The Care Quality Commission (CQC) has issued the notice for multiple failures in several areas, including staffing levels and call wait times.

The emergency service was rated as “requires improvement” after its last inspection in 2022.

The EEAST said it had made “rapid improvements”.

The ambulance service covers Bedfordshire, Cambridgeshire, Essex, Hertfordshire, Norfolk and Suffolk.

When EEAST was last inspected, it was rated as “requires improvement” in four out of the five areas the inspectors considered.

Its only “good” rating within those five was in relation to whether the trust provided services that were “caring”.

The CQC found the trust did not always:

• Have enough staff to keep people safe
• Keep mandatory training up to date
• Manage clinical waste well
• Meet agreed response times
• Ensure staff felt respected and valued

Figures showed the response time for category one calls had deteriorated by almost 20% during the year, and only 21% of ambulances on category four calls were arriving within three hours.

The CQC has now issued a warning notice under the Health and Social Care Act 2008 for “failing to meet requirements relating to staff training, staffing levels, investigation of controlled drug incidents, call wait times, the culture of the service and acting on information from staff to develop and improve the service”.

The CQC said its powers when a warning notice is issued included imposing conditions on the trust, or suspending or cancelling its registration.

Failure to comply with the steps required by the CQC could constitute a criminal offence.

The chief executive of the EEAST, Neill Moloney, said: “Our patients expect and deserve good quality care from us. I am sorry that the trust has not always met this expectation.

“Following the CQC warning notice, we have made rapid improvements in the areas they identified, and we are determined to continue to improve our service to patients.”

He said the steps already taken included redesigning mandatory training requirements to be more effective, and strengthening control drug handling processes.

The trust said it would continue working to improve the culture of the service.

The flaw was found last November at Medefer, which handles 1,500 NHS patient referrals a month.

The software engineer who discovered the flaw believes the problem had existed for at least six years.

Medefer says there is no evidence the flaw had been in place that long and stressed that patient data has not been compromised.

The flaw was fixed a few days after being discovered.

In late February the company commissioned an external security agency to undertake a review of its data management systems.

An NHS spokesperson said: “We are looking into the concerns raised about Medefer and will take further action if appropriate.”

Medefer’s system allows patients to book virtual appointments with doctors, and gives those clinicians access to the appropriate patient data.

However, the software bug, discovered in November, made Medefer’s internal patient record system vulnerable to hackers, the engineer said.

The software engineer, who does not want to be named, was shocked by what he uncovered.

“When I found it, I just thought ‘no, it can’t be’.”

The problem was in bits of software called APIs (application programming interfaces), which allow different computer systems to talk to each other.

The engineer says that at Medefer those APIs were not properly secured, and could potentially have been accessed by outsiders, who would have been able to see patient information.

He said it was unlikely that patient information was taken from Medefer, but that without a full investigation, the company could not have known for sure.

“I’ve worked in organisations where, if something like this happened, the whole system would be taken down immediately,” he said.

On discovering the flaw the engineer told the company that an external cybersecurity expert should be brought in to investigate the problem, which he says the company did not do.

Medefer says the external security agency has confirmed that it has found no evidence of any breach of data and that all the company’s data systems were currently secure.

It says the process of investigating and fixing the API flaw was “extremely open”.

Medefer said it had reported the issue to the ICO (Information Commissioner’s Office) and the CQC (Care Quality Commission), “in the interests of transparency”, and that the ICO had confirmed there is no further action to be taken as there is no evidence of a breach.

The engineer, who had been contracted in October to test for flaws in the company’s software, left the company in January.

In a statement Dr Bahman Nedjat-Shokouhi, founder and CEO of Medefer, said: “There is no evidence of any patient data breach from our systems.”

He confirmed that the flaw had been discovered in November and a fix was developed in 48 hours.

“The external security agency has asserted that the allegation that this flaw could have provided access to large amounts of patients’ data is categorically false.”

The security agency will complete its review later this week.

Dr Nedjat-Shokouhi added: “We take our duties to patients and the NHS very seriously. We hold regular external security audits of our systems by independent external security agencies, undertaken on multiple occasions every year.”

Cybersecurity experts, who have looked at information supplied by the software engineer, have expressed their concern.

“There is the possibility that Medefer stored data derived from the NHS not as securely as one would hope it would be,” said Prof Alan Woodward, a cybersecurity expert at the University of Surrey.

“The database might be encrypted and all the other precautions taken, but if there is a way of glitching the API authorisation, anyone who knows how could potentially gain access,” he added.

Another expert pointed out that as Medefer deals with highly-sensitive, medical data, the company should have brought in cybersecurity experts as soon as the problem was identified.

“Even if the company suspected that no data was stolen, when facing an issue that could have resulted in a data breach, especially with data of the nature in question, an investigation and confirmation from a suitably qualified cybersecurity expert would be advisable,” says Scott Helme, a security researcher.

Medefer was founded in 2013 by Dr Nedjat-Shokouhi, with a goal to improve outpatient care. Since then its technology has been used by NHS trusts across the country.

In a statement the NHS spokesperson said those trusts are responsible for their contracts with the private sector.

“Individual NHS organisations must ensure they meet their legal responsibilities and national data security standards to protect patient data when appointing suppliers, and we offer them support and training nationally on how this should be done.”

Musk reacted to a video showing diversity related roles advertised on the government website on his social media platform X last week.

The South African born billionaire said the positions were a result of the “woke mind virus”.

Isle of Wight and Portsmouth Hospitals University NHS Trusts, whose adverts featured in the video, said they “strive to ensure everyone has equal access to career opportunities and care”.

The two trusts, which work in partnership and are led by the same executives, had been advertising for an EDI project manager.

The manager “plays a crucial role to ensure our services and employment are equitable for all and meet the diverse needs of our local communities”, they said in a statement to the BBC.

The role in question had a starting salary of £46,000 and was only open to internal applicants.

Musk’s post criticising the position has been reposted by more than 12,000 people, and seen more than 6.7 million times.

In it, he said: “The woke mind virus propagates like cordyceps through government and corporations.”

His criticisms of EDI schemes have been echoed by US President Donald Trump, who signed multiple executive orders against the programmes when he returned to office in January.

He ordered that all US government staff working on EDI schemes be put on immediate leave and called for an end to the “dangerous, demeaning and immoral” programmes.

EDI programmes aim to promote participation in workplaces by people from a range of backgrounds.

Supporters say they address historical underrepresentation and discrimination against certain groups including racial minorities but critics say such programmes can themselves be discriminatory.

Another executive order saw President Trump create the Department of Government Efficiency (Doge), which is led by Musk and aims to slash federal spending.