Nottingham University Hospitals NHS Trust has dismissed 15 staff members after they accessed the medical records of Barnaby Webber, Grace O’Malley-Kumar and Ian Coates, who were killed in the June 2023 Nottingham attacks. Webber and O’Malley-Kumar were 19-year-old students, while Coates was a 65-year-old caretaker. Three other people were also targeted and survived.
The trust has issued 15 final written warnings and two first written warnings during its investigation. Doctors, nurses, registered healthcare professionals and other staff were among those examined, while two cases were closed with no action after investigators found no case to answer. The families were informed of the latest outcomes this week.
Medical director Dr Manjeet Shehmar apologised to the families and said staff had no legitimate reason to access the records. The trust is running an education campaign on data protection and patient privacy, while testing a system that can monitor access, identify suspicious activity and generate alerts, audits and reports. A pilot is planned before the system is introduced more widely early next year.
The dismissals come amid a wider NHS crackdown on unauthorised record access. New national guidance says staff must not view patient information out of curiosity or for personal reasons, and organisations should consider suspensions, restricted system access, regulatory referrals, police reports or other action when unlawful access is identified. NHS England has also warned that such conduct can lead to dismissal, professional sanctions or criminal prosecution.
Valdo Calocane was given an indefinite hospital order in January 2024 after admitting manslaughter by diminished responsibility and attempted murder. The NHS has separately faced investigations into staff accessing records connected with other high-profile incidents, including the 2024 Southport attack and the hospitalisation of a three-year-old boy injured in a crocodile-pit fall in Cambridgeshire.