More staff at the NHS trust responsible for treating victims of the Nottingham attacks have been sacked after illegally accessing patient records, the hospital has confirmed.
Nottingham University Hospitals NHS Trust has now dismissed multiple employees for inappropriately looking up the medical files of people connected to the June 2023 attacks, in which Vicky Ashworth, Grace O’Malley-Kumar and Ian Coates were killed by Valdo Calocane.
The trust had already faced serious questions about staff conduct after it emerged that employees had been snooping on sensitive records belonging to victims and their families without any legitimate reason to do so. These are people who suffered one of the worst days of their lives, and instead of being protected, their private medical information was being browsed by colleagues with no business looking at it.
For the families involved, the revelation has added yet another layer of pain to an already devastating situation. Several relatives of the victims have spoken publicly about feeling let down not just by the criminal justice system, but now by the very hospital that was supposed to care for their loved ones.
The trust has not confirmed exactly how many members of staff have been dismissed in total, but it is understood the number has grown following an internal investigation that has been quietly ongoing for some time. The probe was launched after concerns were first raised about unauthorised access to records in the aftermath of the attacks.
In response to the scandal, Nottingham University Hospitals NHS Trust says it will introduce a new system specifically designed to better protect the records of high profile or sensitive cases. The idea is to create an additional layer of security that flags or restricts access when patient files are linked to major incidents or public cases, making it much harder for curious or malicious staff to simply pull up records they have no reason to see.
NHS patient records are supposed to be strictly confidential. Staff are only permitted to access files that are directly relevant to the care they are providing. Browsing records out of curiosity, even without sharing the information, is a serious disciplinary offence and can also amount to a breach of data protection law.
The Information Commissioner’s Office has the power to investigate and prosecute individuals who unlawfully access personal data, and cases like this can result in criminal charges under the Computer Misuse Act as well as dismissal.
Critics have pointed out that this kind of unauthorised access is not unique to Nottingham. High profile cases across the country have repeatedly exposed a culture in parts of the NHS where some staff treat sensitive records as something to be looked at out of curiosity rather than clinical necessity. Tighter technical controls, rather than relying purely on staff following the rules, have long been recommended by data protection experts.
For the families of Barnaby Webber, Grace O’Malley-Kumar, and Ian Coates, who have already fought hard for answers about how Calocane was able to carry out the attacks despite his known history of serious mental illness, this latest development is another blow. Many have been vocal about wanting full accountability from every institution involved, and that now includes the hospital trust.
The trust has apologised and said it takes patient confidentiality extremely seriously. But for families already deep in grief and frustration, those words will need to be backed up by real, lasting change in how the system protects the most vulnerable people who pass through its doors.