The Tavistock and Portman NHS Foundation Trust has said it is investigating a data security incident reportedly involving the Charing Cross Gender Identity Clinic.
In a statement on its website the Trust said: “This incident involved an email from our Patient and Public Involvement team regarding an art project that we are looking forward to launching. Unfortunately, due to an error, the email addresses of some of those we are inviting to participate were not hidden and therefore visible to all.
“We are hugely apologetic and understand that this is a serious data breach.”
The Trust also confirmed that it was reporting the breach to the Information Commissioner's Office as well as treating it as a serious incident within the Trust.
The BBC said two separate emails were sent, with about 900 people CC-ed on each.
Sean Humber of law firm Leigh Day claimed the clinic’s actions - in mistakenly revealing the identities of almost two thousand of its patients - were likely to lead to substantial claims for compensation by those affected.