Key facts
- Liverpool Heart and Chest Hospital contacted those affected by its investigation, the Information Commissioner's Office, and the Care Quality Commission.
- The two suspended staff were placed on precautionary suspension while the investigation is concluded.
- An investigation is also ongoing at North West Ambulance Service Trust into record access relating to the same attack, with eight staff members going through its disciplinary process.
- The May 2026 breach occurred at Aintree Hospital, where some victims received treatment, after the attack.
Liverpool Heart and Chest NHS Foundation Trust, based at Broadgreen Hospital in Liverpool, suspended two staff members after a retrospective audit detected two potential instances of staff accessing care records of victims of the July 2024 attack on a children’s dance class in Southport without legitimate reason. The trust’s probe makes it the second Liverpool hospital to investigate staff access to records of patients treated after the attack, following the earlier disclosure involving NHS University Hospitals of Liverpool Group.
The trust placed two members of staff on precautionary suspension while it concludes an investigation, characterizing the suspensions as precautionary pending the outcome of its probe. Liverpool Heart and Chest NHS Foundation Trust has not confirmed the roles of the suspended staff or the identities of the patients whose records were allegedly viewed.
“We are deeply sorry that this has happened,” said Manoj Kuduvalli, medical director, Liverpool Heart and Chest Hospital. Liverpool Heart and Chest Hospital contacted those affected by its investigation, the Information Commissioner’s Office, and the Care Quality Commission. The trust notified both the data regulator and the care quality regulator alongside the affected individuals.
A separate investigation is ongoing at North West Ambulance Service Trust into record access relating to the same attack, with eight staff members going through its disciplinary process. The scrutiny extends beyond hospital trusts to the regional ambulance service for the July 2024 event. It now covers more than one NHS organization for the same event.
NHS University Hospitals of Liverpool Group confirmed in May 2026 that nearly 50 staff members had accessed medical records of Southport victims inappropriately. The earlier disclosure established that inappropriate record access at a Liverpool trust predated the Liverpool Heart and Chest Hospital case. The May 2026 breach occurred at Aintree Hospital, where some victims received treatment after the attack, and it emerged in the days following the July 2024 attack on the dance class.
The May 2026 breach affected three patients, including a 13-year-old girl who helped with supervision of the dance class and an adult teacher.
NHS England chief executive Sir Jim Mackey said in September that employees suspected of viewing patient records without permission would face immediate suspension. The national NHS leadership issued a directive tying suspected inappropriate access to immediate suspension. “We will not accept behaviour that compromises patient confidentiality or undermines the trust our patients place in us,” Kuduvalli said.
Axel Rudakubana received a life sentence in January 2025 for murdering three young girls and trying to kill 10 other people, including eight children, at a dance class in Southport, and the sentencing followed the attack on a children’s dance class in Southport. He killed Bebe King, aged six, Elsie Dot Stancombe, aged seven, and Alice da Silva Aguiar, aged nine, when he targeted a Taylor Swift-themed dance class, and his life sentence carries a minimum term of 52 years. The three murdered girls were the youngest victims of the dance-class attack. He faces a trial over accusations that he assaulted prison officers while held at HMP Belmarsh.
Join the discussion