The government has been dragged into the Jimmy Savile scandal after it emerged that the Department of Health could be sued directly over claims the star abused patients when he was a volunteer at Broadmoor hospital in the 1970s and 1980s.

A lawyer acting for victims preparing legal action against Stoke Mandeville hospital and the BBC said it was possible the government could face civil claims as it was directly responsible for the running of the Broadmoor high security psychiatric hospital in that time.

Savile was a volunteer for more than four decades at the hospital, had keys to its secure unit and at one point in 1988 was appointed to lead a "taskforce" overseeing the management of the hospital after its management board was dismissed by the then health secretary, Kenneth Clarke.

The Department of Health confirmed that it had launched an internal inquiry into its management of the secure hospital before it was transferred to the control of West London mental health trust in 2001. A number of allegations of abuse at the hospital have emerged, including one claim by a psychiatric nurse that a former patient told her Savile had repeatedly raped her at Broadmoor.

The scale of the crisis at the BBC became apparent on Friday night with the director general, George Entwistle, calling a last-minute press conference to announce two independent inquiries into the Savile scandal and the BBC's reporting of it. He offered a "profound and heartfelt apology" to Savile's victims.

The actor Julie Fernandez, who has appeared in The Office and Eldorado, said on Friday the presenter groped her when she appeared on Jim'll Fix It aged 14. She said she was sitting next to him in her wheelchair and his hands "lingered in places they shouldn't".

She told Radio 5 live that: "It was in a busy room full of people in a studio so it was quite discreetly done … I do remember feeling uncomfortable." She said she joked about it later with classmates but never told an adult about it.

Metropolitan police revealed that their investigations were spiralling and now involved 340 lines of inquiry and 40 potential victims.

Liz Dux, a partner at Russell Jones & Walker in London and an expert in personal injury and child abuse cases, revealed on Friday that she was acting for a number of women who want to sue the BBC and Stoke Mandeville hospital on the grounds of vicarious liability. With 340 lines of inquiry, the threat of legal action is expected to spread to other institutions where Savile made official charity visits.

Dux said it could also reach the government: "The government is not immune in civil litigation. It would absolutely be no different to sue the government."

Health ministers and civil servants are hastily trying to establish the management structures at the hospital between 1959, when the one-time Victorian prison became part of the NHS under the Mental Health Act of that year, and 2001, when the government no longer had direct responsibility for its running.

"Although the framework for child protection and safeguarding for Broadmoor and other special hospital patients changed radically in 1999, we of course want to establish the circumstances and see if any lessons can be learned," a Department of Health spokesman said. In hindsight it was clearly not appropriate that Savile had been given a supervisory role at the hospital, said the spokesman, adding "it is far from clear why any such role would have required possession of … a set of keys, we need to establish how he came to have them and on what basis".

Clarke was appointed health secretary on 25 July 1988. The management board was dismissed the following month. He said: "I have no recollection of ever having met Jimmy Savile and no recollection of these events. The Department of Health are now investigating to establish the facts."

Dux, a personal injury lawyer who has acted for people with severe spinal injuries and amputees, has been contacted by several women who want to sue over the Savile allegations. She said she is preparing cases against the BBC and the hospital on the grounds that they both have a duty of care to anyone who comes into contact with their staff or agents.

"The case would be against the BBC or the hospital because they would be held vicariously liable in law on behalf of someone like Savile who was acting as their agent," Dux told BBC Radio 4's World at One on Friday.

"So in the case of the BBC where he abused people through his connection with programmes, for example the case about the girl who alleges she was abused in his changing room, then because of the close connection with the BBC, the BBC would be what we call vicariously liable in those circumstances," she added.

"Likewise in the hospitals. He may not have been paid by the hospital but he's there as their agent, then they owe a duty of care to those he abused."

Dux said the duty of care towards patients or guests of Top of the Pops, Jim'll Fix It and other programmes would be "heightened" if any managers had suspicions at the time about Savile.

The threat of legal action will now increase the pressure on the BBC and the police to establish who knew what, when and why rumours of his interest in young women were not acted upon.

The fact that some alleged incidents happened decades ago was not an issue, she said. "By their nature, abuse cases are often historic. They are often very old by the time cases are brought. People feel great shame and psychologically don't feel able to talk about it for some time," she told World at One. "Quite often the courts will apply their discretion to allow these cases. For example, sex abuse cases against the Catholic church or against schools or the children's homes cases in Jersey."

"They want some form of recognition as to what's happened to them in the past. They want to be taken seriously, they are not interested in the financial compensation at all, they just want the cathartic process of telling someone what they have been through and someone believing them for a change."She said compensation could range from a few thousand pounds for someone who suffered a minor assault and got on with their lives to hundreds of thousands if their lives had been wrecked, for instance if they had been unable to have a career or form relationships.

"To win the case against the BBC you do not have to show they knew about it, provided you can prove Savile was acting as an agent of the BBC," said Dux.

Richard Scorer, a Manchester lawyer acting for the Rochdale child abuse victims and co-author of Child Abuse Compensation Claims, said victims could also sue Savile's estate "even if the assets have been distributed to others".

He said there would be difficulty in getting a case to court because Savile was dead, but the "evidence stacking up" meant courts were likely to be sympathetic to a trial.

Scorer won £580,000 for a man who had suffered abuse as a child, one of the highest payouts in an English court. He suffered a mental breakdown at the age of 45 when the police started investigating case, and the payout reflected his inability to work after that. Most payouts are less than £100,000.

"The difficulty normally is the injury is inflicted when you are a child so you don't have an earnings capacity built up; this man did," said Scorer.