An NHS clinic in London has been fined £180,000 for a serious breach of the privacy of more than 700 users of an HIV service.

Patients and service users who were on the HIV clinic email list of 56 Dean Street, a Soho-based sexual health clinic, said at the time of the breach they were terrified it could leave them open to blackmail or public outing.

A staff error meant anyone receiving the September newsletter from the service could see the email addresses of all the other recipients.

Addresses had been wrongly entered into the “to” field instead of the “bcc” field, and 730 of the 781 email addresses contained recipients’ full names. Most of the recipients were HIV positive though a small number were not.

Chelsea and Westminster hospital NHS foundation trust, which runs the clinic, has been fined £180,000 after the Information Commissioner’s Office (ICO) found there had been a serious breach of the Data Protection Act, likely to have caused substantial distress.

The information commissioner, Christopher Graham, said it was “clear that this breach caused a great deal of upset to the people affected”.

Graham said the investigation revealed many people recognised other names on the list of recipients, because the clinic served a small area of London, and feared their own name would be recognised too.

The ICO investigation found the trust had previously made a similar error in March 2010, when a member of staff in the pharmacy department sent a questionnaire to 17 patients in relation to their HIV treatment. After the mistake, extra measures were put in place but no specialist training was implemented, the ICO found.

“The trust was quick to apologise for their mistake, and has undertaken substantial remedial work since the breach,” Graham said. “Nevertheless, it is crucial that the senior managers at NHS trusts understand the requirements of data protection law, and the serious consequences that follow when that law is broken.”

After the error was revealed in September, the health secretary, Jeremy Hunt, ordered an inquiry into how the NHS handles confidential medical information. The Care Quality Commission will conduct a review of the effectiveness of existing data security measures in the NHS and recommend changes.

Patients told the Guardian after their names were revealed that the email contained the names of friends who had never disclosed their HIV status to them before.

“It’s not difficult to put those names into Facebook and bring up their profiles and personal details,” Elliot Herman, 38, from London said. “If my details were on that list I would feel angry and disappointed at the clinic for having such a shit system that this can happen.”

56 Dean Street is Europe’s busiest genital-urinary medicine clinic, and widely regarded as a pioneer centre for sexual health. In 2011, the clinic set the world record for the most HIV tests performed in one location, at G-A-Y bar in Soho on World Aids Day.

Patients are also taking legal action against the clinic for distress suffered as a result of the breach, alleging the trust failed to have appropriate IT systems or training in place to prevent the accidental disclosure.

Sean Humber, from law firm Leigh Day, who is acting for more than 20 of the patients affected, said it was the most serious case he had seen for 20 years – both in the number of people affected and the sensitive nature of the information.

“What makes the incident even more unacceptable is that the trust failed to learn the lessons from a similar smaller-scale incident, also investigated by the information commissioner, that occurred in 2010,” he said. “Had the trust taken the necessary remedial measures then, it is likely that this later more serious breach would not have occurred.”