LONDON
\nConfidential health data has been exposed online on dozens of occasions, a Guardian investigation can reveal, raising questions about the safeguarding of patient records by one of the UK\u2019s flagship medical research projects.
\nUK Biobank, which holds the medical records of 500,000 British volunteers, is one of the world\u2019s most comprehensive stores of health information and is credited with driving breakthroughs in cancer, dementia and diabetes research. But scientists approved to access Biobank\u2019s sensitive data appear to have sometimes been cavalier about its security.
\nThe files, which seem to have been inadvertently posted online by researchers using the data, do not include names or addresses, but they may still pose privacy concerns. One dataset found by the Guardian contained millions of hospital diagnoses and associated dates for more than 400,000 participants.
\nWith the consent of a Biobank volunteer, the Guardian was able to pinpoint what appeared to be extensive hospital diagnosis records for the volunteer, using only their month and year of birth and details of a major surgery they had undergone.
\nOne data expert said the scale and persistence of the problem was \u201cshocking\u201d at a time when AI and social media were making it ever easier to cross-reference information online.
\nUK Biobank rejected the concerns, saying that no identifying data, such as names and addresses, were provided to researchers.
\nIn a statement, Prof Sir Rory Collins, the chief executive of UK Biobank, said: \u201cWe have never seen any evidence of any UK Biobank participant being re-identified by others.\u201d<\/p>\n
\u2019They said they would hold our data securely\u2019
\nFounded in 2003 by the Department of Health and medical research charities, UK Biobank holds genome sequences, scans, blood samples and lifestyle information of 500,000 volunteers. Last month, the government extended Biobank\u2019s access to volunteers\u2019 GP records.
\nScientists at universities and private companies across the world apply for access and, until late 2024, were free to download data directly on to their own computer systems.
\nBefore this point, data had been inadvertently published online and Biobank appears to still be grappling with the problem.
\nThe issue emerged because journals and funders increasingly require researchers to publish the code they have used to analyse large datasets. When intending to upload code, some researchers have also accidentally published partial or entire Biobank datasets to GitHub, a popular online code-sharing platform. UK Biobank prohibits researchers from sharing data outside their systems and says it has introduced further training for all researchers.
\nIn the past year, the data leaks appear to have become a more urgent concern to UK Biobank. Between July and December 2025, it issued 80 legal notices to GitHub, which has complied with requests to remove data from the internet. Yet much still remains available.
\nSome of the data files contain just patient IDs, or test results for small numbers, others are more extensive. One dataset found online by the Guardian in January contained hospital diagnoses and associated diagnosis dates for about 413,000 participants, along with their sex and month and year of birth.
\nA data expert, who reviewed the file said: \u201cIt sent shivers down my spine to even open. I deleted the file immediately. It was very detailed and felt like a gross invasion of privacy even to glance at.\u201d
\nTo test the risk of re-identification, the Guardian approached several Biobank volunteers, two of whom had undergone medical procedures in the timeframe within the data and agreed to share these details with an external data scientist.
\nOne volunteer, who provided treatment dates for a fracture and seizure, could not be located in the dataset. A second volunteer, a woman in her 70s, shared her month and year of birth and the month and year she had a hysterectomy. Only one person in the dataset matched these details. The apparent match was corroborated by five other diagnoses from the records that the volunteer had not initially disclosed.
\n\u201cEffectively you were rehearsing the main parts of my medical history to me without me having given you any information at all. I didn\u2019t expect that,\u201d the volunteer said.
\nThe woman said she was not too concerned about her own data being exposed and intended to remain a participant, saying that she viewed UK Biobank\u2019s work as \u201cextremely important\u201d. But, she added: \u201cI\u2019m more concerned about whether Biobank has broken its agreement with people. They said they would hold our data securely \u2026 I just feel as though that has to come into the equation.\u201d
\nUK Biobank said the re-identification scenario tested by the Guardian did not highlight a privacy risk because without additional information it would be impossible to identify individuals.<\/p>\n","protected":false},"excerpt":{"rendered":"
LONDON Confidential health data has been exposed online on dozens of occasions, a Guardian investigation can reveal, raising questions about the safeguarding of patient records by one of the UK\u2019s flagship medical research projects. UK Biobank, which holds the medical records of 500,000 British volunteers, is one of the world\u2019s most comprehensive stores of health […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":{"0":"post-536704","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-business"},"yoast_head":"\n