Fifteen National Health Service (NHS) employees have been dismissed after an internal investigation found they accessed the confidential medical records of patients injured in the Nottingham stabbing incident involving suspect Valdo Calocane. The disciplinary action, announced by NHS England, follows a data‑security review that identified unauthorised log‑ins to the electronic patient record system.
Background to the Nottingham stabbing
On 13 June 2023, a knife attack in the city of Nottingham left one person dead and several others seriously injured. The perpetrator, identified as Valdo Calocane, was arrested and later convicted. The victims, who received treatment in local NHS hospitals, became the subject of a data breach when staff accessed their health information without a legitimate clinical need.
Investigation and disciplinary action
According to the BBC, the breach was discovered during a routine audit of system access logs, which flagged a pattern of non‑clinical queries into the victims' records. The audit prompted a formal investigation by the NHS's Data Security and Information Governance team, which concluded that the accesses violated patient confidentiality and the NHS’s data‑protection policies.
"Fifteen NHS staff were dismissed for unauthorised access to the medical records of victims of the Nottingham stabbing," the BBC reported.
The NHS confirmed that all fifteen employees were terminated with immediate effect and that their conduct will be referred to the General Medical Council where appropriate. The agency also said it is reviewing its access controls and staff training to prevent future incidents.
In a later development reported by the Daily Mail, four additional workers were sacked for similar breaches, and a further 17 staff members received formal warnings. This brings the total number of personnel disciplined to at least 19 dismissals and 17 warnings, although other outlets have only reported the initial fifteen terminations. The discrepancy has been noted by media analysts, indicating that the full scope of the disciplinary measures may still be unfolding.
Data‑protection experts have warned that such breaches undermine public trust in the NHS, which holds a legal duty under the UK’s Data Protection Act 2018 and the GDPR to safeguard patient information. The Information Commissioner's Office (ICO) has been notified, and a formal assessment of the breach is expected to be published in the coming weeks.
Health‑service unions have expressed concern over the speed of the dismissals, urging a balance between accountability and due process for the staff involved. Meanwhile, the families of the stabbing victims have been contacted by the NHS to apologise for the breach and to offer support, though no public statement from the victims' representatives has been recorded.
The incident adds to a series of data‑security challenges faced by the NHS in recent years, prompting calls for stronger oversight of electronic health‑record systems and clearer guidance for staff on lawful data access.
