On June 13, 2023, the city of Nottingham was shattered by a brutal attack that claimed the lives of three people and left a community reeling. Barnaby Webber and Grace O’Malley-Kumar, both just 19 years old and with their whole lives ahead of them, were killed alongside 65-year-old Ian Coates, a caretaker described as a kind and devoted family man. The man responsible, Valdo Calocane, had been diagnosed with paranoid schizophrenia in 2020 and had a long history of refusing to take his medication. He had been sectioned four times and had shown violent tendencies long before that terrible day. He also tried to kill three other people before he was finally stopped. In the aftermath, it became painfully clear that there had been serious failings by the authorities who had encountered Calocane over the years. He eventually pleaded guilty to manslaughter on the grounds of diminished responsibility and was handed an indefinite hospital order. For the families of Ian, Grace and Barnaby, the grief has been unimaginable. But just when they thought they had endured the worst, another wound was opened: it emerged that NHS staff had been inappropriately accessing the medical records of their murdered loved ones. Now, a total of 15 NHS workers have been sacked for doing so, and the news has left the families feeling betrayed all over again.
Nottingham University Hospitals NHS Trust launched an investigation after discovering that staff had accessed the records of Webber, O’Malley-Kumar and Coates without any legitimate reason. In May, the trust confirmed that 11 members of staff had been dismissed. Then, as of Friday, four more employees were fired, bringing the total to 15. The investigation did not stop there. Alongside the dismissals, 15 final written warnings and two first written warnings were issued to other staff members involved. In two further cases, no action was taken. The trust confirmed that the disciplinary action was taken against doctors, nurses, registered healthcare professionals and other staff across the organisation. Dr Manjeet Shehmar, the medical director at NUH, made no attempt to soften the message. She said there is simply no excuse for accessing the records of a patient without a legitimate reason, and she hoped the dismissals would send a very clear message that such behaviour would always be investigated and acted upon. She also expressed deep sorrow that the families of Ian, Grace and Barnaby had to suffer this additional pain on top of their devastating loss. Her words were heartfelt, but for the families, the damage had already been done.
To understand why this feels so cruel, it is important to remember the full context of the Nottingham attacks. Valdo Calocane was not a stranger to the mental health system. He had been diagnosed with paranoid schizophrenia in 2020, and there were multiple opportunities for intervention. He had been sectioned four times, yet he continued to fall through the cracks. He had a history of violence and a pattern of not taking his medication, and there were clear warning signs that should have prompted stronger action. The families of the victims have had to live with the knowledge that their loved ones might still be alive if those in authority had done their jobs properly. An independent review later highlighted serious failings by the agencies that were supposed to monitor and treat Calocane. He admitted manslaughter on the grounds of diminished responsibility, meaning he accepted that he had killed but argued that his mental illness reduced his culpability. He is now detained in a secure hospital, but that does little to ease the pain of those left behind. And now, the families have had to learn that NHS staff, people working in an institution meant to care for and protect patients, were secretly looking at the medical files of their murdered relatives. It is hard to imagine a more invasive violation of privacy. These were not just files; they were the personal, intimate records of people who had been violently taken from their families. For the families, it must feel like their grief has been turned into gossip.
Earlier this year, the victims’ families described the actions of the staff as “a kick in the teeth.” That phrase captures the sense of being knocked down again just as they were trying to stand up. They had already endured the shock of the attack, the pain of the funerals, the agony of the court case, and the frustration of learning about the systemic failures that allowed Calocane to slip through the net. Then came the discovery that hospital workers had been accessing the medical records of Ian, Grace and Barnaby without any legitimate reason. It is a betrayal of trust that cuts deep. Dr Shehmar acknowledged this, saying she was sorry that the families’ pain had been compounded by the actions of these staff members. The trust also informed Nottinghamshire Police, the Nursing and Midwifery Council, the General Medical Council and the Information Commissioner’s Office, meaning the consequences for those involved could extend far beyond losing their jobs. In addition, a separate investigation is still ongoing into inappropriate access to the records of the attack’s surviving victims: Wayne Birkett, Sharon Miller and Marcin Gawronski. These are people who lived through a nightmare, who were seriously injured and traumatised, and who now have to worry that their private medical information may have been viewed by strangers. The fact that this investigation is still continuing shows that the problem is not limited to a few bad apples; it is a wider issue that requires serious attention.
Sadly, this is not an isolated case. Across the NHS, there have been several other incidents of workers wrongfully accessing, or attempting to access, the medical records of victims from high-profile tragedies. In September, ten people were removed from duty after they tried to access the records of three-year-old Noah Woods, whose body was found in a pond after he went missing from a park. That case, like the Nottingham one, involved a child whose death had already brought immense sorrow to his family and the wider community. Then, this week, an investigation was launched after two staff members sought to access the records of William Chapman, a man who died following a tiger attack at Yorkshire Wildlife Park. These cases share a disturbing pattern: NHS employees, driven by curiosity rather than compassion, deciding that the medical records of victims are theirs to browse. It is a breach of the most fundamental ethical duty in healthcare. Patients share their most personal information with doctors and nurses in the expectation that it will remain confidential. When that trust is broken, it not only harms the individuals involved but also undermines confidence in the entire NHS. To address this, a campaign called “Your Responsibility, Your Actions, Their Privacy” was launched earlier this year. The aim is to reinforce data protection rules, educate staff about the laws surrounding patient confidentiality, and remind them of the severe consequences of acting on curiosity. Automated monitoring systems have also been introduced, designed to flag unauthorised record access in real time, so that breaches can be caught quickly and dealt with firmly.
The question now is what happens next. Dr Shehmar has said that the trust is doing all it can to educate staff on appropriate access and how to keep patient records safe. She also revealed that a new system is being introduced to detect possible data breaches. She acknowledged that the actions of these staff members are disappointing, but she was careful to point out that they represent a small number of the wider workforce. She said that staff across the trust are listening, learning and doing what they can to ensure that only lawful and justified access takes place in the hospitals. That may be true, but for the families of Ian Coates, Grace O’Malley-Kumar and Barnaby Webber, no apology can fully undo the hurt. They have been let down too many times. First by the authorities who failed to stop Calocane, and then by healthcare workers who treated their loved ones’ medical records as something to be snooped on. The NHS is built on trust. Patients need to know that when they walk into a hospital, their secrets are safe. When that trust is broken, it affects everyone. Behind every medical record is a person, a family, a story. The hope is that these dismissals, warnings and new safeguards will send a clear message: privacy is not optional, and those who violate it will face serious consequences. The victims and their families deserve nothing less. They have suffered enough, and the least the system can do is protect their dignity from this point forward.
