The short version
- Fifteen staff members have been dismissed by Nottingham University Hospitals for inappropriately accessing patient records related to the June 2023 attacks.
- The dismissals occur alongside a broader statutory inquiry that has identified failures across multiple agencies, including the Ministry of Justice and probation services.
- Hospital leadership is implementing new detection systems and educational campaigns to prevent future breaches of patient privacy.
Nottingham University Hospitals NHS Trust has dismissed four additional employees, bringing the total number of staff sacked for inappropriately accessing medical records to fifteen. The disciplinary actions concern the private files of Barnaby Webber, Grace O'Malley-Kumar, and Ian Coates, three individuals who were fatally stabbed on June 13, 2023. The trust confirmed these latest dismissals on Friday, expanding upon an earlier announcement in May that had cited eleven terminations. This development marks a significant escalation in the institution’s response to internal misconduct regarding the handling of sensitive patient data during a period of intense public scrutiny.
The victims were killed by Valdo Calocane, who was diagnosed with paranoid schizophrenia in 2020. Calocane pleaded guilty to manslaughter on grounds of diminished responsibility in January 2024 and is currently serving an indefinite hospital order in a high-security facility. The unauthorized access to their records represents a secondary violation of privacy for the families, who have already endured the trauma of losing loved ones. Dr. Manjeet Shehmar, the medical director at NUH, stated that there is no justification for accessing patient files without legitimate clinical reasons. He expressed regret that the families’ grief was compounded by the actions of these staff members, emphasizing that the trust will continue to investigate and act against such breaches.
Beyond the fifteen dismissals, the trust has issued fifteen final written warnings and two first written warnings to other employees involved in the investigation. Two cases were closed with no action taken after it was determined there was no case to answer. The disciplinary measures have affected a range of personnel, including doctors, nurses, registered healthcare professionals, and administrative staff. Independent regulatory bodies, such as the Nursing and Midwifery Council and the General Medical Council, have been notified of the actions. Additionally, the Information Commissioner’s Office and Nottinghamshire Police have been informed to ensure that all legal and professional standards are upheld in the aftermath of these violations.
The families of the deceased victims had previously welcomed the initial disciplinary steps taken by the trust but described the May announcement as a 'kick in the teeth.' The latest round of dismissals aims to address ongoing concerns about data protection within the hospital system. Dr. Shehmar noted that while the misconduct is disappointing, it represents a small fraction of the wider workforce. He highlighted efforts to educate staff on appropriate access protocols and the serious consequences of failing to follow rules. A campaign titled 'Your Responsibility, Your Actions, Their Privacy' has been launched to reinforce these standards across the organization.
To prevent future incidents, NUH is implementing a new system currently under testing that will alert administrators to potential data breaches. This technological upgrade is part of a broader strategy to safeguard patient information and ensure that only lawful and justified access occurs within the hospitals. The trust asserts that staff are listening and learning from these events, striving to maintain the integrity of medical records. The focus remains on creating a culture where privacy is respected and where any deviation from protocol is swiftly identified and addressed.
These internal disciplinary actions are unfolding against the backdrop of the Nottingham Inquiry, a statutory public inquiry led by retired senior judge Deborah Taylor KC. The inquiry has examined decisions made in the lead-up to the attacks and the subsequent responses by various authorities. Between February and June 2026, the inquiry heard from 164 witnesses over fourteen weeks, with closing statements delivered in September. The findings are scheduled to be published by May 2027. The hearings have laid bare failures and missed opportunities by agencies, including the NHS and police, revealing a complex web of interactions that failed to prevent the tragedy.
The inquiry has scrutinized Calocane’s history, noting that he had been sectioned four times under the Mental Health Act and had a record of police interactions linked to violent incidents before the killings. The investigation extends beyond the NHS, as other organizations have also faced allegations of inappropriate access to information related to the case. In December 2024, an investigation opened into claims that Ministry of Justice staff illegally accessed computer files concerning the attacks. Court workers were identified as having inappropriately accessed case information in January 2024, and seven probation service officers were also implicated.
Amy Holmes, interim director general for the chief operating group of the Ministry of Justice, testified before the inquiry that she could not detail the specific information accessed due to an ongoing police investigation. The breadth of these violations suggests systemic issues in how sensitive data is managed across different sectors involved in public safety and healthcare. As the Nottingham Inquiry continues its work, the focus remains on understanding how multiple agencies failed to act on warning signs. The upcoming report will likely provide critical insights into improving coordination and accountability in similar situations.
Investigations are also continuing into the inappropriate access of files belonging to the surviving victims of the attacks: Wayne Birkett, Sharon Miller, and Marcin Gawronski. This indicates that the scope of the privacy breaches extends beyond those who died, affecting all individuals involved in the incident. The trust maintains that it is doing everything possible to ensure that patient records are kept safe and that only authorized personnel can view them. As the legal and administrative processes unfold, the emphasis remains on restoring trust through transparency, accountability, and robust data protection measures.
The case highlights the delicate balance between maintaining patient confidentiality and ensuring public safety in cases involving mental health crises. The failures identified by the inquiry underscore the need for better communication and coordination between healthcare providers, law enforcement, and social services. While the dismissals serve as a punitive measure, they also signal a commitment to reforming internal practices. The coming months will see further developments as the inquiry prepares its final recommendations, which could influence policy changes across the UK’s health and justice systems.
Sources behind this briefing
Go to the original reporting
- BBC News↗More NHS staff sacked over attacks victims' records
