Nottingham University Hospitals NHS Trust has sacked 15 members of staff for inappropriately accessing medical records of three people killed in a stabbing attack on 13 June 2023. Barnaby Webber and Grace O'Malley-Kumar, both Nottingham students, and Ian Coates, a grandfather, were stabbed to death by Valdo Calocane, who has been diagnosed with paranoid schizophrenia.
The trust confirmed the dismissals on Friday. In May, it had disclosed 11 sackings as part of its investigation into unauthorized record access. The latest update brings the total to 15 dismissals. The trust has also issued 15 final written warnings and two first written warnings. Two cases were found to have no case to answer.
The staff members dismissed held various roles: doctors, nurses, registered healthcare professionals and other staff. Dr Manjeet Shehmar, medical director at NUH, stated: "There is simply no excuse for accessing the records of a patient without a legitimate reason and I hope this sends a really clear message. We will investigate and we will take action."
Dr Sanjoy Kumar, Grace's father, responded to the dismissals: "I am appalled, it's time to get a handle on these failures. Clearly, the way that the highest confidential data, which is medical data, is being looked at by voyeuristic people in the NHS is disgraceful."
The trust has notified independent regulators including the Nursing and Midwifery Council, the General Medical Council, the Information Commissioner's Office and Nottinghamshire Police. Investigations continue into inappropriate access to records of the three surviving victims: Wayne Birkett, Sharon Miller and Marcin Gawronski.
NUH is implementing a new system, currently under testing, to detect potential data breaches. The trust has also launched a "Your Responsibility, Your Actions, Their Privacy" campaign to educate staff on data protection rules and consequences.
Unauthorized record access has extended beyond the NHS. In December 2024, an investigation opened into allegations that Ministry of Justice staff illegally accessed computer files related to the attacks. Court workers also inappropriately accessed information in January 2024. Three probation service officers accessed files without legitimate reason, though the breaches were deemed insufficient to warrant further action. Nottinghamshire Police confirmed multiple staff viewed attack-related footage and images without legitimate policing purpose.
A judge-led public inquiry examining events leading up to the attacks and the aftermath is underway. The findings are expected by May 2027.