In the summer of 2023, as Nottingham reeled from one of the most shocking acts of violence in recent British memory, the families of Barnaby Webber, Grace O’Malley-Kumar, and Ian Coates began the impossible work of grief. What they could not have anticipated was that, alongside that grief, they would be forced to endure a prolonged institutional failure of a different kind — one measured not in blood but in the quiet, illicit clicking through confidential medical files by people who had no business being there.
Nottingham University Hospitals NHS Trust has now confirmed the dismissal of four further members of staff for inappropriately accessing the medical records of the three victims, bringing the total number of sackings to fifteen. The latest round of disciplinary action follows the dismissal of eleven staff in May 2026, itself a development the victims’ families described, with considerable restraint, as a “kick in the teeth.” Alongside the dismissals, the trust confirmed that fifteen final written warnings and two first written warnings have been issued in total, with two cases finding no case to answer.
A Breach Measured in Dozens
The scale of the misconduct, spread across doctors, nurses, registered healthcare professionals, and other categories of staff, raises serious questions about the culture of data governance within the trust. Accessing a patient’s records without clinical justification is not a grey area; it is a clear and well-understood professional violation. That so many individuals across different roles saw fit to do so suggests either a failure of deterrence or a failure of institutional seriousness about patient confidentiality — or both.
Dr Manjeet Shehmar, medical director at NUH, stated plainly that there is no excuse for accessing patient records without a legitimate reason, and expressed sorrow that the families had suffered this additional compounding harm. The trust has notified the Information Commissioner’s Office, Nottinghamshire Police, the Nursing and Midwifery Council, and the General Medical Council — bodies which carry the power to remove individuals from their professional registers entirely.
Grace O’Malley-Kumar’s father, Dr Sanjoy Kumar, offered a response that was brief and unsparing: “I am appalled. It’s time to get a handle on these failures.” It is difficult to argue with him.
A Pattern That Extends Well Beyond the Hospital
The NHS breaches do not stand alone. Eleven members of Nottinghamshire Police were found to have viewed material relating to the case without legitimate reason, though only three faced formal disciplinary proceedings; the remaining eight received performance interventions, a distinction that will strike many observers as rather gentle. A special constable was sacked in December 2023 for viewing bodycam footage showing the aftermath of the attacks. Separately, the South East Regional Organised Crime Unit notified the victims’ families late last year of alleged data breaches by staff within HM Prison and Probation Service and HM Courts and Tribunals Service, again involving the unauthorised accessing of case files and images.
The cumulative picture is one of systemic weakness across multiple public sector institutions, each of which handles sensitive material as a matter of routine and each of which, in this instance, demonstrably failed to prevent its misuse. The Nottingham case has become, among other things, an unwanted audit of how Britain’s public bodies actually manage confidential data in practice.
A System Under Review — and a Further Incident Elsewhere
NUH says it is currently testing a new system designed to protect patient records and alert the trust to potential breaches in real time. The belated arrival of such a mechanism underscores how much the existing architecture relied on professional self-restraint rather than technical enforcement — a fragile foundation, as events have shown.
Meanwhile, a separate investigation is underway following reports that NHS ambulance staff accessed, or attempted to access, the medical records of the man killed by a tiger at a Yorkshire zoo. The details remain under inquiry, but the episode reinforces a concern that the Nottingham breaches were not an isolated aberration but rather a symptom of a broader and inadequately addressed vulnerability in how NHS record systems are managed and monitored.
Barnaby Webber and Grace O’Malley-Kumar were nineteen years old when they were stabbed to death on the morning of 13 June 2023. Ian Coates, a sixty-five-year-old school caretaker and grandfather, died alongside them. Their killer, Valdo Calocane, had been diagnosed with paranoid schizophrenia in 2020 and had a documented history of failing to take his medication. The families have spent the years since navigating not only loss but an unbroken sequence of institutional shortcomings — in mental health provision, in criminal justice, and now in the basic dignity of keeping their loved ones’ medical records private. Each new disclosure asks them to absorb yet another failure. It is a considerable thing to ask.