Fifteen NHS staff have been dismissed after inappropriately accessing the medical records of the victims of the 2023 Nottingham attacks, the hospital trust responsible has confirmed. The files belonged to two 19-year-old students, Barnaby Webber and Grace O'Malley-Kumar, and Ian Coates, a 65-year-old caretaker, all of whom were killed by Valdo Calocane in June 2023.
The trust has issued an apology for the data breach, acknowledging that there is «simply no excuse» for staff to have looked at the records without a legitimate reason. The dismissals follow an internal investigation into who had viewed the files and why, with the trust treating the unauthorised access as a serious matter of patient confidentiality.
Calocane killed the three victims and attempted to kill three other people during the attacks in Nottingham. The case prompted widespread scrutiny of how mental health services had handled Calocane before the killings, and the victims' families have since campaigned for changes to the way such cases are reviewed.
The disclosure that NHS employees had accessed the victims' records adds a further dimension to the case, raising questions about how sensitive medical information is protected within the health service. The trust has not named the individuals involved, but confirmed that disciplinary action has been taken against those found to have breached confidentiality rules.
Patient records are governed by strict confidentiality rules, and staff are permitted to access them only when it is necessary for providing care or carrying out authorised duties. Unauthorised access is treated as a disciplinary offence and can result in dismissal, as well as referral to professional regulators in some cases.
The trust's apology reflects the seriousness with which it views the breach, and it is expected to review its procedures to prevent similar incidents. The families of the victims have been informed of the outcome of the investigation.
The Nottingham attacks remain one of the most closely examined criminal cases in recent years, and the handling of Calocane's contact with mental health services has been the subject of independent review. The latest development concerns the conduct of NHS staff rather than the clinical care provided, but it underlines the sensitivity surrounding the victims' personal information.
The trust has not indicated whether any of those dismissed will face further action, and it has not commented on the specific circumstances of each case. It has, however, made clear that access to patient records is monitored and that breaches will be dealt with firmly.