NHS trusts investigated 2,914 patient data breaches since 2021, but only 409 were referred to the ICO, with monitoring practices varying across trusts.