Yvette Cooper Says NHS Staff Who Improperly Access Patient Records Should Be Suspended, Then Sacked

Since Nottingham University Hospitals NHS Trust said in May that it had sacked 11 staff for improperly viewing the records of the 2023 Nottingham attack victims, the count has risen to 15. Now the Health Secretary has weighed in, and a second case is under investigation.

Yvette Cooper spoke on Sunday, Oct. 18, to both the BBC's Sunday with Laura Kuenssberg and Sky News. Her message was the same on each: patient data is not public entertainment.

"If there are breaches then people actually need to be sacked," she told Sky News.

Cooper's line: suspend first, sack after

Cooper said she had spoken to the NHS chief executive. The two agreed that anyone suspected of inappropriately accessing records should be suspended while the investigation runs.

She also called for "a much swifter line on this." Her reasoning: "these are basic standards, and everybody across the NHS knows that these are the basic standards."

She named the motives she considers unacceptable: "voyeurism, or what is in the news, or any of that kind of reason." On the BBC she said there "has got to be proper respect for patients" and that "there are proper data and privacy standards across the NHS."

The Nottingham numbers

Nottingham University Hospitals announced the further dismissals on Friday, Oct. 16. The trust has now dismissed 15 staff, issued 15 final written warnings and two first written warnings. The action covered "doctors, nurses, registered healthcare professionals and other staff."

The victims are Barnaby Webber and Grace O'Malley-Kumar, both 19, and Ian Coates, 65. Valdo Calocane killed them on June 13, 2023.

The trust says it has told the Nursing and Midwifery Council, the General Medical Council, the Information Commissioner's Office and Nottinghamshire Police. It is also testing a new system meant to protect patient records and alert the trust to potential breaches. Dr Manjeet Shehmar, the trust's medical director, said there is "simply no excuse for accessing the records of a patient without a legitimate reason."

The victims' families were told about the latest update this week.

A new case in Yorkshire

Yorkshire Ambulance Service opened an investigation on Friday into two staff members who may have accessed, or tried to access, the records of William Chapman without a legitimate reason. Chapman, 24, died at Yorkshire Wildlife Park near Doncaster on Saturday, Oct. 10, after being attacked by a tiger.

That is a possible breach, not a finding. The ambulance service says the access may have been illegitimate, and its investigation is under way. Cooper acknowledged a specific investigation is in progress.

An inquest has heard that Chapman scaled two fences to reach the Land of the Tigers enclosure. The coroner was told he had a schizophrenia diagnosis and previous bouts of psychosis, and that his family had raised "a number of concerns" about his contact with mental health services. Doncaster and South Humber NHS Foundation Trust has opened a separate investigation into its handling of his case.

A father asks what changes

Not everyone is satisfied with talk of standards. Dr Sanjoy Kumar, Grace O'Malley-Kumar's father, reacted to the Nottingham dismissals on Saturday and said the families want to meet Cooper.

"I'd like to ask Yvette Cooper the question, when is this going to stop and what is she doing exactly to make this stop and decrease the suffering of people who are victims of crime and of major incidents," Kumar said.

He added: "I am appalled. It's time to get a handle on these failures." He described medical data as the "highest confidential data" and accused "voyeuristic people in the NHS" of looking at it.

Cooper's answer so far is the suspension-then-dismissal approach she says she agreed with the NHS chief executive. She has not, in the remarks reported, said whether she will meet the families.

Not the first trust, not the first case

The problem is not confined to Nottingham. In May, the NHS trust that runs Aintree hospital in Liverpool admitted that nearly 50 staff had looked inappropriately at the records of victims of the Southport knife attack.

Nicola Ryan-Donnelly of Fletcher's Solicitors, which represents many of the injured children, called it a "deeply disturbing abuse of power and a shocking breach of privacy."

Three separate cases now sit on the table: Nottingham, Southport and the possible Chapman access. Each involves a high-profile death or attack, and in each the question was the same: who looked, and why.

What enforcement has looked like

When Nottingham announced its first 11 dismissals in May, the Information Commissioner's Office said it would "assess any evidence provided by the trust in due course and consider our next steps." Nottinghamshire Police said there was "no criminal investigation." The sources contain no later update from either body.

The trust has informed the ICO and police again with this week's news. What the ICO decides, and whether police revisit their position, will show whether sackings stay the only consequence. Kumar's request for a meeting with Cooper is the other open item, and she has not yet responded publicly to it.