NHS Forth Valley is investigating after a staff member sent a spreadsheet containing data of roughly 150 women who had used its maternity services to a personal email address. The health board said the staff member, a fully qualified non‑clinical employee, has deleted the file and the information has not been shared beyond the trust.

The board contacted the affected women and notified the UK Information Commissioner’s Office and Police Scotland. The spreadsheet contained names, dates of birth, NHS numbers, pregnancy treatment details and the total number of children for each patient. An internal review is under way to determine how the data was transferred and whether any security controls were breached.

This incident is part of a pattern of NHS email‑based data mishaps. Chelsea and Westminster and NHS Highland were found to have exposed HIV patient data when using the CC field instead of BCC. Cambridge University Hospitals NHS Foundation Trust disclosed extra data in spreadsheets used for Freedom of Information responses between 2020 and 2021. In 2023, NHS Digital inadvertently exposed email addresses when a BCC error failed to hide recipients of a cybersecurity event invitation.

The UK health service has a history of email‑related breaches, including inaccurate Freedom of Information releases and misuse of the BCC field. Officials said the current investigation will assess whether the latest incident reflects systemic weaknesses or an isolated error.

The trust has not indicated that the data will be used for any purpose other than the internal analysis, and it has pledged to improve email handling procedures.