Details of three women who had a stillborn baby were posted online by a hospital trust, prompting a probe into the potential data breach.
Hampshire Hospitals NHS Foundation Trust (HHFT) said no names or addresses were published but details of a “sensitive nature” were shared.
The trust, which runs three hospitals, has apologised and said it is taking the matter “very seriously”.
The Information Commissioner’s Office (ICO) said it was investigating.
According to the Bazingstoke Gazette, the “restricted” information detailed in a review of stillbirths at the trust was visible on the trust’s website for several weeks and could be viewed or downloaded by the public.
It included the date and time of the birth, the women’s age and BMI, the gender and weight of their baby, and medical history, including miscarriages and terminations.
HHFT, which runs Andover War Memorial, Basingstoke and North Hampshire, and the Royal Hampshire County hospitals, said it had referred itself to the ICO as a potential breach of the Data Protection Act 2018.
Malcome Ace, senior information risk officer for the trust, said: “We apologise for any distress caused. The three women whose experiences were noted in the report are being contacted by our team and support is being offered to them.”
An ICO spokeswoman confirmed the trust had made them aware of the matter and it was making inquiries.
NHS England’s confidentiality policy states all employees are “bound by a legal duty of confidence to protect personal information they may come into contact with during the course of their work”.
Tommy’s, the charity which funds research into stillbirth and miscarriage, described baby loss as incredibly “personal” and having a loss made public could fuel bereaved parents’ feelings of anger.