An NHS private contractor has been found to have had a misconfigured API that potentially allowed outside actors to retrieve patient data. An ongoing audit seems to suggest no data was taken. A ...