15 NHS Staff Now Sacked for Accessing Nottingham Attack Victims’ Medical Records
Nottingham Hospital Confirms Further Sackings in Patient Privacy Investigation
Private Records, Public Tragedy
The total has risen from 11 dismissals in May, while inquiries into access to survivors’ records remain open.
Fifteen NHS staff have now been dismissed following investigations into inappropriate access to the medical records of Nottingham attack victims Ian Coates, Grace O’Malley-Kumar and Barnaby Webber.
Nottingham University Hospitals NHS Trust confirmed the cumulative total on Friday 16 October. It is an increase from the 11 dismissals announced in May, rather than 15 new sackings this week.
The update concerns what happened to private information after a public tragedy. On 13 June 2023, Valdo Calocane killed the two Nottingham students and school caretaker. Their families have since faced questions about the institutions involved before the attacks and the treatment of sensitive material afterwards.
What the Disciplinary Outcomes Show
Alongside the dismissals, the trust has issued 15 final written warnings and two first written warnings. Two cases resulted in no case to answer, with no action taken.
The investigation has included doctors, nurses, other registered healthcare professionals and additional staff. The published breakdown does not identify the people dismissed or assign each outcome to a particular profession.
The figures describe different decisions. They should not be read as evidence that every employee investigated committed the same breach or that everyone who opened a record did so improperly.
The trust contacted the bereaved families this week with the latest outcomes. Its medical director, Dr Manjeet Shehmar, apologised for the additional distress caused by staff conduct and said access without a legitimate reason was inexcusable.
How the Investigation Has Developed
The hospital began its inquiries in early 2025. On 21 May 2026, it announced 11 dismissals, 12 final written warnings and two first written warnings.
That earlier statement explained the standard staff were expected to meet: access had to be lawful, justified and directly connected to their role. Employment in a hospital did not provide unrestricted permission to look at the information held there.
May’s announcement also confirmed that inquiries extended to records belonging to surviving victims Wayne Birkett, Sharon Miller and Marcin Gawronski. Those investigations remain ongoing.
The disciplinary process sits alongside the broader examination of the health and police timelines surrounding the Nottingham attacks. Decisions about access to records address a specific responsibility after the violence. They do not, by themselves, settle questions about prevention or emergency care.
Why a Hospital Login Is Not Enough
Medical services need information to move quickly. A patient may arrive in an emergency or be transferred between teams, making prompt access to records essential for treatment.
The Information Commissioner’s Office has explained that this creates an important distinction: being able to open a record does not establish a legitimate need to read it.
In a June statement, the watchdog’s chief executive, Paul Arnold, described inappropriate access as rare across the healthcare workforce, while warning that high-profile tragedies could increase the temptation to look. He called for timely reminders from senior leaders, training suited to staff roles and technical controls that reinforce access boundaries.
The practical challenge is to preserve the access clinicians need while identifying uses that cannot be justified. A system that allows a member of staff to retrieve information must also support scrutiny of why that retrieval happened.
What the Regulator Notifications Mean
The trust has informed Nottinghamshire Police and the Information Commissioner’s Office. It is also discussing outcomes with professional regulators, including the General Medical Council and Nursing and Midwifery Council.
Notification is not a finding of criminal guilt. A dismissal, a professional fitness-to-practise decision and a criminal prosecution are separate processes. The latest hospital announcement does not establish that any particular dismissed employee has been charged or convicted.
That distinction matters when discussing consequences. The information watchdog has warned that unauthorised access can lead to disciplinary action, professional sanctions and, in some circumstances, prosecution. Which route applies depends on the facts and the relevant decision-maker.
The Next Safeguard Is Still Being Tested
The hospital is testing a monitoring system intended to flag suspicious access and produce alerts, audits and reports. A pilot is due to follow, with the trust aiming to bring it into operation early in 2027.
Staff education is also continuing through its privacy campaign. Training explains the boundary; monitoring helps the organisation examine whether it is being respected.
The next practical test is whether the planned system moves from testing into routine use, and whether alerts lead to prompt investigation. For the victims and their families, the remaining inquiries still have to establish whose records were accessed improperly and what action each case requires.
Sources
Nottingham University Hospitals — NUH Dismisses Further Staff in Inappropriate Access Investigations — Official update of 16 October 2026 confirming outcomes, notifications, continuing inquiries and planned monitoring.
Nottingham University Hospitals — Nottingham Hospitals Confirms First Outcomes of Inappropriate Access Investigations — Official statement of 21 May 2026 establishing the earlier disciplinary totals and investigation chronology.
Information Commissioner’s Office — Curiosity Is Not an Excuse: Protecting Patient Data in Healthcare — Explains legitimate access, privacy risks and preventive measures, 22 June 2026.
Next Reads
True Crime: The Nottingham Attacks – Connecting The Health And Police Timelines — The wider institutional history and the questions examined by the public inquiry.
8.8 Million Danish Identity Records Exposed After Attackers Abuse Trusted Company Access — A separate case examining the risks around trusted access to sensitive information.
