Snooped On: When NHS Staff Pry Into Victims' Private Records

Oh, here we bloody go.

You lose a child. Or a partner. Or you survive an attack and end up in a hospital bed fighting for your life. And while you're still trying to breathe through the shock, someone with an NHS login — someone who has nothing to do with your care — opens your medical record for a look.

A flagrant abuse of power. That's what the open letter calls it. And for once, the lawyers have understated it.

More than thirty people have signed that letter, including survivors and families from the Southport and Nottingham attacks, plus parents caught up in maternity scandals. They sent it to Health Secretary Yvette Cooper, Culture Secretary Lisa Nandy and NHS England chief Sir Jim Mackey. They want three things that should already exist: a tick-box declaring legitimate reason before anyone opens a record; patients recognised as victims by the Information Commission; and independent quarterly audits with published results for ten years.

I don't know about you, but that does not sound radical to me. It sounds like basic dignity.

Fifteen sacked. Still not enough.

I'm from Nottingham. That bit matters here.

Barnaby Webber and Grace O'Malley-Kumar were nineteen. Ian Coates was sixty-five. Valdo Calocane stabbed them to death in the street in 2023. Surviving victims were still in hospital when staff began prying, according to the letter. Parents were still coming to terms with the deaths of their children.

Last month Nottingham University Hospitals NHS Trust confirmed a total of fifteen staff have now been sacked for inappropriately accessing the medical records of those three killed victims. Fifteen final written warnings and two first written warnings sit alongside that. Doctors, nurses, registered healthcare professionals and others. The trust started its inquiries in 2025. It has told the Nursing and Midwifery Council, the General Medical Council, the Information Commissioner's Office and Nottinghamshire Police.

Dr Manjeet Shehmar, the medical director, said there is simply no excuse for accessing a patient's records without a legitimate reason. She apologised to the families. She is right on both counts.

But let's be clear about what that apology does not do. It does not unsnoop the records. It does not give those families their privacy back. And sackings after the fact are not the same as a culture that never opens the file in the first place.

I keep thinking about what it means to live in a city where the names are not abstract. You hear them in the pub. You see the tributes. You watch the inquiry evidence pile up. And then you learn that some of the people trusted with the most intimate details of those lives decided those details were theirs to browse.

Investigations are still ongoing, including into access of surviving victims' files — Wayne Birkett, Sharon Miller and Marcin Gawronski among them, according to the trust. So no, this is not finished. And nobody serious is pretending it is.

The trust is testing a new system meant to monitor access, spot suspicious behaviour and generate alerts. Early next year is the aim for going live. Lovely. I will believe the culture has shifted when the audit trail is something patients can see, not a press release after the fifteenth dismissal.

Southport, Liverpool, and the same habit

Then there is Southport.

Axel Rudakubana killed Bebe King, six, Elsie Dot Stancombe, seven, and Alice Da Silva Aguiar, nine, at a Taylor Swift-themed dance class in 2024. Child survivors had court-ordered anonymity. Their families believed that would protect their most vulnerable moments.

It did not stop strangers with logins.

The BBC reports NHS workers snooped on Southport victims' records too. Liverpool Heart and Chest NHS Foundation Trust is investigating allegations. University Hospitals of Liverpool Group admitted in May that nearly fifty of its staff had wrongly looked at victims' medical files. There is a separate investigation at North West Ambulance Service Trust.

And the letter is careful to say this is not exclusive to the NHS. The Ministry of Justice and HM Courts and Tribunals Service have both apologised for inappropriate access of sensitive personal information belonging to Southport victims.

So the pattern is not one rogue trust on a bad Tuesday. It is a habit. High-profile tragedy. Names in the news. And then people who should know better go looking.

The letter also points to other cases: three-year-old Noah Woods; William Chapman; a two-year-old boy thrown into a crocodile pit at a Cambridge zoo. Same alleged behaviour. Different headlines. Same breach of trust.

Apparently some staff need reminding that a medical record is not a true-crime podcast.

