fight, filed 7 August 2026, shows how bitterly contested the right to encrypt data in Britain now is; this case shows what happens when an NHS body simply forgot to.
What exactly was sent in the open?
Transplant coordinators received pager messages containing donor names, recipient names, dates of birth, organ types, tissue-match scores and immunosuppression risk factors. These last two are clinical ratings that help doctors decide whether a patient's immune system will reject a donated organ.
Pagers are small, battery-powered radio receivers, popular through the 1980s and 1990s, that show short text messages on a tiny screen. They only receive signals and cannot send them back. That one-way design suits hospitals, where thick, X-ray-shielding walls block phone signals but low-frequency pager signals pass through. The open broadcast, though, is also the flaw.
Luca Arnaboldi, an assistant professor at the University of Birmingham, put it plainly: "It broadcasts messages to a large area, potentially a whole building or even nationwide, and anybody can receive it as long as they're on the right frequency."
Anthony Clarkson, NHSBT's head of organ transplantation, said the service was "deeply sorry" and acknowledged it had been unaware the messages were unencrypted. "We were surprised that these messages were not encrypted, and that vulnerability was there," he said.
Should patients be worried?
NHSBT says it cannot confirm whether anyone intercepted the messages, because pager systems keep no log of who receives a broadcast. That unauditability is itself a serious problem.
The BBC's wider investigation found hundreds of additional unencrypted messages sent over ten days by ambulance trusts and fire services, including mental health crises and at least one patient's suicide attempt.
| Organisation | Data sent openly | Current status |
|---|---|---|
| NHS Blood and Transplant | Donor names, recipient names, DOB, organ type, tissue-match scores | Pager use stopped |
| North West Ambulance Service | Addresses, patient ages, medical details | Pagers fully withdrawn |
| Northern Ireland Ambulance Service | Crew dispatch details including patient ages | Pagers largely withdrawn |
If you're a transplant patient and want to know whether your data was among those sent, NHSBT is the right body to contact. Monitor any correspondence from your transplant centre over the coming weeks.
The pager network operator said it does offer encrypted paging services, but that customers choose how to deploy them. Its terms and conditions warn against sending sensitive information over radio networks.
The government announced in 2019 that NHS England should phase out pagers by 2021. Parts of the health service never did. At this point, that gap between policy and practice is the more embarrassing fact: the encryption failure is a known risk, the ignored deadline is a choice.
