Seven patients and 34 staff members caught Covid in a cardiac unit at Wolverhampton's New Cross hospital. Two patients died in hospital and another later died in a hospice.
An internal investigation into the outbreak revealed that some staff members had come to work with potential symptoms of Covid, while hand hygiene and use of PPE was not always of an acceptable standard.
It also found that the staff rest area was too small and inadequate to maintain social distancing, and that non-Covid wards were loaning equipment which potentially could risk further cross contamination.
The Royal Wolverhampton NHS Trust said the outbreak had occurred when infection rates in the community were at their highest.
It denied there had been any staff-to-patient transmission, but said patients may have caught Covid from each other.
The two patients who died in hospital had suffered significant heart problems, the trust said, while investigations were ongoing to determine whether catching Covid there may have contributed to their deaths.
The trust added: "Following the outbreak, we have acted upon all recommendations for improvement, including audits of hand hygiene, audits of mandatory training and appropriate ventilation of areas, and continue to regularly swab inpatients as a precautionary measure."
The failings came to light when letters were sent out to patients regarding the outbreak.
Harold Kingston, known as Philip, told the BBC that his brother, Paul Kingston, had died after contracting Covid on the ward.
He had been admitted to hospital on December 18 with a leaking heart valve. His Christmas Eve operation was cancelled and he was confirmed as having Covid on New Year's Eve.
Although he battled through the infection, the 80-year-old was no longer strong enough to have the operation and died after being transferred to Compton Care hospice.
Mr Kingston told the BBC: "You would have expected him to survive if he could have just had the operation and got out of the hospital.
"He was prevented from doing that by contracting Covid in the hospital and it should not have happened."