Southport and Nottingham Attack Families Demand End to NHS Data Breaches

Families devastated by the Southport and Nottingham attacks have issued a powerful call for stronger safeguards against NHS staff improperly accessing confidential patient records. In an open letter, they condemned the breaches as a "flagrant abuse of power" and urged ministers and NHS leaders to take decisive action.

The letter, signed by more than 30 people including survivors and bereaved relatives, also highlights similar concerns from maternity scandals. It comes after a series of revelations that NHS workers snooped on the medical files of victims, often while families were still grappling with the immediate aftermath of the tragedies.

A Pattern of Betrayal

The Nottingham attacks in 2023 saw Grace O'Malley-Kumar and Barnaby Webber, both 19, and 65-year-old Ian Coates stabbed to death by Valdo Calocane. In the wake of that horror, the letter states, "staff began prying, while parents were still coming to terms with the deaths of their children. Other victims were still in hospital fighting for their lives when their records were breached."

Last month, Nottingham University Hospitals NHS Trust confirmed that 15 employees had been dismissed following an investigation into inappropriate access to the medical records of the attack victims.

Similarly, after the Southport knife attacks on 29 July 2024, where Axel Rudakubana killed six-year-old Bebe King, seven-year-old Elsie Dot Stancombe, and nine-year-old Alice Da Silva Aguiar during a Taylor Swift-themed dance class, NHS staff were found to have accessed victims' records without authorization. Liverpool Heart and Chest NHS Foundation Trust is investigating allegations, and the University Hospitals of Liverpool Group admitted that nearly 50 staff had wrongly looked at victims' files. A separate probe is underway at North West Ambulance Service Trust.

The letter also cites other cases, including the breaches involving three-year-old Noah Woods, who drowned near a Suffolk pond; William Chapman, who died after entering a tiger enclosure in Yorkshire; and a two-year-old boy thrown into a crocodile pit at a zoo in Cambridge.

Beyond the NHS

The authors stress that the problem is "not exclusive to the NHS," noting that the Ministry of Justice and HM Courts and Tribunals Service have both apologized for inappropriate access to sensitive personal information belonging to Southport victims.

In September, NHS officials announced a crackdown, stating that staff suspected of snooping would be suspended immediately and have their access to health service computer systems cut off. However, the letter argues these measures do not go far enough.

Demands for Change

The families are calling for three key actions: a "tick box" system requiring staff to confirm they have a legitimate reason to access records; regular audits on snooping; and for patients to be "properly recognised" by the Information Commissioner.

"These breaches are deeply distressing and entirely preventable," the authors wrote. "We believe these three measures would make significant progress in tackling the problem and preventing further harm."

Nicola Ryan-Donnelly, a partner at Fletchers Solicitors, which penned the letter, said: "We have written and published this open letter because victims of NHS snooping have had enough. Every week in the media we are learning of a new breach into patient's medical records by staff who have no legitimate cause to access them."

She added: "Among the child Southport survivors I represent, many of their parents do not feel they have a voice to speak out about how this has affected them. They had hoped that their anonymity would protect their children's most vulnerable and difficult moments, but the truth is staff have repeatedly abused their position to pry into their most private and sensitive information."

Ryan-Donnelly continued: "Anybody, no matter who they are or what they have been through, should feel confident that staff will protect their privacy and dignity while they are being treated or cared for by the NHS and other agencies. Stronger sanctions and dismissals for NHS staff who snoop is a step in the right direction, but it does not do enough to address the problem. We have to instil a new culture in our health system and give victims a powerful voice to challenge breaches."

The BBC has contacted NHS England, the Department for Health and Social Care, and the Department for Culture for comment.