The East Suffolk and North Essex NHS Foundation Trust has removed 10 employees from active duty and reported the matter to the Information Commissioner’s Office after the medical records of three‑year‑old Noah Woods were accessed by unauthorised people following his disappearance, the trust has said.
Immediate action and apology
Trust officials said staff were either suspended or taken off active duty while an internal investigation continues and that disciplinary action is being considered. In a statement the trust apologised to Noah’s family for “the extra anguish this breach of trust has caused them at an already devastating time.”
“We have apologised unreservedly to Noah Woods’ family for the extra anguish this breach of trust has caused them at an already devastating time.”
Dr Martin Mansfield, the trust’s deputy chief medical officer, described unauthorised access to patient data as “completely unacceptable” and said immediate steps had been taken to secure records and prevent any further inappropriate viewing. The trust has formally notified the ICO, the regulator responsible for data protection compliance in the UK.
How the events unfolded
Noah, aged three, went missing from a playground in Merriam Close, Brantham, Suffolk, and was the subject of a large local search that involved more than 1,300 members of the public before police divers recovered his body from Decoy Pond the following day. Suffolk police have said his death is not being treated as suspicious, and an inquest heard that he had escaped the park “through a gap in the fence”.
The trust did not disclose how the potential breach was first identified, but said that as soon as concerns were raised an urgent internal inquiry was launched and access to the relevant records was restricted to those with a legitimate clinical reason.
Regulatory and sector response
The episode has prompted comment from NHS England, whose chief executive Sir Jim Mackey said staff caught “snooping” in patient records would be suspended immediately. Sir Jim said there had been “too many cases” of staff abusing access to confidential information and signalled a tougher approach across the service.
There are precedents for high‑profile cases of inappropriate access to patient files: investigators have previously examined incidents involving the 2023 Nottingham attacks and the 2024 Southport dance class knife attack. Those cases heightened public concern about the protection of medical data in sensitive, widely reported incidents.
- 10 staff removed from active duty or suspended by the trust.
- Over 1,300 members of the public joined the search for Noah.
- The trust has reported the incident to the ICO and launched an internal investigation.
Sources within the trust said the investigation will aim to establish whether the accesses were deliberate, the scale of the viewing, and whether the records were shared or disclosed outside legitimate clinical practice. If wrongdoing is substantiated, those responsible could face disciplinary dismissal and potential referral to professional regulators; the ICO could also consider statutory enforcement action or fines if data protection rules were breached.
Wider implications
The case raises immediate questions about staff training, technical safeguards and audit trails that are intended to protect patient confidentiality. NHS trusts hold sensitive records on millions of people and rely on both technological controls and professional standards to limit access to those with a direct and necessary clinical role.
Patient groups and privacy campaigners are likely to demand details of what went wrong and how access controls failed in this instance. For affected families, the breach compounds existing trauma: the trust’s apology acknowledged the additional distress caused to Noah’s relatives at “an already devastating time”.
| Event | Date / Detail |
|---|---|
| Disappearance | Noah went missing from a playground in Merriam Close, Brantham |
| Recovery | Body recovered from Decoy Pond by police divers |
| Public search | More than 1,300 people took part |
| Data breach response | 10 staff removed from duty; ICO notified; internal investigation under way |
The trust has not yet said when it expects the internal inquiry to conclude or whether any staff have been permanently dismissed. The ICO has not commented publicly at this stage. As investigations proceed, the findings will shape both the immediate personnel outcomes and any wider recommendations about safeguarding medical records across the NHS.
