In the aftermath of a tragedy that claimed three lives in Nottingham in June 2023, a second wound has been opened for the victims' families: the discovery that those entrusted with the sacred privacy of medical records violated that trust out of curiosity rather than care. Fifteen NHS staff have been dismissed, and others disciplined, for accessing the records of the murdered without clinical justification — a pattern of intrusion that has since been found to extend across courts, probation services, and police. The incident asks an enduring question about institutions: whether the systems bui
NHS Trust sacks 15 staff for accessing Nottingham attack victims' records
Three people were stabbed to death in the June 2023 Nottingham attacks; families of victims have suffered additional trauma from unauthorized access to their medical records.
Voyeuristic people in the NHS accessing confidential medical data
Mark
Why does it matter that staff accessed these records without permission? Isn't the real story the attack itself?
Mimi
The attack happened nearly three years ago. These families have already lost loved ones. Then they discover that hospital staff—people they trusted with their most sensitive information—were looking at those records out of curiosity, not care. It's a second violation.
Luke
But we should be clear: the source doesn't say why these fifteen people accessed the records. Were they curious? Did they think they had a reason? The trust says there was no legitimate reason, but that's different from knowing their intent.
Mimi
Fair point. What we know is the access happened and the trust found it unjustifiable. What we don't know is whether these were isolated incidents or part of a culture.
Mark
The trust says it's a small number of staff. Do we believe that?
Luke
The trust would say that. But the fact that they're implementing a new detection system suggests they weren't catching this before. How many other breaches might have gone undetected?
Mimi
That's the real question. And it's not just the NHS. The inquiry heard about Ministry of Justice staff, court workers, probation officers, police—all accessing information about these victims without proper reason.
Mark
So this is systemic?
Luke
We can't say systemic based on this reporting. We can say it happened in multiple places. Whether it reflects a culture or just individual bad actors—that's still unclear.
Mimi
What's clear is that the families have had to relive this trauma through institutional failures, not just the crime itself.
Mark
And the inquiry findings won't come until May 2027. So this story isn't finished.
Luke
Not even close. We're still waiting to see what the judge-led inquiry concludes about how these agencies failed before and after the attacks.
Der Puls
- Families already carrying the weight of violent loss have been told that hospital staff browsed the medical records of their murdered loved ones without any legitimate reason — an act one father called 'voyeuristic.'
- The scale of the breach has grown since first disclosed: fifteen dismissals, fifteen final written warnings, and referrals to independent regulators including the GMC, NMC, and the Information Commissioner's Office.
- The violations are not confined to one institution — courts, probation officers, and police have all been implicated in unauthorized access to files connected to the same attacks, suggesting a systemic failure of data culture across public services.
- The NHS trust is now deploying new detection software and a named staff awareness campaign to close the gap between policy and practice, while investigations into breaches affecting three surviving victims remain ongoing.
- A broader public inquiry, having heard 164 witnesses over fourteen weeks, is not expected to deliver its findings until May 2027 — leaving families in a prolonged state of unresolved accountability.
In the aftermath of a tragedy that claimed three lives in Nottingham in June 2023, a second wound has been opened for the victims' families: the discovery that those entrusted with the sacred privacy of medical records violated that trust out of curiosity rather than care. Fifteen NHS staff have been dismissed, and others disciplined, for accessing the records of the murdered without clinical justification — a pattern of intrusion that has since been found to extend across courts, probation services, and police. The incident asks an enduring question about institutions: whether the systems built to protect the vulnerable can also protect them from the institutions themselves.
Fifteen members of staff at Nottingham University Hospitals NHS Trust have been dismissed after it emerged they accessed the medical records of three people murdered in the June 2023 Nottingham attacks without any legitimate clinical reason. Barnaby Webber, Grace O'Malley-Kumar, and Ian Coates were killed by Valdo Calocane on June 13, 2023. The trust had initially disclosed eleven dismissals in May; the revised figure of fifteen emerged as the investigation continued.
Beyond those dismissed, fifteen final written warnings and two first written warnings were issued to other staff. The disciplinary action spans doctors, nurses, and other healthcare professionals. Independent regulators — including the Nursing and Midwifery Council, the General Medical Council, and the Information Commissioner's Office — have all been notified.
Dr. Sanjoy Kumar, father of Grace O'Malley-Kumar, described the unauthorized access as 'voyeuristic' and said it compounded his family's grief. The trust's medical director, Dr. Manjeet Shehmar, offered an apology to the families, acknowledging there is no justification for accessing records without clinical need. He stressed that those responsible represent only a small fraction of the wider workforce.
