An NHS trust has sacked 11 employees for inappropriately accessing the medical records of the Nottingham stabbing victims.
Students Barnaby Webber and Grace O’Malley-Kumar, and grandfather Ian Coates, were knifed to death by paranoid schizophrenic Valdo Calocane, while three others survived their injuries, on June 13, 2023.
It emerged that in 2025, employees at Nottingham University Hospitals (NUH) NHS Trust had accessed their records ‘without a legitimate reason’.
On Thursday, NUH announced 11 staff members had been dismissed.
A further 12 employees received final written warnings, while two were issued with first written warnings for their involvement.
The revelation comes as a public inquiry continues into the attack and its aftermath – and just days after a similar breach was reported in relation to the Southport attack victims.
Further investigations are also ongoing into the access of files relating to three survivors of the incident, the NUH said.
Wayne Birkett, Sharon Miller and Marcin Gawronski were all injured by Calocane during the shocking attack.
Students Barnaby Webber and Grace O’Malley-Kumar (right and centre) and grandfather Ian Coates (left) were knifed to death by paranoid schizophrenic Valdo Calocane in June 2023
Marcin Gawronski was one of three surviving victims whose files were also accessed
It is understood those who were investigated worked in departments across the trust, including doctors, nurses, medical professionals, admin and clerical colleagues, BBC News reported.
Dr Manjeet Shehmar, medical director at NUH, told the outlet: ‘The families of Ian, Grace and Barnaby have had to endure much pain and heartache, and I am truly sorry that the actions of some of our staff have added to that.
‘To access the medical records of our patients without a legitimate reason is totally unacceptable and we are doing all we can to identify where and how that has happened.’
The Trust contacted the families of Barnaby, Grace and Ian with the findings of the investigation.
Both Nottinghamshire Police and the Information Commissioner’s Office have been made aware of the outcomes, while the General Medical Council and Nursing and Midwifery Council are also expected to now look into the matter.
An inquiry into the triple killings heard last week that a similar incident could happen again tomorrow as there is a ‘lack of consequences’ for police and mental health service failures, experts warned.
They said a series of ‘red flags’ about Calocane’s behaviour were missed in the months prior to the fatal stabbings.
Calocane was sectioned four times between 2020 and 2022, and he once took a hammer into a hospital ward. This was ‘missed as an incident’ before he was eventually discharged nine months before the attacks.
David Spencer, head of crime and justice at the Policy Exchange, called for police and NHS bosses to be held accountable for the attack.
He said the three victims were ‘visited by evil’, adding: ‘There was a complete failure of leadership at so many different levels and there is almost a lack of consequences for that failure.’
Meanwhile former Old Bailey judge Wendy Joseph, KC, asked: ‘How could police not have seen it coming? There was a clear link between mental illness, refusal to have treatment, violence against the police, a route that would take him before the courts.
‘And then nothing [happened]. If the bereaved are angry, if we are all, there’s a good reason for it.’
Valdo Calocane, ho was diagnosed with paranoid schizophrenia in 2020, fatally stabbed Barnaby Webber, Grace O’Malley-Kumar and Ian Coates in June 2023
The latest confidentiality breach comes just days after it emerged 48 hospital workers inappropriately accessed the medical records of the Southport attack victims.
Leanne Lucas, who was the instructor at the Taylor Swift-themed dance workshop targeted by Axel Rudakubana in July 2024, said she was ‘devastated and horrified’ and claimed the NHS staff had ‘abused their position’.
Rudakubana’s cowardly attack with a kitchen knife saw him fatally stab seven-year-old Elsie Dot Stancombe, Alice da Silva Aguiar, nine, and Bebe King, six. Ten others were injured, including Leanne herself, who has been credited with saving many lives that day.
Some of those injured were treated at the University Hospitals of Liverpool Group, where numerous members of staff accessed the records of the victims without good reason.
An information access audit carried out by the trust in the days following the incident showed 48 staff members inappropriately accessed the medical records, the HSJ reports.
According to the HSJ, University Hospitals of Liverpool Group reported the incident to the Information Commissioner’s Office in August 2024.
The hospital’s trust chief executive, James Sumner, said after it had concluded its investigation, it had made the decision not to inform the patients involved after ‘taking into consideration the potential psychological impact it may have upon them at the time’.
Ms Lucas said: ‘I am absolutely devastated and horrified that my privacy has been invaded when I was at my most vulnerable.
‘Nothing will take away my gratitude to the staff who saved my life, but 48 people not involved in my care abused their position of trust to access the files of victims who have suffered unspeakable trauma.
‘The decision to keep this from me for almost two years is a new low.
‘I am speaking out as I want this scandal and the attempted cover up by senior management exposed for what it is.’
NHS University Hospitals of Liverpool Group said it was ‘sincerely sorry for any distress that may have been caused to the patients that were under our care and who trusted us to look after them when they were most vulnerable’.
The ICO had been contacted about the incident.
