Nottingham University Hospitals NHS Trust has now dismissed 15 staff for looking at the medical records of the Nottingham attack victims without any reason to do so. It has told the ICO and the police, and it says an automated system to monitor record access should be live early next year.
What happened
On 16 October 2026, Nottingham University Hospitals NHS Trust (NUH) gave an update on its internal investigation into staff who opened the medical records of Ian Coates, Grace O’Malley-Kumar and Barnaby Webber without a legitimate reason. The three were killed in Nottingham in June 2023. Fifteen employees have now been dismissed. Another 15 have received final written warnings and two have received first written warnings. In two further cases the trust found no case to answer.
The total has gone up since May, when the trust said 11 staff had been sacked and 14 more had faced lesser sanctions. The trust says those investigated include doctors, nurses and other registered healthcare professionals, as well as other staff groups. The trust began its inquiries in 2025 and contacted the families during the week of the update to tell them the latest outcomes.
NUH says it is discussing outcomes with the General Medical Council and the Nursing and Midwifery Council, which can strike people off their registers. It has also told the Information Commissioner’s Office (ICO) and Nottinghamshire Police. The investigation is still going on and now covers access to the records of the three people who survived the attacks.
The trust’s medical director, Dr Manjeet Shehmar, said there is no excuse for opening a patient’s record without a legitimate reason, and added that “we will investigate and we will take action”. The trust also apologised to the families for the further distress caused.
The detail
This is not a breach in the usual sense. Every person disciplined had a valid login to a clinical system and used it for something they had no business doing. In UK GDPR terms, it is a failure of confidentiality caused by authorised users, and that is the kind of failure perimeter controls never see.
The trust’s own account says it is responding in three ways. The first is accountability: dismissals, warnings, referrals to professional regulators and notification of the police. The second is awareness: an internal campaign called “Your Responsibility, Your Actions, Their Privacy” explains staff duties under data protection law and what happens when they breach them. The third is detection: a new system that continuously monitors who opens which records, flags suspicious behaviour and produces alerts, audit trails and reports. That system is still being tested, a pilot will follow, and it is expected to go live early next year.
The timeline is worth noticing. The attacks happened in June 2023, the trust’s inquiries started in 2025, and automated detection is not due until early 2027. That suggests the improper access was found mainly by looking back through access logs after the event, not by an alert at the moment a record was opened. Retrospective review clearly works, but it is slow and leaves patients exposed in the meantime.
Why it matters for UK organisations
Nottingham is one of several such cases. In September, Sir Jim Mackey, the head of NHS England, wrote to every trust. He said staff suspected of improperly accessing patient records should be suspended straight away and lose their system access, and he warned of “too many cases” of staff abusing that trust. Press reports this year have also described dozens of Liverpool hospital staff viewing records of Southport attack victims, and around 40 staff opening the file of a young child injured in Cambridgeshire.
When a patient or customer is in the news, curiosity jumps, and the people with access are the ones most likely to look. Banks, police forces, councils, telecoms providers and anyone holding records on high-profile people face the same risk. A “need to know” rule only means something if it is enforced and checked. Writing it into a policy is not enough.
Article 32 of the UK GDPR requires a controller to implement appropriate technical and organisational measures to secure personal data, and health data is special category data that calls for extra care. Separately, section 170 of the Data Protection Act 2018 makes it an offence to knowingly or recklessly obtain or disclose personal data without the controller’s consent. A snooping employee can face prosecution, and the organisation can still be asked how its controls allowed it.
Expert view
In my experience, insider misuse of legitimate access is the risk most organisations manage worst, and it is not because they lack tools. Most electronic patient record and case management systems already log every record that is opened. The weak points are elsewhere: nobody reviews the logs, nobody has defined what normal looks like, and the logs only get pulled once a complaint comes in.
When we assess access controls, role-based access often turns out to be far too generous. In clinical settings that is often deliberate, because blocking a clinician in an emergency can cause harm. Locking everything down is not the answer. It is to combine broad access with “break the glass” prompts that ask for a reason, extra protection on records flagged as sensitive or high profile, and alerts when someone opens a record with no link to their ward, team or caseload.
Deterrence matters as much as detection. Staff who know their access is watched in near real time behave differently from staff who believe nobody looks at the logs. Visible, consistent consequences are a control in themselves, and they work best when staff know about them in advance. Early, honest communication with the people affected should also be part of the incident response plan.
What to do now
- Find your high-profile records. Agree in advance how patients, customers or citizens who become newsworthy will be flagged, and switch on extra controls and real-time alerts for those records as soon as a major incident is declared.
- Turn audit logs into detection. Make sure record-access logs are kept, centralised and searchable. Build alerts for access with no care relationship, unusual volumes, access by staff outside the relevant team, and access to colleagues’ or family members’ records.
- Tighten access control. Review role-based access against least privilege, remove dormant and leaver accounts promptly, and check privileges after role changes. This fits the Cyber Essentials user access control requirements.
- Brief staff before the next incident. Remind them that every access is logged and reviewed, explain the legal and professional consequences, and repeat the message whenever a sensitive case enters the news.
- Rehearse the response. Set out how suspected snooping will be handled: suspension of access, evidence preservation, HR and regulator referral, ICO notification decisions and communication with the people affected.
Bottom line
Fifteen dismissals is a clear statement, but it comes years after the access took place. The lesson for any UK organisation holding sensitive records is that access logs which nobody reads are not a control. Detecting insider misuse in close to real time, with known consequences, protects people far better than disciplinary hearings after the event.
Sources
- Nottingham University Hospitals NHS Trust: NUH dismisses further staff in inappropriate access investigations
- West Bridgford Wire: 15 NHS staff sacked over accessing Nottingham attack victims’ medical records
- Greatest Hits Radio (PA): More NHS staff sacked for accessing records of Nottingham stabbing victims
- News Beep: Fifteen NHS staff sacked after accessing medical records of Valdo Calocane victims
- LBC: Eleven NHS staff sacked for inappropriately accessing Nottingham stabbing victims’ medical records
- legislation.gov.uk: UK GDPR, Article 32 (Security of processing)
- legislation.gov.uk: Data Protection Act 2018, section 170 (Unlawful obtaining etc of personal data)
- Time News: Nottingham Trust fires four more staff over attack records
