Nottingham University Hospitals NHS Trust has dismissed a further 15 members of staff after investigations found they had inappropriately accessed the medical records of victims of the Nottingham attacks.
The latest disciplinary action brings the total number of dismissals linked to the investigation to 15. In addition, the Trust has issued 15 final written warnings and two first written warnings. Those sanctioned include doctors, nurses, registered healthcare professionals and other members of staff. Two individuals were found to have no case to answer, and no action was taken against them.
The families of Ian Coates, Grace O'Malley-Kumar and Barnaby Webber were informed of the latest findings this week.
NUH launched detailed investigations in 2025 to determine which instances of access to patient records were unauthorised and inappropriate. The Trust said all cases were assessed in accordance with regulatory standards to ensure a fair and consistent process.
Dr Manjeet Shehmar, Medical Director at NUH, said:
“There is simply no excuse for accessing the records of a patient without a legitimate reason, and I hope this sends a really clear message – we will investigate, and we will take action.
“To lose a loved one in the way that the families of Ian, Grace and Barnaby have is heartbreaking enough. I am so sorry that they have had this further compounded by the actions of these staff members.
"We will continue to investigate inappropriate access to these records and take action as and where necessary. Alongside this, we are doing all we can to educate our staff on appropriate access and how to keep the records of our patients safe. We are also introducing a new system which acts to detect possible data breaches.
“While the actions of these staff members are disappointing, we know that this represents a small number of our wider workforce. We know staff across the Trust are listening, learning and doing what they can to ensure that only lawful and justified access takes place in our hospitals.”
As part of the disciplinary process, NUH is discussing outcomes with relevant professional regulators, including the Nursing and Midwifery Council (NMC) and the General Medical Council (GMC).
The Trust has also notified the Information Commissioner’s Office (ICO) and Nottinghamshire Police.
Investigations remain ongoing into inappropriate access to records connected to the Nottingham attacks, including the files of surviving victims Wayne Birkett, Sharon Miller and Marcin Gawronski.
Alongside the investigations, NUH has expanded staff awareness initiatives through its ‘Your Responsibility, Your Actions, Their Privacy’ campaign. The programme is designed to reinforce employee responsibilities around patient confidentiality, data protection and the potentially severe consequences of data breaches.
The Trust is also introducing a new monitoring system aimed at strengthening the security of patient records. The technology will continuously monitor access to records, flag potentially suspicious activity and generate automated alerts, audits and reports to support earlier detection of possible breaches.
Testing is currently underway, with a pilot programme planned before the system is expected to go live early next year.
The latest disciplinary action represents one of the most significant NHS responses to inappropriate patient-record access in recent years and highlights the increasing scrutiny being placed on information governance, patient confidentiality and staff accountability across the health service.
Image credit: iStock