What Cooper said — and what the letter wants

Yvette Cooper has called the breaches a disgrace. She told the BBC she expects action, including people being sacked, and that staff should be swiftly suspended while investigations take place. She said there has got to be proper respect for patients, and that it is a core value in the NHS.

Good. Say it again. Louder.

In September, NHS officials announced a crackdown: suspected snoopers suspended immediately, access to systems cut off. Fine. Necessary. Still not enough, say the signatories.

Nicola Ryan-Donnelly, the Fletchers Solicitors partner who penned the letter, put it plainly. Victims of NHS snooping have had enough. Every week in the media, she said, we learn of a new breach by staff with no legitimate cause. Among the child Southport survivors she represents, many parents do not feel they have a voice. They hoped anonymity would protect their children's hardest moments. Instead, staff repeatedly abused their position.

Anybody — no matter who they are or what they have been through — should feel confident that staff will protect their privacy and dignity.

Stronger sanctions help. They do not rebuild the culture on their own.

The letter's three asks are practical. A mandatory tick-box before access. Force the Information Commission to treat patients as victims, not only the trust as data controller. Publish independent quarterly audits for a decade.

That middle one deserves a pause. Right now, the watchdog can treat the organisation that stores the data — the trust — as the victim of a breach, even when the trust's own staff did the prying. The patient is affected, of course. But the letter says patients need a clear route to find out what was accessed, when, by whom, and what happened next. Without that standing, you are left thanking an apology and hoping the next shift behaves better.

The letter also cites a recent press investigation claiming more than two hundred NHS staff dismissed and almost two thousand disciplined for inappropriate access over five years. Treat that as a claim until you see the full methodology. The direction of travel is still ugly enough without padding it.

And Remember — this is not anti-nurse. It is anti-voyeur. There is a difference, and the people who do the job properly deserve that distinction in bold.

Here's my position

I love the NHS nurses. I mean that. My mum waited months for treatment and was let down by poor communication, and I still credit the people on the ward who showed up and did the hard graft. Most staff would never dream of opening a file for gossip.

That is exactly why the snooping enrages me.

Because every idle click steals trust from the people who never would. Because grieving parents should not have to write open letters to get a tick-box. Because a surviving child in a hospital bed should not become entertainment for colleagues down the corridor.

Privacy is not a luxury add-on. It is part of care.

If you need a clinical reason, you open the record. If you are curious, you do not. If you are bored on nights and the name was on the news, you especially do not.

Same rule for every trust. Same rule for every login. Same rule whether the patient is famous for five minutes or never makes the papers at all.

I want the three measures in that letter. I want Cooper's "disgrace" to turn into published audit trails patients can actually see. I want regulators to move as fast as the rumour mill already does. And I want the Information Commission to stop treating the trust as the only victim when the trust's own staff did the prying.

And I want ordinary patients — not only the ones whose names were on the front pages — to know the same protections apply when nobody is watching. Because if it can happen to Southport and Nottingham, it can happen on a quiet Tuesday to someone whose grief never makes the news.

Dignity. Transparency. Consequences that arrive before the next tragedy, not after the fifteenth sacking.

Stay curious — and stay angry

Britain is very good at mourning in public and very bad at protecting people in private.

We leave flowers. We light candles. We say never again. Then someone with a password has another look.

The families who signed that letter are not asking for miracles. They are asking for a culture that treats patient data like what it is: the most intimate story of a human life, not a free newspaper for staff with spare time.

Fifteen sacked at Nottingham is a start. Liverpool's nearly fifty wrongful look-ups are a warning. Southport's broken anonymity promise is a disgrace on its own.

So here is the short version, without the spin.

Tick the box. Audit the logins. Name the patient as the victim. Sack the ones who pry — and build a system where prying is harder than caring.

Same privacy. Same dignity. Same law.

We might actually have to mean it.

And Remember:

Trust no Single Source

Trust Your Gut

and Stay Curious

Sally Joe

For media enquiries, please contact:

UK - 020 3404 2295

USA - 0650 702 7445

AUS - 02 9072 9499

[email protected]

Help Support Sally Joe and the rest of our Authors by visiting the store to get your copy of the latest Anonymous Author Novel or Anything Anonymous.

Visit Store