NHS blunders expose private details of 40,000 people