Southport and Nottingham attack victims call out NHS snooping

Families affected by the tragic attacks in Southport and Nottingham have united to demand enhanced protections against unauthorized access to confidential NHS patient records. Through an open letter, over 30 signatories—including those impacted by prior maternity scandals—have condemned these breaches as a “flagrant abuse of power,” calling on government ministers and NHS authorities to implement stronger measures.

The letter draws attention to the distress caused when NHS staff improperly accessed sensitive information about victims shortly after these traumatic events. For instance, in Nottingham, three victims—19-year-olds Grace O’Malley-Kumar and Barnaby Webber, along with 65-year-old Ian Coates—were stabbed to death in 2023 by Valdo Calocane. According to the letter, staff began probing their medical details while families were still grappling with their loss and while some victims remained hospitalized. Nottingham University Hospitals NHS Trust has since dismissed 15 employees involved in these inappropriate record searches.

Similarly, breaches occurred following the Southport attack on 29 July 2024, when Axel Rudakubana killed three children—Bebe King (six), Elsie Dot Stancombe (seven), and Alice Da Silva Aguiar (nine)—during a Taylor Swift-themed dance class. The letter highlights the deeply troubling nature of strangers with no direct role in victims’ care accessing intimate and private data. Investigations are ongoing at Liverpool Heart and Chest NHS Foundation Trust, with nearly 50 staff members from the University Hospitals of Liverpool Group admitting to unauthorized access. Additionally, the North West Ambulance Service Trust is examining breaches involving the same victims. The letter also references past incidents where NHS staff viewed records of other tragic cases, such as a drowning child in Suffolk, a fatal tiger enclosure accident in Yorkshire, and a child involved in a crocodile pit incident in Cambridge.

The problem extends beyond the NHS, as the Ministry of Justice and HM Courts and Tribunals Service have apologized for similar unauthorized access to Southport victims’ personal information. In response, NHS officials announced a crackdown on such breaches in September, pledging immediate suspension and removal of system access for suspected offenders. However, the family representatives argue that these steps are insufficient. They propose implementing a mandatory confirmation box for accessing records to ensure legitimate reasons, conducting regular audits, and improving recognition and support for affected patients under the Information Commissioner’s remit. Their statement reads: “These breaches are deeply distressing and entirely preventable… We believe these three measures would make significant progress in tackling the problem and preventing further harm.”

Nicola Ryan-Donnelly, a partner at Fletchers Solicitors who authored the letter, emphasized the ongoing frustration: “Every week in the media we are learning of a new breach into patient’s medical records by staff who have no legitimate cause to access them.” She added that many parents of Southport child survivors feel voiceless, as the repeated privacy violations have invaded the most vulnerable moments of their families. Ryan-Donnelly stressed that stronger sanctions are a start but called for a cultural shift within the NHS to empower victims and uphold patients’ dignity and trust.

Health Secretary Yvette Cooper described the situation as a “disgrace” and underscored that NHS data and privacy standards are well established and upheld by the vast majority of staff. Speaking to the BBC, she said: “It is a disgrace that we’ve had cases where people don’t, and we do expect action to be taken, including people being sacked.” Cooper also expressed her expectation that suspected offenders be promptly suspended during investigations, reinforcing that respect for patients is fundamental to the NHS