Between 2023 and 2024, 27-year-old Miryam Brand, a healthcare assistant at the hospital, accessed internal databases and disclosed confidential material to Montell Ashby, aged 29, a prisoner incarcerated at HMP Highpoint in Suffolk.  

The information Brand sent to Ashby included names, dates of birth and addresses of patients known to him.

The data breaches came to light when a mobile phone was seized from Ashby's cell in December 2023 and was found to contain sensitive information he should not have had access to.

An investigation identified Brand as the person who had been sending Ashby the sensitive NHS records. She was arrested and subsequently charged with knowingly/recklessly obtaining or disclosing personal data without consent of controller, encouraging/assisting in the commission of an either way offence believing it will be committed, and causing a computer to perform function to secure/enable unauthorised access to a program/data.

Ashby was charged with knowingly/recklessly obtaining or disclosing personal data without consent of controller and possessing inside a prison an item specified in section 40D(3B) without authority.

Both Brand and Ashby entered guilty pleas to all the offences at Northampton Crown Court.

Ashby, of HMP Highpoint, Suffolk, was sentenced to 15 months in prison, suspended for 18 months, and ordered to complete 120 hours of unpaid work. Brand, previously of Southwick Close, Kettering, was sentenced to 18 months in prison, suspended for 18 months, and 120 hours of unpaid work.