NHS sacks 15 staff for snooping on Nottingham victims’ records

The trust said it had also issued 15 final written warnings and two first written warnings as its investigation continued into access to the records of Ian Coates, Barnaby Webber and Grace O’Malley-Kumar, who were killed by Valdo Calocane in 2023.

Doctors, nurses, registered healthcare professionals and other staff were among those investigated. The families were told about the latest update this week, the trust said.

There is a grim banality to this kind of breach. The victims are dead, the families are already carrying that fact, and yet the privacy owed to them still had to be defended against staff who, according to the trust, had no legitimate reason to be in those files.

Dr Manjeet Shehmar, NUH’s medical director, said: “There is simply no excuse for accessing the records of a patient without a legitimate reason and I hope this sends a really clear message – we will investigate and we will take action.

“To lose a loved one in the way that the families of Ian, Grace and Barnaby have is heartbreaking enough. I am so sorry that they have had this further compounded by the actions of these staff members.”

She said the trust would continue investigating inappropriate access, was educating staff on proper use of records and was introducing “a new system which acts to detect possible data breaches”.

The scale of discipline here is the point. Fifteen dismissals is no longer a matter of one rogue click dressed up as curiosity. It is an institutional embarrassment, and the trust’s own figures show it sits alongside a wider pattern serious enough to produce dozens of sanctions.

The case also lands in the middle of a broader NHS crackdown. In September, NHS England head Sir Jim Mackey said staff suspected of inappropriately accessing patient records would be suspended immediately and have their access to NHS computer systems cut off. He said there had been “too many cases” of workers abusing trust and warned that snooping could cost staff their careers and leave them with a criminal record.

The Independent said that in other recent cases, dozens of staff at University Hospitals of Liverpool Group looked at the records of victims of the Southport attack, while around 40 hospital staff viewed the records of a three-year-old boy injured after falling into a crocodile pit in Cambridgeshire.

At Nottingham, the trust says the investigation is still continuing.