NHS trust sacks 11 staff for inappropriately accessing records of Nottingham stab victims – as it’s claimed up to 150 may have seen files

An NHS trust has sacked 11 staff for improperly accessing medical records of stabbing victims in Nottingham.

Students Barnaby Webber and Grace O’Malley-Kumar and grandfather Ian Coates were stabbed to death by paranoid schizophrenic patient Valdo Calocane on June 13, 2023, while three others survived their injuries.

In 2025, it was revealed that Nottingham University Hospitals (NUH) NHS Trust employees accessed their records ‘without a legitimate reason’.

On Thursday, NUH announced the dismissal of 11 staff following investigations that began shortly after the breach was discovered.

A further 12 employees were given a final written warning, while two employees were given a first written warning for their participation.

Emma Webber, who killed her 19-year-old son Barnaby in the Nottingham attacks, described the incident as ‘shocking’ and claimed the numbers were much higher and that 150 employees had accessed the records.

The revelation comes as the public inquiry into the attack and its aftermath continues, and just days after a similar breach was reported involving the Southport attack victims.

NUH said further investigations were ongoing into access to files on the three survivors.

During the shocking attack, Wayne Birkett, Sharon Miller and Marcin Gawronski were injured by Calocane.

Marcin Gawronski was one of three surviving victims whose files were also accessed

Those involved in the investigation worked in departments across the trust, including doctors, nurses, medical professionals, administrators and bureaucrats.

Ms Webber said: ‘It is shocking to learn that 11 staff have been made redundant and 14 face disciplinary action.

‘Even more shocking is the extent of the abuses; 150 staff accessed the records.

‘The process is not yet complete, so we expect these numbers to increase significantly.

‘The trust is also aware that we do not accept its findings that 48 employees had legal access. The number is very high.

‘The reasons put forward for legitimacy do not add up and we are formally challenging this in order to properly examine it.

‘It is heartbreaking that in addition to our tragic loss, we have to face such appalling additional failures by staff who should have known better.

‘I would ask them all to think about how they would feel if it were their own child or father.’

NUH medical director Dr. Manjeet Shehmar said: ‘The families of Ian, Grace and Barnaby have had to endure so much pain and heartache and I am truly sorry that the actions of some of our staff have added to this.

‘It is completely unacceptable for our patients’ medical records to be accessed without a legitimate reason, and we are doing our best to identify where and how this is happening.

‘I hope our families, staff and communities are reassured by the results so far that we are taking this seriously and will continue to do so.

‘We know that the vast majority of our staff understand that appropriate access is a fundamental principle of our duty of care and that it is important that access to patient records is lawful, justified and directly related to their role.

‘By accessing records inappropriately, staff undermine the valuable contribution made by colleagues who care for these patients.

‘Where this does happen, I hope it will be a very clear reminder that we will take appropriate action.’

The Trust has contacted the families of Barnaby, Grace and Ian regarding the findings of the investigation.

Both Nottinghamshire Police and the Information Commissioner’s Office (ICO) have been informed of the results, while the General Medical Council and the Nursing and Midwifery Council are also expected to review the matter.

Experts have warned a similar incident could happen again tomorrow due to the “lack of consequences” for failures by police and mental health services in the investigation into three murders last week.

They said a number of ‘red flags’ about Calocane’s behavior were overlooked in the months before the fatal stabbings.

Calocane was sectioned four times between 2020 and 2022, and once attacked a hospital ward with a hammer. It was ‘overlooked as an incident’ until he was discharged nine months before the attacks.

David Spencer, head of crime and justice at Policy Exchange, called for police and NHS bosses to be held accountable for the attack.

He said the three victims were ‘visited by evil’ and added: ‘There was a complete failure of leadership on so many different levels and the consequences of that failure were almost negligible.’

Meanwhile former Old Bailey judge Wendy Joseph, KC, asked: ‘How could the police not see this coming? There was a clear connection between mental illness, refusal of treatment, violence against police, and the path that would lead him to court.

‘And then nothing [happened]. If the bereaved are angry, if we are all angry, there is good reason.’

Valdo Calocane, who was diagnosed with paranoid schizophrenia in 2020, fatally stabbed Barnaby Webber, Grace O’Malley-Kumar and Ian Coates in June 2023.

The latest privacy breach comes just days after it was revealed that 48 hospital employees improperly accessed the medical records of Southport shooting victims.

Leanne Lucas, who taught at the Taylor Swift-themed dance workshop targeted by Axel Rudakubana in July 2024, said she was ‘devastated and appalled’ and claimed NHS staff ‘abused their position’.

In Rudakubana’s cowardly attack with a kitchen knife, he fatally stabbed seven-year-old Elsie Dot Stancombe, nine-year-old Alice da Silva Aguiar and six-year-old Bebe King. Ten people were also injured, including Leanne, who is said to have saved many lives that day.

Some of the injured were treated at Liverpool Group University Hospitals, where a number of staff accessed victims’ records without cause.

An information access audit carried out by the trust in the days following the incident showed that 48 staff had improperly accessed medical records. HSJ reports.

Liverpool Group University Hospitals reported the incident to the Information Commissioner’s Office in August 2024, according to the HSJ.

The hospital’s trust chairman, James Sumner, said that after completing the investigation, he decided not to inform the patients involved ‘taking into account the potential psychological impact it might have on them at the time’.

Ms Lucas said: ‘I am absolutely devastated and horrified that my privacy was invaded when I was most vulnerable.

‘Nothing can take away my gratitude to the staff who saved my life, but 48 people who were not involved in my care abused their position of trust to access the files of victims who suffered untold trauma.

‘The decision to keep this from me for almost two years is a new level of despicableness.

‘I’m speaking out because I want this scandal and the top management’s attempted cover-up to be exposed.’

Liverpool Group NHS University Hospitals said it was ‘sincerely sorry for any distress this may have caused to patients in our care who trust us to care for them when they are most vulnerable’.

ICO was contacted regarding the incident.