Publication of pictures of medical files on social media prompts data breach inquiry

Martin Shipton

A health board has launched an investigation after an “urban explorer” published photographs suggesting that confidential medical records were kept insecurely in a 120-year-old mental hospital.

The pictures of St Cadoc’s Hospital in Caerleon, on the northern outskirts of Newport, appeared on a website run by someone calling themselves Urban Welsh Explorer. They depict piles of files in boxes in what appears to be a publicly accessible area of the hospital.

Urban Welsh Explorer is described as a social media creator active on YouTube, TikTok, and Facebook, focusing on urban exploration (urbex) of abandoned properties, historical buildings, and forgotten locations.

Their content captures the quiet, often eerie atmosphere of these sites, emphasizing preservation and storytelling rather than vandalism or theft. The explorer documents everything from abandoned houses and hotels to industrial sites and asylums, often highlighting the history and decay of each location.

Urban Welsh Explorer emphasises ethical exploration, documenting sites without disturbing or removing items. Their motto is said to align with the urbex principle of “leaving only footprints,” ensuring that the history and atmosphere of each location remain intact for future visitors.

This approach is said to appeal to viewers interested in history, photography, and the unique aesthetics of abandoned spaces, offering a blend of adventure, education, and visual storytelling.

Writing about their visit to St Cadoc’s Hospital, Urban Welsh Explorer states: “One of the first things that stood out when exploring St Cadoc’s Hospital was something genuinely concerning, confidential patient medical records were still left out on display, despite parts of the premises being left unsecured.

“Even more surprising, these records hadn’t been removed before builders had begun work on sections of the site. If these records contained identifiable personal or medical information and were accessible to unauthorised people, this would appear to represent a serious breach of UK GDPR and data protection obligations.

‘It’s a stark reminder that, even after closure, sensitive information deserves to be handled with the utmost care and respect. And the amount [of] equipment that was just left behind, [a] total waste of taxpayers’ money!!

“Originally opened in 1906 as Newport Borough Asylum, St Cadoc’s Hospital in Caerleon was built to provide mental healthcare for the people of Newport. Over the decades it evolved with changing attitudes towards mental health, becoming St Cadoc’s Hospital when it joined the NHS in 1948. For more than a century, thousands of patients passed through its wards, each with their own story.

“Today, many parts of the historic buildings sit abandoned, slowly succumbing to time and decay. Walking the silent corridors, it’s impossible not to reflect on the lives once lived here. Behind every peeling wall and empty ward is a chapter of Wales’ healthcare history that shouldn’t be forgotten.

“Exploring places like this isn’t just about photographing decay, it’s about documenting history before it disappears.

“At the same time, discoveries like abandoned patient records highlight the importance of respecting both the buildings and the people whose lives were connected to them.”

St Cadoc’s Hospital has been featured as a location for episodes of the popular BBC TV series Doctor Who and Torchwood.

Full investigation

A spokesperson for Aneurin Bevan University Health Board said: “We are aware that there are videos and photos circulating on social media and we are currently undertaking a full investigation. We are liaising with Gwent Police and take any potential data breach very seriously.

“St Cadoc’s Hospital is a fully functioning hospital site and we are disappointed that people have entered without authorisation, as there are staff and vulnerable patients on site. This is unacceptable.”