NHS trust sacks staff over accessing Nottingham attacks victims' records

Eleven members of staff, including doctors and nurses, have been sacked by an NHS trust for inappropriately accessing medical records of the Nottingham attacks victims.

Nottingham students Barnaby Webber and Grace O'Malley-Kumar, and grandfather Ian Coates, were stabbed to death on 13 June 2023 by Valdo Calocane, who was diagnosed with paranoid schizophrenia in 2020.

It emerged in 2025 that staff at Nottingham University Hospitals (NUH) NHS Trust had accessed the victims' records without need, prompting an internal investigation.

On Thursday, NUH confirmed 11 members of staff had been dismissed, 12 had received final written warnings and two had first written warnings.

The trust said it had informed Nottinghamshire Police and the Information Commissioner's Office of the outcomes.

It comes as a public statutory inquiry continues, examining the lead-up to the attacks and decisions and actions taken in the aftermath.

NUH confirmed the staff involved in the investigations included doctors, nurses, registered medical professionals, and admin and clerical employees.

The families of Barnaby, Grace and Ian were informed of the outcome of the investigations this week, the trust added.

Further investigations are ongoing into inappropriate access, including into the files of the surviving victims of the attacks, Wayne Birkett, Sharon Miller and Marcin Gawronski.

Dr Manjeet Shehmar, medical director at NUH, said: "The families of Ian, Grace and Barnaby have had to endure much pain and heartache, and I am truly sorry that the actions of some of our staff have added to that.

"To access the medical records of our patients without a legitimate reason is totally unacceptable and we are doing all we can to identify where and how that has happened."

Shehmar is expected to give her evidence to the Nottingham Inquiry next week.

The trust said follow-up activity would take place with independent regulators such as the Nursing and Midwifery Council and General Medical Council.

Shehmar said appropriate access was a "fundamental principle of our duty of care", which the "vast majority" of staff understood.

She added: "By accessing records inappropriately, staff are damaging the valuable contributions made by those colleagues providing care for those patients.

"In those cases where it does happen, I hope that this is a very clear reminder that we will take appropriate action."

Calocane was sentenced to a hospital order in January 2024 after admitting three counts of manslaughter on the grounds of diminished responsibility and three counts of attempted murder.

What later emerged was a series of failings by authorities, including the police and mental health services - which Calocane was known to - prompting calls for a statutory public inquiry.

Further potential data breaches

NUH is among a number of organisations in which staff inappropriately viewed records or information related to the fatal attacks.

Amy Holmes, the interim director general for the chief operating group of the Ministry of Justice (MoJ), told the inquiry she could not detail what information was accessed due to the ongoing police investigation.

The inquiry also heard seven probation service officers were identified as having accessed the information.

HM Prison and Probation Service found four of those officers accessed files legitimately, but three did not have a legitimate reason to do so.

However, it was deemed by the probation service and the Ministry of Justice's data protection unit that the breaches were not serious enough to warrant further action.

Footage and images related to the attacks were also viewed numerous times by Nottinghamshire Police staff without a legitimate policing purpose.

The force confirmed it would carry out an audit of how many times the information was viewed and whether it was appropriate, following a complaint by Barnaby Webber's mother, Emma Webber, in March.