A total of 15 staff members have now been dismissed by Nottingham University Hospitals NHS Trust for improperly accessing the medical records of victims targeted in the 2023 Nottingham attacks, the hospital trust confirmed in an update on Friday.
The announcement follows an internal investigation that previously saw 11 employees terminated in May. The hospital trust revealed that the disciplinary measures extend across various professional tiers, involving doctors, nurses, registered healthcare professionals, and other support staff. Beyond the 15 dismissals, the trust issued 15 final written warnings and two first written warnings, while two cases were reviewed and found to have no case to answer, resulting in no further action.
The unauthorized file accesses directly impacted the records of Nottingham university students Barnaby Webber and Grace O'Malley-Kumar, alongside grandfather Ian Coates, all three of whom were fatally stabbed on 13 June 2023. The perpetrator, Valdo Calocane, who had been diagnosed with paranoid schizophrenia in 2020, pleaded guilty in January 2024 to manslaughter on the grounds of diminished responsibility and is currently serving an indefinite hospital order at a high-security facility. The trust noted that ongoing inquiries are also looking into unauthorized record views involving surviving victims Wayne Birkett, Sharon Miller, and Marcin Gawronski.
Responding to the latest findings, Dr Sanjoy Kumar, the father of Grace O'Malley-Kumar, expressed sharp outrage over the breaches. He stated that he was appalled and called for immediate control over institutional failures, remarking that it was disgraceful for voyeuristic personnel in the NHS to scrutinize highly confidential medical data.
Dr Manjeet Shehmar, the medical director at Nottingham University Hospitals NHS Trust, extended an apology to the bereaved families and emphasized that non-legitimate access to patient files will face strict consequences. She expressed deep regret that the grief of the victims' families had been compounded by the improper actions of hospital personnel, stressing that there is simply no excuse for viewing patient records without a valid clinical reason. She added that the trust hopes the disciplining of staff conveys a clear message regarding enforcement.
Shehmar acknowledged that while the conduct of the dismissed employees was deeply disappointing, it represented a small fraction of the broader workforce. She assured that staff members across the organization are actively learning to ensure that only lawful and justified file access occurs. To prevent future incidents, the trust has alerted independent regulatory and oversight bodies, including the General Medical Council, the Nursing and Midwifery Council, the Information Commissioner's Office, and Nottinghamshire Police.
In response to the privacy breaches, the trust is implementing a specialized detection system, currently in its testing phase, designed to safeguard patient records and issue automated alerts whenever potential unauthorized access occurs. The hospital administration has also launched an educational campaign titled "Your Responsibility, Your Actions, Their Privacy" to reinforce data protection mandates and outline the serious repercussions of violating patient confidentiality.
The disclosures surrounding NHS record breaches come amid broader scrutinies brought to light by the statutory Nottingham Inquiry. Presided over by retired senior judge Deborah Taylor KC, the judge-led public inquiry investigated systemic failures and agency interactions prior to and following the tragic events of 13 June 2023. Over 14 weeks between February and June 2026, the inquiry heard testimony from 164 witnesses, culminating in two days of closing statements in September. The inquiry's final findings are scheduled for publication by May 2027.
Evidence presented to the inquiry detailed missed opportunities and operational shortcomings across multiple state institutions, including healthcare providers and law enforcement. Proceedings revealed that Calocane had been sectioned four times under the Mental Health Act prior to the fatal stabbings and had accumulated a history of violent incidents known to police.
The inquiry also exposed data handling infractions across other public bodies. In January 2024, court workers were found to have inappropriately accessed details regarding the case. Amy Holmes, interim director general for the chief operating group at the Ministry of Justice, informed the inquiry that specific details regarding the compromised information could not be disclosed due to an active police investigation. Additionally, seven probation service officers were investigated for viewing case records. An internal review by HM Prison and Probation Service concluded that four officers held legitimate access reasons, whereas three did not; however, the Ministry of Justice's data protection unit determined those breaches were not severe enough to prompt formal disciplinary measures.
Following a formal complaint submitted in March by Barnaby Webber's mother, Emma Webber, police confirmed they would execute a comprehensive audit to determine the exact frequency and legitimacy of case file views across official channels.
He added: "Clearly, the way that the highest confidential data, which is medical data, is being looked at by voyeuristic people in the NHS is disgraceful."
As well as the dismissals, NUH said 15 final written warnings and two first written warnings have also been issued in total.
