A monetary penalty notice for £325,000 has been served on Brighton and Sussex University Hospitals NHS Trust following the discovery of highly sensitive personal data belonging to tens of thousands of patients and staff -“ including some relating to HIV and Genito Urinary Medicine patients -“ on hard drives sold on an Internet auction site in October and November 2010.