NHS England introduced the Patient Safety Incident Response Framework (PSIRF) in 2022, which mandated that affected families must receive investigation reports.
I understand that last year they received (in my view questionable) legal advice which suggested to do so would breach data protection laws and the patient confidentiality of the offender.
In the VC case it would be his patient confidentiality that would be potentially breached, but after some discussion it was decided that the public interest in this case (an exemption to data protection laws) would allow the lawful publication of the inquiry report in full.
Hope this helps.