NHS staff suspended or removed from duty over access to Noah Woods' medical records

East Suffolk and North Essex NHS Foundation Trust (ESNEFT) has suspended or removed from active duty ten members of staff and reported itself to the Information Commissioner's Office after concerns that the medical records of three-year-old Noah Woods were viewed without a legitimate clinical reason following his disappearance.

Noah became separated from a relative after visiting a playground in Merriam Close, Brantham, Suffolk, on the afternoon of 15 September. An inquest opened and adjourned in Ipswich on 25 September heard that he left the park through a gap in the fence. Around 1,300 members of the public joined the search, and Metropolitan Police divers recovered his body from Decoy Pond on the afternoon of 16 September. Suffolk Constabulary said his death was not being treated as suspicious.

Dr Martin Mansfield, Deputy Chief Medical Officer and Caldicott Guardian at ESNEFT, said in a statement on 26 September that the trust had launched an urgent internal investigation as soon as it became aware of concerns that Noah's records may have been viewed inappropriately. "Any unauthorised access of patient data is completely unacceptable. We understand the significant distress it can cause patients and their families. It also undermines trust in our services," he said.

Mansfield said the trust had apologised unreservedly to Noah's family for the additional anguish caused at an already devastating time. Immediate steps had been taken to secure the records and prevent further access that was not for a legitimate clinical reason, and the matter had been reported to the ICO. The trust would take disciplinary action where needed in line with its policies and procedures, and would keep the family informed as the investigation progressed.

A trust spokesperson confirmed that ten employees had been removed from active duty or suspended while investigations are concluded, and that disciplinary action was being explored. The trust has not disclosed their roles or workplaces, whether all ten are suspected of accessing the records, or how the concerns first came to light.

Knowingly or recklessly obtaining personal data without the consent of the controller is a criminal offence under section 170 of the Data Protection Act 2018, prosecuted by the ICO and punishable by an unlimited fine. Unauthorised access by staff also constitutes a personal data breach for the trust as controller, engaging the security and accountability obligations in Articles 5(1)(f) and 32 of the UK GDPR and the 72-hour notification requirement under Article 33 where the breach is likely to result in a risk to individuals.

An ICO spokesman confirmed the regulator was making enquiries with the trust and said its message to healthcare professionals was clear: knowingly or recklessly accessing patient data without authorisation is against the law and puts livelihoods, professional accreditation and liberty at risk. He said a series of recent high-profile incidents involving unauthorised access to patient records was painting an extremely worrying picture.

The case follows earlier incidents of NHS staff accessing the records of patients involved in high-profile events, including the Nottingham attacks in June 2023 and the Southport stabbings in July 2024. Sir Jim Mackey, Chief Executive of NHS England, said on 25 September that staff found looking at patient records without an authorised reason would be suspended immediately. "We have seen too many cases of people abusing that trust, and enough is enough," he said.

Noah's family, in a statement released after the inquest opened, said they wanted him remembered as the happy little boy he was, describing him as cheeky, playful and at the centre of their world.

The trust's statement is available at: https://www.esneft.nhs.uk/media-statement-unauthorised-access-to-patient-records/

---

Flags: the Guardian and LBC give slightly different wording for the trust's ten-staff line ("removed from active duty or suspended whilst investigations are concluded" versus "removed from direct active duty or suspended pending further investigation"); I have paraphrased rather than quoted it. Mackey's remarks are dated to Friday by the Guardian and appear to predate the ESNEFT statement, so it is worth confirming whether he was speaking about this case or about the wider pattern — a link to his full statement would help. Follow-ups: whether any of the ten are referred for section 170 prosecution or to professional regulators, whether NHS England's "immediate suspension" line is being formalised in guidance, and how the ESNEFT access was detected, given the trust runs Epic with full audit trails.