Nottingham University Hospitals (NUH) NHS Trust has confirmed that a total of 15 employees have now been dismissed for the unauthorized access of medical records related to the victims of the June 2023 attacks. This development follows a previous update in May, when the trust disclosed that 11 staff members had already been fired for the same breach. We are doing all we can to educate our staff on appropriate access and how to keep the records of our patients safe, alongside this. Learning and doing what they can to ensure that only lawful and justified access takes place in our hospitals, we know staff across the trust are listening.
The attacks on 13 June 2023 saw university students Barnaby Webber and Grace O’Malley-Kumar, along with grandfather Ian Coates, killed by Valdo Calocane. Calocane, who was diagnosed with paranoid schizophrenia in 2020, is currently serving an indefinite hospital order in a high-security facility following a guilty plea for manslaughter on the grounds of diminished responsibility. To lose a loved one in the way that the families of Ian, Grace and Barnaby have is heartbreaking enough. The Nottingham Inquiry examined decisions made in the lead-up to fatal attacks on 13 June 2023 and the aftermath. Laying bare failures and missed opportunities by agencies, including the NHS and police, the hearings scrutinised authorities that had interactions with Calocane in the years before the attacks. The inquiry heard Calocane had been sectioned four times under the Mental Health Act and had a history of police interactions linked to violent incidents before the killings. Barnaby and Grace were walking home from a night out in the early hours of 13 June 2023 when they were killed.
The families of the three victims have previously characterized the unauthorized handling of sensitive information as a “kick in the teeth.” Responding to the latest disciplinary figures, NUH medical director Dr. Manjeet Shehmar expressed her sincere apologies to the families, acknowledging that the staff actions had caused them further distress. Shehmar emphasized that patient privacy is paramount, stating, “There is simply no excuse for accessing the records of a patient without a legitimate reason.”
Beyond the 15 dismissals, the trust has issued 15 final written warnings and two first written warnings regarding the improper conduct. Two additional cases were reviewed, but the trust determined there was no case to answer. The disciplinary actions involved a range of professionals, including doctors, nurses, and other healthcare staff. Independent oversight bodies—such as the General Medical Council, the Nursing and Midwifery Council, the Information Commissioner’s Office, and Nottinghamshire Police—have all been notified of the breaches.
To prevent future occurrences, the trust is currently testing a new monitoring system designed to detect and alert administrators to potential data breaches. Furthermore, a campaign titled “Your Responsibility, Your Actions, Their Privacy” has been launched to reinforce data protection training across the workforce. Shehmar noted that while the recent findings are disappointing, they represent a small fraction of the broader staff, many of whom have demonstrated a commitment to professional conduct.
The trust continues to investigate other incidents of inappropriate data access, including files relating to surviving victims of the incident: Wayne Birkett, Sharon Miller, and Marcin Gawronski. These findings emerge during a wider public inquiry into the circumstances surrounding the 2023 attacks, which is being chaired by retired senior judge Deborah Taylor KC. The inquiry recently concluded 14 weeks of evidence from 164 witnesses and is scheduled to release its formal findings by May 2027. External heard from 164 witnesses during 14 weeks of harrowing evidence between February and June 2026, as well as two days of closing statements from core participants in September, the judge-led Nottingham Inquiry. Tell us which stories we should cover in Nottingham. External, on X, external, or on Instagram, external, listen to Radio Nottingham on Sounds and follow Nottingham on Facebook. External or via WhatsApp, external on 0808 100 2210, send your story ideas to eastmidsnews@.co.uk.
Authorities have identified that other organizations also mishandled information pertaining to the tragedy. In late 2024, investigations were launched into allegations that Ministry of Justice staff accessed computer files without authorization. The inquiry heard that three probation officers were found to have accessed information without a legitimate purpose, though the service determined these breaches did not necessitate further formal action. The public inquiry has since heard court workers also inappropriately accessed information about the case in January 2024. Amy Holmes, the interim director general for the chief operating group of the Ministry of Justice (MoJ), told the inquiry she could not detail what information was accessed due to the ongoing police investigation.
Additionally, staff at Nottinghamshire Police were found to have viewed footage and imagery related to the attacks numerous times without a legitimate policing necessity. Following a formal complaint by Barnaby Webber’s mother, Emma Webber, the force has committed to auditing the extent and nature of these viewings to determine if any internal protocols were violated.
