Nottingham University Hospitals NHS Trust has dismissed fifteen staff members for inappropriately accessing medical records belonging to victims of the 2023 Nottingham knife attacks, up from eleven dismissals disclosed in May, and has issued dozens of additional warnings as its audit continues.
Valdo Calocane killed students Barnaby Webber and Grace O'Malley-Kumar, both nineteen, and sixty-five-year-old school caretaker Ian Coates in June 2023, and attempted to kill three other people. The trust launched a formal review in 2025 after families raised concerns that hospital workers had opened the victims’ files without clinical justification.
Disciplinary tally and regulator involvement
In an update Friday, the trust said fifteen employees — including doctors, nurses and other clinical staff — have now been sacked. Fifteen others received final written warnings and two received first written warnings; two cases ended with no action. The trust said it informed the families of Coates, Webber and O'Malley-Kumar this week, and notified the Information Commissioner’s Office and Nottinghamshire Police.
Medical director Dr Manjeet Shehmar said there was “simply no excuse” for opening a patient record without a legitimate reason and that the trust would keep investigating. The Nursing and Midwifery Council and General Medical Council, which can remove practitioners from their registers, are also involved.
Automated monitoring promised
NUH said it is introducing a system to monitor access continuously, flag suspicious patterns and generate automated alerts, with a pilot before a planned go-live early next year. A staff-facing campaign, “Your Responsibility, Your Actions, Their Privacy,” is meant to reinforce lawful access rules across the trust’s hospitals.
Investigators are still examining inappropriate access claims involving surviving victims of the attacks, including Wayne Birkett, Sharon Miller and Marcin Gawronski, the trust said. Those cases have not yet produced public outcomes.
Families’ scrutiny
Emma Webber, Barnaby’s mother, told Sky News in May that the breaches felt like “gross voyeurism” and that the trust uncovered the scale of access only because families insisted on a review. She welcomed some dismissals but said the experience remained “intrusive and traumatising” on top of the killings.
For the NHS more broadly, the Nottingham case sits alongside other trusts disciplining staff who looked at high-profile patients’ files out of curiosity. NUH’s promise of automated detection is the kind of control hospitals increasingly sell to boards after ICO fines and media scandals — but the trust still has to show the tool works in real time, not only after bereaved relatives demand another spreadsheet of who opened what, and when.