Families of attack victims condemn NHS staff snooping into medical records

More than 30 people, including survivors and families of the Southport and Nottingham attacks and people affected by maternity scandals, signed an open letter calling improper NHS staff access to confidential patient records a flagrant abuse of power. It calls on ministers and NHS leaders to improve protections against staff accessing patient records improperly.

In Nottingham in 2023, Valdo Calocane stabbed to death Grace O’Malley-Kumar and Barnaby Webber, both 19, and Ian Coates, 65, in the street. In Southport in 2024, Axel Rudakubana killed Bebe King, aged six, Elsie Dot Stancombe, aged seven, and Alice Da Silva Aguiar, aged nine, at a dance class themed around Taylor Swift.

University Hospitals of Liverpool Group said in May that nearly 50 workers had viewed victims’ medical files without authorization. Liverpool Heart and Chest NHS Foundation Trust is investigating claims that staff viewed the records of people stabbed in the Southport attack without permission, and North West Ambulance Service Trust is separately investigating staff who looked up Southport victims’ records without authorization.

NHS staff breached Noah Woods’s records after the three-year-old drowned near a Suffolk pond. They breached William Chapman’s records after he went into a tiger enclosure in Yorkshire, and the records of a two-year-old boy thrown into a crocodile pit at the zoo in Cambridge.

The family of an injured Southport child said two breaches of their daughter’s records, one involving North West Ambulance Service Trust and one involving the Ministry of Justice, have left them devastated. They want those responsible sacked and a full account of what happened to information they say someone stole.

The parents said their worst fear is that accessed information could be used for profit, and that apologies and offers to sit down with ministers and chief executives that come to nothing wear them out. Two years on, they said, the priority should be their daughter’s recovery rather than fresh state failures that put her at risk; snooping across agencies must stop, with individuals held to account rather than shielded by the confidentiality laws they flouted.

Nicola Ryan-Donnelly of Fletchers Solicitors represents 22 of the 23 children who survived the Southport attack. She said many parents of child survivors feel unable to speak out about the snooping’s impact, and that parents had hoped anonymity would shield their children’s vulnerable moments while staff misused their position to pry into private information. The letter’s authors said staff began accessing records while parents in Nottingham were still coming to terms with the deaths of their children and while other victims remained critically ill in hospital.

Nicola Ryan-Donnelly said a new breach of patient records by staff without a legitimate cause is reported in the media every week, and that those affected by NHS snooping have had enough. She said: “Week after week we are learning of a new data breach against victims who have endured the worst atrocities this country has ever seen.”

Health Secretary Yvette Cooper called NHS data breaches a disgrace and said she expects action, including sackings, where breaches occur. Cooper said every NHS staff member knows the proper data and privacy standards and must follow them, and that the overwhelming majority value those standards. She said anyone suspected of a breach should be suspended quickly during an investigation, and called respect for patients a core NHS value.

In September, NHS officials announced a crackdown under which they would suspend anyone suspected of snooping immediately and remove their access to health service computer systems. The letter’s authors said the September crackdown does not go far enough to stop future staff snooping.

The signatories want a tick box that staff must complete to confirm they have a legitimate reason before looking at patient records, and they want checks on snooping with patients properly recognised by the Information Commissioner. Nicola Ryan-Donnelly said tougher penalties and firmer dismissals for staff who snoop are a step forward but not enough to solve the problem. She called for an independent government inquiry into a culture she describes as grim and voyeuristic, and said public bodies aware of breaches for months disclose them only once media pressure mounts.

Court staff viewed files without authorization, and the breach came to light after an examination of digital systems. The Ministry of Justice and HM Courts and Tribunals Service have apologized for inappropriately accessing Southport victims’ sensitive personal information. Their spokesperson said anyone who committed wrongdoing would face firm action and called unauthorized access to court files unacceptable. The Prisons and Probation Service and the Courts and Tribunals Service are investigating, and people affected are receiving direct notification.