Health Secretary Yvette Cooper said unauthorised peeking at patient records is a "disgrace" and expects NHS organisations to suspend staff quickly when data breaches are suspected, after fresh dismissals linked to the Nottingham attacks and a separate ambulance-service probe.
Speaking to the BBC's Sunday with Laura Kuenssberg, Cooper insisted privacy rules are well understood across the health service even as investigations widen beyond a single trust.
Nottingham trust update
Nottingham University Hospitals NHS Trust said on Friday that 15 staff members have now been dismissed for inappropriately accessing medical records connected to the June 2023 stabbings that killed students Barnaby Webber and Grace O'Malley-Kumar and caretaker Ian Coates. The trust also issued 15 final written warnings and two first written warnings, and said regulators including the Information Commissioner's Office and Nottinghamshire Police have been informed.
Medical director Dr Manjeet Shehmar said there is "simply no excuse" for viewing records without a clinical reason. The trust is testing automated monitoring to flag suspicious access patterns.
Broader breach cases
Cooper's interview followed Yorkshire Ambulance Service acknowledging that medical records related to William Chapman, who died after a tiger incident, may have been accessed illegitimately. She tied both episodes to a core NHS value of patient dignity, not a rogue individual story.
Grace O'Malley-Kumar's father, Dr Sanjoy Kumar, told the BBC he was "appalled" at repeated failures to protect confidential data, language Cooper did not dispute when pressed on enforcement.
Systems and culture
NUH has run an internal campaign titled Your Responsibility, Your Actions, Their Privacy, reminding staff that curiosity clicks leave audit trails. National leaders are weighing whether fines under data-protection law are sufficient deterrence when families are re-traumatised by leaks.
For IT teams, the policy direction is clear: deploy real-time access analytics, integrate with professional regulators, and treat breach response with the same urgency as clinical safety incidents. Cooper's message to chief executives is that excuses will not shield managers if suspensions lag.
Regulators and next steps
The Information Commissioner's Office said in May it would assess evidence from NUH and consider next steps; police have stressed there is no parallel criminal investigation into the trust dismissals. Professional regulators for doctors and nurses retain separate fitness-to-practise powers that can outlast employment tribunals.
Cooper's Sunday interview signals ministers want chief executives to treat audit logs as clinical safety data, not IT housekeeping, ahead of winter when temporary staff rotations increase login volumes.