NHS Trust Has Dismissed 15 Staff Over Access to Nottingham Attack Victims' Records

Fifteen people have now lost their jobs at Nottingham University Hospitals (NUH) NHS Trust for looking at medical records they had no business opening.

The trust gave the updated figure on Friday, Oct. 16. It is a running total, not 15 new sackings. In May the trust confirmed 11 dismissals.

The records belong to Barnaby Webber, Grace O'Malley-Kumar and Ian Coates. Valdo Calocane, who was diagnosed with paranoid schizophrenia in 2020, stabbed the three to death on 13 June 2023.

The disciplinary tally

Beyond the dismissals, the trust said it has issued 15 final written warnings and two first written warnings. Two cases ended with no case to answer and no action.

The trust said the action covered "doctors, nurses, registered healthcare professionals and other staff." It did not say how the outcomes break down by profession, and it has not named anyone.

The trust has told the Nursing and Midwifery Council, the General Medical Council, the Information Commissioner's Office and Nottinghamshire Police. Those bodies hold their own powers over registered professionals and data-protection breaches. None has announced an outcome.

What the families and the trust said

Dr Sanjoy Kumar, Grace's father, said he was "appalled, it's time to get a handle on these failures." He called it "disgraceful" that "the highest confidential data, which is medical data, is being looked at by voyeuristic people in the NHS."

Dr Manjeet Shehmar, NUH's medical director, said: "There is simply no excuse for accessing the records of a patient without a legitimate reason." He apologised to the families of Ian, Grace and Barnaby for the extra distress.

Shehmar also pushed back on any broader reading. "While the actions of these staff members are disappointing, we know that this represents a small number of our wider workforce," he said.

That is the trust's position. The families have not said whether they accept it. Kumar's call for a handle on "these failures" points at the system, not just the individuals.

Why a login is not a license

Hospital staff have to open records quickly. A patient arrives in an emergency or moves between teams, and clinicians need the file.

The Information Commissioner's Office has made the distinction explicit: being able to open a record does not mean you have a legitimate reason to read it. The trust applied the same standard in May, saying access had to be lawful, justified and tied to the person's role.

Working in a hospital does not entitle anyone to browse patient files out of curiosity.

The fix still being tested

The trust said it is bringing in a new system to protect patient records and alert managers to possible breaches. The system is still under testing. Staff have also been through a campaign titled "Your Responsibility, Your Actions, Their Privacy," which warns of "serious consequences" for breaking the rules.

The sackings came after the snooping, and the detection tool is still not fully running. The trust has not said how the original access came to light or how long it went on.

The trust has contacted the bereaved families this week with the latest outcomes.

Not an isolated problem

The Nottingham case is not the only recent example in the NHS. The Yorkshire ambulance service has opened an investigation into two staff members who may have accessed, or tried to access, incident or medical information about William Chapman without a legitimate reason.

Chapman, 23, was killed by a Siberian tiger after he climbed into an enclosure at Yorkshire Wildlife Park. The ambulance trust said it found the concern through "proactive audits" and has reported it to the Information Commissioner's Office.

The trust told Chapman's family about the investigation. An inquest heard that Chapman had schizophrenia and had experienced bouts of psychosis. A full inquest is set for 18 March.

That case shows audits can catch this behavior, and it also shows the behavior keeps happening after high-profile tragedies.

What is still open

NUH said its investigations are continuing, including into access to the records of the attacks' surviving victims: Wayne Birkett, Sharon Miller and Marcin Gawronski.

The trust said it "will continue to investigate inappropriate access to these records and take action as and where necessary." The 15 dismissals could still grow, and the regulators holding the referrals have yet to say what, if anything, they will do.