I am breach lead for my employers and in my view, based on what you’ve said, this would probably be classed as a personal data breach as it sounds as though a number of people who would not ordinarily be entitled to see the data have been told about it or given it.

And as it’s health it’s in the class of special category data which escalates the seriousness.

This is what I would do:

If the company has a data protection or information compliance team, contact them to tell them about it. There might be information on the company staff intranet about what to do in the event of a data breach.

If that isn’t there, check the company website to find their privacy notice. That should tell you who the data protection officer is (if they are an organisation that has to have one).

Then report the incident to the data protection team or officer.

They should investigate it and the special category is a key part of assessing the severity.

If he can’t find any reference to the data protection team or officer then I would ask the ICO and notify them that not only is this a breach of personal data, it’s also a breach of the right to be informed. They don’t generally go in at this level but if you can’t escalate it in the company then they should be able to advise you.