Fifteen NHS staff members have been dismissed for improperly accessing the medical records of victims of high-profile incidents, prompting the health secretary to condemn the breaches as a “disgrace” and call for stronger enforcement of privacy standards.
According to the BBC, Nottingham University Hospitals (NUH) NHS Trust confirmed it had sacked a total of 15 employees for inappropriately viewing the medical files of three people murdered in the Nottingham attacks. Meanwhile, Yorkshire Ambulance Service has launched an investigation after staff may have accessed records of William Chapman, who died after being mauled by a tiger at Yorkshire Wildlife Park in October.
Health Secretary Yvette Cooper told BBC’s Sunday with Laura Kuenssberg that she expected action to be taken against staff who breach NHS data and privacy standards. “There are proper data and privacy standards across the NHS,” she said. “Every member of NHS staff knows that, and every member of NHS staff needs to abide by it.”
Cooper added that she had spoken to the NHS England chief executive about the matter and expected people to be swiftly suspended whilst investigations take place. “There’s got to be proper respect for patients, and I think that is a core value in the NHS,” she stated.
Details of the breaches
The Nottingham incidents involved the medical records of Barnaby Webber, Grace O’Malley-Kumar and Ian Coates, who were stabbed to death on 13 June 2023 by Valdo Calocane, a man diagnosed with paranoid schizophrenia in 2020.
NUH initially announced in May that it had dismissed 11 staff members for the breaches and subsequently added four more to that total. According to the trust, those sacked included doctors, nurses, registered healthcare professionals and other staff. The trust informed the Information Commissioner’s Office (ICO), Nottinghamshire Police and independent regulators such as the Nursing and Midwifery Council and General Medical Council.
Dr Manjeet Shehmar, NUH medical director, said previously that there was “simply no excuse for accessing the records of a patient without a legitimate reason”.
The trust has stated that a new system, currently being tested, will be implemented to protect patient records and alert the organisation to potential breaches in future.
Dr Sanjoy Kumar, father of victim Grace O’Malley-Kumar, responded to the dismissals by calling the situation “disgraceful” and demanding action. “Clearly, the way that the highest confidential data, which is medical data, is being looked at by voyeuristic people in the NHS is disgraceful,” he said, according to the BBC.
Dr Kumar also said the victims’ families would like to meet with the health secretary and asked when the government would take steps to stop such breaches and “decrease the suffering of people who are victims of crime and of major incidents”.
What this means for Poles in the UK
Anyone registered with the NHS in England—including Polish residents and workers—has their medical information protected under strict data protection laws and NHS privacy standards. NHS staff are only permitted to access patient records when there is a legitimate clinical or administrative reason related to that person’s care.
If you suspect your NHS medical records have been accessed inappropriately, you can request an audit trail from your GP surgery or hospital trust showing who has viewed your file and when. You have the right to complain to the trust’s data protection officer and to report the matter to the Information Commissioner’s Office at ico.org.uk.
The NHS Constitution guarantees confidentiality, and breaches can result in dismissal for staff and potential criminal or regulatory action. All patients, regardless of nationality, are entitled to the same privacy protections. If you are concerned about your records, you can also contact the NHS England customer contact centre on 0300 311 22 33 for advice on how to proceed.
These recent cases highlight that the NHS takes unauthorised access seriously, with investigations involving independent regulators and police where appropriate. Patients should be aware of their rights and know that there are clear routes to challenge potential violations of medical privacy.
