An NHS trust has sacked 11 members of staff and sanctioned 14 others for inappropriately accessing the medical records of the Nottingham attack victims.
Students Barnaby Webber, 19, and Grace O'Malley-Kumar, 19, and school caretaker Ian Coates, 65, were killed in a stabbing rampage by Valdo Calocane on 13 June 2023.
Last year, Nottingham University Hospitals Foundation Trust, which provides acute hospital services, launched an investigation into staff who were found to have inappropriately accessed the medical records of Mr Webber, Ms O'Malley-Kumar and Mr Coates.
The trust’s investigation looked into whether any “wrongdoing” had taken place and to identify what action would be needed.
The inquiry covers at least 150 staff members and is still ongoing, with probes into the inappropriate access of the file of the surviving victims of the attacks, Wayne Birkett, Sharon Miller, and Marcin Gawronski.
It comes as a public statutory inquiry into the killings continues.
Barnaby’s mother, Emma Webber said it was “shocking” to learn of the staff dismissals and disciplinary actions, adding: “What is more shocking is the scale of misconduct – 150 members of staff accessed the records.
“The process is not yet complete, so we anticipate these numbers to escalate considerably. The trust is also aware that we do not accept their findings that 48 members of staff had legitimate access. The number is far too high.
“The rationale given for legitimacy does not stack up, and we are formally challenging this in order to scrutinise properly.
“It’s heartbreaking that on top of our tragic loss, we’ve also had to face such appalling additional failures by members of staff who should know better. I’d ask them all to consider how they would feel if it was their child or father.”
Staff who accessed the records of Mr Webber, Ms O’Mally-Kumar, and Mr Coates, included doctors, nurses, other registered medical professionals, and admin and clerical staff.
Following the investigation, 11 were dismissed, 12 were handed final written warnings and two staff were given first written warnings.
Dr Manjeet Shehmar, medical director at NUH, apologised for the actions of the staff involved in the breach.
She said: “The families of Ian, Grace and Barnaby have had to endure much pain and heartache, and I am truly sorry that the actions of some of our staff have added to that.
"To access the medical records of our patients without a legitimate reason is totally unacceptable, and we are doing all we can to identify where and how that has happened. I hope that the families, staff, and our communities feel reassured by the outcomes so far, that we are taking this seriously and will continue to do so.”
Dr Shehmar added that the vast majority of trust staff understand that by accessing records inappropriately, the staff involved were damaging the valuable contributions made by those colleagues providing care for those patients.
“In those cases where it does happen, I hope that this is a very clear reminder that we will take appropriate action,” she said.
The trust will now involve the relevant professional regulators, such as the Nursing and Midwifery Council and General Medical Council. It has also informed Nottinghamshire Police and the Information Commissioner’s Office.
Following his deadly attacks, Calocane, who has paranoid schizophrenia, was sentenced to an indefinite hospital order after pleading guilty to manslaughter by reason of diminished responsibility and attempted murder.
Following his detention, a statutory public inquiry was launched into failures by NHS mental health services, run by Nottinghamshire Healthcare Foundation Trust, to prevent his attacks.
Giving evidence to the inquiry this week, bosses of Nottinghamshire Healthcare FT admitted there were missed opportunities in relation to Calocane’s care to prevent the attacks after he was discharged from mental health hospitals multiple times to community services, despite concerns about his violent behaviour. The trust is set to review whether staff involved in the “errors” in care should face disciplinary action.
Reacting to the sanctions against staff over the accessing of medical records, Nottingham University Hospitals FT said: “Since starting investigations in early 2025, the trust has been conducting thorough and professional inquiries to identify wrongdoing and to take necessary action. The first of those investigations is now complete, with families being informed of the outcomes this week.”
The news comes after the Health Service Journal this week reported that staff at the University Hospitals of Liverpool Group inappropriately accessed the medical records of the victims of the 2024 mass stabbing at a dance class in Southport when Elsie Dot Stancombe, Alice da Silva Aguiar, Bebe King, were killed and 10 others were injured.
