Nottingham University Hospitals says there is “simply no excuse” for the breaches, and that the families of Ian Coates, Barnaby Webber and Grace O’Malley-Kumar have been told about the latest dismissals.
Nottingham University Hospitals NHS Trust (NUH) has dismissed 15 members of staff so far for inappropriately accessing the medical records of the victims of the 2023 Nottingham attacks. The trust said on Saturday that it had also issued 15 final written warnings and two first written warnings. Doctors, nurses, registered healthcare professionals and other staff were covered by the investigation. Ian Coates, Barnaby Webber and Grace O’Malley-Kumar were stabbed to death by Valdo Calocane in 2023. The trust said their families were told about the latest update this week.
The trust’s response
Dr Manjeet Shehmar, NUH’s medical director, said: “There is simply no excuse for accessing the records of a patient without a legitimate reason and I hope this sends a really clear message – we will investigate and we will take action.”
Statements in the source that follow, which appear to be from the trust, say: “To lose a loved one in the way that the families of Ian, Grace and Barnaby have is heartbreaking enough. I am so sorry that they have had this further compounded by the actions of these staff members.” They continue: “We will continue to investigate inappropriate access to these records and take action as and where necessary.” The trust added: “Alongside this, we are doing all we can to educate our staff on appropriate access and how to keep the records of our patients safe. We are also introducing a new system which acts to detect possible data breaches.”
How the figures have grown
The trust’s earlier results, published on 21 May 2026, recorded 11 dismissals, so four more staff have since been sacked. The trust began its formal inquiries in early 2025, almost two years after the attacks. The investigation remains open, so further outcomes are possible.
According to a breakdown in the research notes, 34 disciplinary cases have reached an outcome:
| Outcome | Number |
|---|---|
| Dismissal | 15 |
| Final written warning | 15 |
| First written warning | 2 |
| No case to answer | 2 |
That means 32 of the 34 concluded cases ended in disciplinary action. It should not be read as the share of everyone investigated, as inquiries are still under way. The trust has not given a breakdown of sanctions by profession.
Survivors’ records also examined
The investigation extends beyond the three people who died. The trust has confirmed it is also looking at possible unauthorised access to the records of Wayne Birkett, Sharon Miller and Marcin Gawronski, who survived the attacks on 13 June 2023. It has not said how many staff may have accessed their records inappropriately.
Police and regulators informed
The trust has told Nottinghamshire Police, which can consider whether any offences were committed. It has also notified the Information Commissioner’s Office, the Nursing and Midwifery Council and the General Medical Council, and is discussing its disciplinary findings with the professional regulators. A referral does not mean that charges have been brought or that anyone has been struck off. No criminal prosecution arising from these dismissals has been confirmed.
When the first dismissals were announced in May, Barnaby Webber’s mother, Emma Webber, publicly criticised the breaches. The families also questioned the trust’s suggestion that as many as 48 employees had legitimately accessed records linked to the victims. Being able to open a patient’s file does not in itself show a legitimate reason to do so. The latest announcement does not settle that disagreement.
Prevention measures
The trust is testing monitoring technology that would continually track staff access to records and automatically flag suspicious activity for investigation. It would also produce audit trails and reports. A pilot is planned ahead of an expected introduction in early 2027. The trust has also begun a staff campaign called “Your Responsibility, Your Actions, Their Privacy”, which reminds employees that confidentiality applies to every patient, including those whose cases attract national attention.
A national crackdown
NHS England issued guidance on 8 July 2026 explaining when accessing records is unlawful. It said staff may not look at records just because a patient is famous, involved in a high-profile crime or known to them. Sir Jim Mackey, the head of NHS England, then announced in September that staff suspected of inappropriately accessing patient records would be suspended immediately and have their access to NHS computer systems cut off. The new approach was set out from 25 September, according to the research notes.
He said there had been “too many cases” of workers “abusing” trust. He warned that “snooping” could cost staff their careers and leave them with a criminal record. He wrote to all NHS trusts demanding that they apply the approach. Under it, trusts are expected to consider whether conduct amounts to gross misconduct and to refer suitable cases to police or regulators. Suspension does not remove an employee’s right to a fair investigation.
The source says the Nottingham case follows other high-profile incidents. In May, it emerged that dozens of staff at University Hospitals of Liverpool Group had looked at the records of victims of the 2024 Southport attack, which left three girls dead and 10 others injured. About 40 hospital staff also viewed the records of a three-year-old boy hurt after falling into a crocodile pit in Cambridgeshire in June.
Separately, NUH disclosed in September that a technical error on 18 August 2026 had overwritten a maternity records database. It said it recovered what was needed for current care, but could not fully restore historical records showing who accessed some maternity files between September 2011 and November 2022. The Information Commissioner’s Office was notified. There is no evidence linking this to the breaches involving the attack victims.
