NHS Trust Suspends 10 Staff for Snooping on Dead Toddler Noah Woods' Medical Records

Ten NHS employees have been suspended or pulled off active duty after unauthorized staff accessed the private medical records of Noah Woods, the three-year-old who died after wandering out of a Suffolk playground earlier this month.

East Suffolk and North Essex NHS Foundation Trust confirmed the suspensions in a statement issued Sunday, September 27. Dr Martin Mansfield, the trust's deputy chief medical officer, called the breach "completely unacceptable" and said the trust has "apologised unreservedly" to Noah's family, according to the BBC and The Guardian.

What actually happened

Noah went missing from a playground on Merriam Close in Brantham, Suffolk, on September 15 after slipping away from a relative through a gap in the fence, Suffolk police said. More than 1,300 members of the public joined the search. Police divers recovered his body the next day from Decoy Pond, five meters from the bank among tree roots, according to ITV News. Police say his death is not being treated as suspicious.

An inquest opened and was adjourned in Ipswich on Friday, September 25. Assistant coroner Jyoti Gill called it a "very sad and tragic death." The Manchester Evening News and The Daily Mirror reported Noah was non-verbal and had been waiting on an autism assessment.

The trust says it didn't wait for a complaint. Because the case was high-profile, its information governance team proactively audited the main electronic patient record system starting September 17, checking who had opened Noah's file between 5:30 p.m. on September 15, when his disappearance was confirmed, and the night of September 16, when police confirmed his death, according to the Manchester Evening News and Daily Mirror, both citing trust statements.

That audit turned up unauthorized access. Ten staff have been "removed from active duty or suspended whilst investigations are concluded," a trust spokesperson said. Anna Turner, the trust's deputy director of communications, told the BBC the trust has now made it "impossible to find [Noah's] record" going forward, and that staff receive regular information-governance training, including posters in staff areas.

The trust has reported the matter to the Information Commissioner's Office and says it's now also checking other NHS systems Noah had contact with before his death, per the Manchester Evening News.

A pattern, not a one-off

NHS staff have been caught snooping on patient files in other high-profile cases before, including after the 2023 Nottingham attacks and the 2024 Southport dance class stabbings. The Guardian noted this pattern. NHS England chief executive Sir Jim Mackey addressed the issue directly on Friday, September 25, saying staff would be suspended immediately if found accessing records without authorization. "We have seen too many cases of people abusing that trust, and enough is enough," Mackey said, according to The Guardian.

Mackey's statement is a direct admission from the top of NHS England that this keeps happening. The system evidently relies on after-the-fact audits triggered by media attention, not real-time controls that stop curious staff from opening a dead child's file in the first place. Whether the ICO's investigation results in fines or just another round of promises is an open question the trust hasn't answered.

The trust did catch this itself. Turner told the BBC the breach was found through a "proactive" search precisely because the case was high-profile, not because a whistleblower or the family flagged it. Unlike some past scandals, this one wasn't buried until a journalist or watchdog forced it out.

The family, and what's still unresolved

Noah's mother, Charlie Peck, issued a plea to other parents after his death: "If there is one thing we could ask of people, it is to hold their children a little tighter, cherish every moment, and never take those precious memories for granted." His father, Rhys Woods, posted on Facebook that Noah was "the sweetest and most innocent little boy, with nothing but love to give."

What isn't yet known: how many of the 10 suspended employees will face formal disciplinary action, whether any will be dismissed or referred to their professional regulators, and what the ICO's investigation concludes about the trust's data controls. The trust has not said whether the other NHS systems it's now auditing turned up additional unauthorized access. Given Mackey's admission that this is a recurring problem across the NHS, the real question is whether any trust will face real regulatory teeth the next time a family's grief becomes staff room gossip.