When Brian Whittaker began suffering kidney problems in October, his family were anxious about the 79-year-old visiting hospital, worried he might contract Covid-19. His daughter, Julie Tranham, who trained as a nurse at the same hospital, reassured relatives that strict NHS infection control practices meant he would be safe. “I have had to eat my words since,” she said ruefully.

The hospital, Blackpool Victoria, accepts that her father was exposed to Covid-19 in the acute medical unit the day after he was admitted. He was moved to a bay for patients classed as contacts of Covid-19 sufferers, where he was exposed to the virus again, because another patient in the bay tested positive. On 11 October, Whittaker tested positive himself. He died less than two weeks later.

Tranham made contact with the Covid-19 Bereaved Families for Justice group, and was alarmed to find that many of its 2,600 members were grieving for relatives who they believe contracted the virus in hospitals. “I felt sick to the bottom of my stomach,” she recalled.

The many tragedies include: Jack Branch, 67, whose wife Lesley believes he was infected while he was visiting her in hospital; John Lees, 85, who died following a brief hospital stay for anaemia; and Sayed Mohamed Kadri, 74, a former security officer at the British Library, who died in May after being transferred between two London hospitals for a heart bypass operation.

Responding to a complaint from Tranham, Blackpool Victoria told her it had followed correct procedures when it moved her father to the “contact bay”, but said it was “extremely sorry that he contracted Covid and that you feel we have been negligent”. Since then, protocols for screening patients for Covid-19 have been improved, the hospital said.

However, unlike in the case of Tranham’s father, hospitals contacted by the Guardian in relation to the deaths of Branch, Lees, and Kadri do not appear to accept that their patients were infected during their hospital stays.

Pinpointing with certainty when someone contracted Covid-19 is not easy, and bereaved families say they understand that hospitals and their staff have been facing an unprecedented pandemic. But many feel strongly that there have to be answers, and some accountability, over why so many people appear to have been infected with coronavirus in hospitals.

The extent of hospital-acquired, or “nosocomial”, Covid-19 infections and deaths in the pandemic’s first wave led to an investigation by the Healthcare Safety Investigation Branch (HSIB), a body that investigates patient safety in NHS-funded operations in England.

Its report, published on 29 October, made a series of critical findings, and warned that nosocomial infections could be even higher in the second wave, because many healthcare staff were exhausted and emotionally distressed, and because hospitals were likely to have more non–Covid patients.

Figures published by NHS England suggest that 39,088 people were likely to have been infected with Covid-19 in hospitals between 1 August last year and 21 February 2021.

There is less certainty about cases before, during the first wave, because testing was more limited and there was less data. But the Scientific Advisory Group for Emergencies (Sage) published calculations by experts on 12 February, estimating that 31,070 people were infected with Covid-19 in English hospitals during the first wave. It cites research estimating the R rate, the effective reproduction number for the virus, was up to 14 in hospitals.

Infection prevention and control (IPC) in hospitals kept cases much lower than they otherwise would have been, the Sage paper says, but it notes that hospital outbreaks are potentially catastrophic for vulnerable patients.

David Oliver, a consultant in geriatrics and acute general medicine who has worked on Covid-19 wards throughout the pandemic, is now campaigning against alleged failings contributing to infections in hospitals, particularly inadequate protective personal equipment (PPE) and poor ventilation.

He points to under-resourcing of the NHS, citing figures showing the UK second lowest of European OECD countries for hospital beds per 1,000 people. “The pandemic has exposed structural problems many of us have known for years,” he said.

Adrian Boyle, a vice-president of the Royal College of Emergency Medicine, also cited building inadequacies. “Many of our emergency departments are not big enough or well enough designed to offer adequate social distancing or allow infection prevention and control,” he said.

A principal finding of the HSIB investigation, which examined six unnamed NHS trusts, was that the age, quality and design of hospital buildings could hamper infection control. Some buildings dated back to 1900; older hospitals had wards with patients in bays, and fewer single rooms. Ventilation also varied between newer and older buildings.

The report also said national guidance on controlling and preventing infections was not comprehensive, and there was “a lack of clarity” about which national health organisation was responsible for it. It found “a national lack of IPC staff and shared understanding of their role and national IPC requirements”.

Figures show 1,238 coronavirus outbreaks in hospitals were reported to Public Health England between 29 June and 21 February.

Success at preventing infections has varied widely between hospitals, with some in the north-west reporting relatively high numbers of infections. A survey of 23 orthopaedic trauma departments in the north-west, published in November, said it had identified “substantial deficiencies” in Covid-19 infection control measures. The Health Service Journal has reported that NHS England has now asked trusts in the north-west to review their processes.

Responding to questions from the Guardian, a Department of Health and Social Care spokesperson said it accepted the HSIB recommendations that related to it. The government has provided an extra £31.9bn to tackle Covid-19, she said, “including £450m to upgrade and expand A&E facilities and increase infection control measures”.

An NHS spokesperson pointed to a 10-point plan for infection controls published in November, and said millions of staff had been tested since asymptomatic tests were made available. “The root cause of rising infection rates in hospitals is rising rates in the community, so the public have an important role to play in reducing infection rates by following hands, face, space government guidance,” the spokesperson added.

Prof Miltos Petridis, 58, head of computer science at Middlesex University, who was married with four teenage children, was admitted to hospital on 20 March suffering from an abcess. He died due to Covid-19 on Easter Sunday, 12 April.

His wife, Yvonne Fryer, firmly believes he was infected in hospital, although the hospital has not accepted that. Now in lockdown with her four bereaved children aged 18, 19 and twins, 15, Fryer notes that following the government guidance was not enough to save her husband.

“We hear so much from the government that people must follow the rules, yet we did everything we should have done. We were all isolating at home. We expected our loved ones to be safe in hospitals.”