Nottingham hospitals trust to roll out access-monitoring system after record-snooping dismissals reach 15

Nottingham University Hospitals NHS Trust (NUH) has dismissed a further four members of staff for inappropriately accessing the medical records of Ian Coates, Grace O'Malley-Kumar and Barnaby Webber, taking the total number of dismissals arising from its investigation to 15.

The trust said 15 final written warnings and two first written warnings have also been issued, while two cases were found to have no case to answer. Staff investigated include doctors, nurses, registered healthcare professionals and other staff. The families of the three victims were contacted this week to be updated on the latest outcomes.

Mr Coates, Ms O'Malley-Kumar and Mr Webber were killed in the Nottingham attacks in June 2023. The trust announced in May this year that 11 staff had been dismissed, with 12 final written warnings and two first written warnings issued, meaning three further final written warnings have been handed down alongside the four additional dismissals since then.

Dr Manjeet Shehmar, Medical Director at NUH, said there was no excuse for accessing a patient's records without a legitimate reason and that the outcomes should send a clear message that the trust would investigate and take action. "To lose a loved one in the way that the families of Ian, Grace and Barnaby have is heartbreaking enough. I am so sorry that they have had this further compounded by the actions of these staff members," she said.

Shehmar said the trust would continue to investigate inappropriate access and take action where necessary, while educating staff on appropriate access and introducing a new system to detect possible data breaches. "While the actions of these staff members are disappointing, we know that this represents a small number of our wider workforce," she added.

The trust began its inquiries in 2025 to identify where access to the records was illegitimate and inappropriate, and said regulatory standards had been applied throughout to ensure a consistent and fair approach. Investigations are continuing and now also cover inappropriate access to the records of surviving victims of the attacks, including Wayne Birkett, Sharon Miller and Marcin Gawronski.

NUH has informed the Information Commissioner's Office and Nottinghamshire Police, and is discussing the outcomes with professional regulators including the Nursing and Midwifery Council and the General Medical Council.

Accessing personal data held by an employer without a legitimate purpose engages the integrity and confidentiality principle in Article 5(1)(f) of the UK GDPR, and can amount to a criminal offence by the individual under section 170 of the Data Protection Act 2018, which covers knowingly or recklessly obtaining personal data without the consent of the controller. The ICO has previously prosecuted NHS employees under section 170 and its predecessor, section 55 of the Data Protection Act 1998, for viewing patient records without a business need.

The trust has been running a 'Your Responsibility, Your Actions, Their Privacy' campaign to set out staff roles and responsibilities on data protection and the consequences of breaches. It is also introducing a monitoring system to continually track access to patient records, identify suspicious behaviour and generate alerts, audits and reports. Testing is under way, to be followed by a pilot, with the system expected to go live early next year.