The UK health secretary called the breaches a disgrace, and a second NHS trust is investigating access to another patient's records.

 

What happened

Nottingham University Hospitals NHS Trust has dismissed 15 staff members for accessing the medical records of the victims of the 2023 Nottingham attacks without a legitimate reason, the BBC reported in October 2026. Three people were killed in the attacks in June 2023. The trust first dismissed 11 staff in May, then announced further dismissals, saying the action covered doctors, nurses, registered healthcare professionals, and other staff. Separately, Yorkshire Ambulance Service said staff may have accessed the records of a 24-year-old man who died at a wildlife park in October, and has opened an investigation. UK Health Secretary Yvette Cooper called the cases "a disgrace." Unauthorized access by staff is a data security failure that no firewall or email filter would catch, because the people involved hold legitimate logins.

 

Going deeper

The Nottingham trust said it had informed the Information Commissioner's Office, the UK's data protection regulator, along with the Nursing and Midwifery Council, the General Medical Council, and Nottinghamshire Police. Police said earlier there was no criminal investigation. The trust also said it is testing a new system to protect patient records and alert it to possible breaches. Dr. Manjeet Shehmar, the trust's medical director, said there was "simply no excuse for accessing the records of a patient without a legitimate reason." The ambulance service said the family of the man whose records may have been viewed had been told about the possible breach.

 

What was said

"There are proper data and privacy standards across the NHS," Cooper told the BBC, adding that she expected staff who breach them to face action, including dismissal, and to be suspended quickly while investigations take place. She said she had spoken to the chief executive of NHS England about the cases. Dr. Sanjoy Kumar, the father of one of the Nottingham victims, said the families would like to meet her. "It's time to get a handle on these failures," he said.

 

In the know

Staff viewing records without a work reason is enforced as a HIPAA matter in the United States. OCR settled with Yakima Valley Memorial Hospital in Washington state after 23 security guards in its emergency department used their own logins to view the records of 419 patients without a job-related purpose, according to HHS. The information they viewed included names, dates of birth, addresses, treatment notes, medical record numbers, and insurance details. The hospital agreed to pay $240,000 and update its policies and train staff to prevent the same behaviour. It was a small breach by number of patients, and still led to a federal penalty and two years of monitoring.

 

The big picture

The Nottingham trust's response, a system to detect and alert on inappropriate access, matches what US rules already expect hospitals to have in place. Under HIPAA, covered entities must restrict staff access to patient information based on each person's role, identifying who needs access, to what categories of information, and under what conditions, according to HHS's summary of the Privacy Rule. They must also train every workforce member on their privacy policies and apply sanctions to anyone who breaks them. High-profile patients are where those controls get tested, since public interest in a case creates the temptation. Hospitals can flag the records of patients in the news for closer monitoring, so that any access without a care relationship is reviewed quickly.

 

FAQs

Why can staff open records they have no reason to see?

Electronic health records often give clinicians broad access, so care isn't delayed in an emergency. The control then relies on monitoring who opens which records and following up on access that doesn't match a care relationship.

 

Is viewing a record without sharing it still a breach?

Under HIPAA, unauthorized access to protected health information is an impermissible use even if nothing is copied or shared. The Yakima case involved viewing alone.

 

What does role-based access mean?

Each job role is given access only to the information it needs. A security guard, for example, would not normally need to see treatment notes.

 

Who regulates this in the UK?

The Information Commissioner's Office enforces data protection law. Professional regulators such as the General Medical Council and Nursing and Midwifery Council deal separately with individual clinicians.

 

How do hospitals spot inappropriate access?

By reviewing access logs, often with software that flags patterns such as staff viewing records of coworkers, family members, or patients in the news. The flagged events are then investigated by a privacy team.