NHS trust sacks 15 staff over Nottingham attack victims’ records
NUH has told the Information Commissioner’s Office and Nottinghamshire Police, and aims to bring in a system to flag suspicious access in early 2027.
Nottingham University Hospitals NHS Trust (NUH) has dismissed 15 staff in its investigation into inappropriate access to the medical records of Ian Coates, Grace O’Malley-Kumar and Barnaby Webber, the trust said on 16 October.
The people covered by the investigation include doctors, nurses, registered healthcare professionals and other staff, it said. The trust set out the outcomes so far:
| outcome | number of cases |
|---|---|
| Dismissal | 15 |
| Final written warning | 15 |
| First written warning | 2 |
| No case to answer | 2 |
The Nottingham Inquiry’s website says the three were killed in the Nottingham attacks on 13 June 2023.
“There is simply no excuse for accessing the records of a patient without a legitimate reason and I hope this sends a really clear message – we will investigate and we will take action,” Dr Manjeet Shehmar, medical director at NUH, said.
Shehmar added: “To lose a loved one in the way that the families of Ian, Grace and Barnaby have is heartbreaking enough. I am so sorry that they have had this further compounded by the actions of these staff members.” The trust said it contacted the families in the week of the announcement to update them on the latest outcomes.
NUH said it began inquiries in 2025 to identify where access to records was illegitimate and considered inappropriate, and applied regulatory standards throughout to ensure “a consistent and fair approach”.
The trust said it is discussing the outcomes with independent regulators, such as the Nursing and Midwifery Council and the General Medical Council. It has also informed the Information Commissioner’s Office and Nottinghamshire Police.
Investigations are continuing into inappropriate access in these cases, including access to the files of surviving victims, NUH said.
Shehmar said the actions of the staff were “disappointing” but represented “a small number of our wider workforce”. The trust is running a campaign called ‘Your Responsibility, Your Actions, Their Privacy’ to explain to staff their responsibilities under data protection rules and the serious consequences of breaches.
NUH is also bringing in a system to monitor access continually, identify suspicious behaviour and generate alerts, audits and reports. Testing is under way, followed by a pilot period, and the trust aims to take the system live in early 2027.