The trust is now testing a new system designed to detect and flag unauthorized access attempts, and has launched a staff campaign — 'Your Responsibility, Your Actions, Their Privacy' — to reinforce data protection obligations. Investigations into unauthorized access to the records of three surviving victims are also continuing.
The breaches extend well beyond the hospital. Court workers, probation officers, and Nottinghamshire Police staff have all been found to have accessed files connected to the attacks without legitimate purpose. A complaint from Barnaby Webber's mother, Emma Webber, prompted the police to commit to a full audit of those viewings. Meanwhile, the judge-led Nottingham Inquiry, having heard evidence from 164 witnesses across fourteen weeks in 2026, is expected to publish its findings by May 2027.
Fifteen staff members at Nottingham University Hospitals NHS Trust have been dismissed for accessing the medical records of three people killed in a stabbing attack in June 2023 without legitimate reason. Barnaby Webber and Grace O'Malley-Kumar, both Nottingham students, and Ian Coates, a grandfather, were murdered on June 13, 2023, by Valdo Calocane, who had been diagnosed with paranoid schizophrenia in 2020. The trust first disclosed eleven dismissals in May; the updated figure of fifteen came to light on Friday as the investigation into unauthorized record access continued.
Beyond the dismissals, the trust has issued fifteen final written warnings and two first written warnings to other staff members. Two cases were closed with no action taken. The disciplinary action spans doctors, nurses, registered healthcare professionals, and other staff categories. Independent regulators including the Nursing and Midwifery Council, the General Medical Council, the Information Commissioner's Office, and Nottinghamshire Police have all been notified of the breaches.
Grace O'Malley-Kumar's father, Dr. Sanjoy Kumar, expressed his distress at the violations. He called the pattern of access by NHS staff "voyeuristic" and described it as compounding the families' grief. Dr. Manjeet Shehmar, the trust's medical director, acknowledged the gravity of the breaches, stating there is no justification for accessing patient records without legitimate clinical reason. He apologized to the families for the additional harm caused by staff actions, describing the loss itself as already heartbreaking.
The trust is implementing a new system, currently under testing, designed to detect potential data breaches and alert management to unauthorized access attempts. Staff have also been subjected to a campaign titled "Your Responsibility, Your Actions, Their Privacy" aimed at reinforcing data protection obligations and the serious consequences of violations. Shehmar said the trust would continue investigating inappropriate access and educating staff on lawful record access practices, while emphasizing that the offending staff represent a small fraction of the wider workforce.
Investigations are also ongoing into unauthorized access to records of three surviving victims of the attacks: Wayne Birkett, Sharon Miller, and Marcin Gawronski. The breaches at the NHS trust are part of a broader pattern of unauthorized access across multiple public institutions. In December 2024, an investigation opened into allegations that Ministry of Justice staff illegally accessed files related to the attacks. The public inquiry subsequently heard that court workers also inappropriately viewed case information in January 2024. Seven probation service officers were identified as having accessed files; three of those accesses were deemed to lack legitimate justification, though the probation service and Ministry of Justice data protection unit concluded the breaches did not warrant further disciplinary action. Nottinghamshire Police confirmed that staff viewed footage and images from the attacks multiple times without legitimate policing purpose, and the force committed to auditing the extent and appropriateness of those viewings following a complaint from Barnaby Webber's mother, Emma Webber, in March.
Calocane, who had been sectioned four times under the Mental Health Act and had a documented history of police interactions linked to violent incidents, pleaded guilty to manslaughter on grounds of diminished responsibility in January 2024 and is serving an indefinite hospital order. The judge-led Nottingham Inquiry, led by retired senior judge Deborah Taylor KC, has been examining the lead-up to the attacks and the response by authorities including the NHS and police. The inquiry heard evidence from 164 witnesses over fourteen weeks between February and June 2026, plus two days of closing statements in September. Its findings are expected by May 2027.
Bemerkenswerte Zitate
The way that the highest confidential data, which is medical data, is being looked at by voyeuristic people in the NHS is disgraceful.— Dr. Sanjoy Kumar, father of victim Grace O'Malley-Kumar
There is simply no excuse for accessing the records of a patient without a legitimate reason. To lose a loved one in the way that the families of Ian, Grace and Barnaby have is heartbreaking enough. I am so sorry that they have had this further compounded by the actions of these staff members.— Dr. Manjeet Shehmar, medical director at Nottingham University Hospitals NHS Trust
Möchten Sie die ganze Geschichte?
Das Original lesen bei BBC News ↗
Health & Medicine