NHS Trust Removes Ten Staff Over Noah Woods Data Breach

East Suffolk and North Essex NHS Foundation Trust has removed 10 staff from active duty or suspended them after finding that Noah Woods' digital medical records were accessed without authorization, the trust said Sunday, according to the BBC. Noah, 3, died after going missing on September 15 in Brantham, Suffolk, and his body was recovered from a nearby pond by police divers the following day.

What did the trust find?

A trust spokesperson said 10 employees were "removed from active duty or suspended whilst investigations are concluded," the BBC reported. Anna Turner, the trust's deputy director of communications, said the breaches surfaced through a "proactive" search of access logs because the case was high profile, and that the trust has since "made it impossible to find [Noah's] record, which is something we're able to do in this specific case." On Saturday the trust wrote to all staff to disclose the breach and, in Turner's words, "to make it clear we're taking very swift action."

What has the trust said to Noah's family?

Dr. Martin Mansfield, the trust's deputy chief medical officer, said any unauthorized access to patient data was "completely unacceptable" and that the trust has apologized "unreservedly" to Noah's family, per the BBC. Mansfield said immediate steps were taken "to secure the records and prevent further access that was not for a legitimate, clinical reason," and that the matter has been reported to the Information Commissioner's Office. He said disciplinary action would follow if the investigation warrants it, and the trust would keep the family updated as it proceeds.

How did Noah Woods die?

An inquest opened Friday in Ipswich heard that the three-year-old left a play area "through a gap in the fence," the BBC reported. Assistant coroner Jyoti Gill called it a "very sad and tragic death" before opening and adjourning the inquest. Police said at least 1,300 members of the public joined emergency services in the search for Noah in the 24 hours before his body was found. His family, in a tribute cited by the BBC, described him as a "happy, cheeky, playful" boy who loved to laugh; his mother urged other parents to "hold their children a little tighter and cherish every moment."

Why is NHS England pressing trusts on data breaches now?

The suspensions come two days after Sir Jim Mackey, chief executive of NHS England, wrote to every trust in the country ordering tougher action against staff who look up patient records without cause. "We have seen too many cases of people abusing that trust, and enough is enough," Mackey said, according to the BBC. "Anyone who thinks they can satisfy their curiosity by looking at a patient's record should know this: they will be found out, they may lose their career and could end up with a criminal record."

The Information Commissioner's Office confirmed it is making enquiries with East Suffolk and North Essex NHS Foundation Trust over the Noah Woods case. "A series of recent high-profile incidents involving unauthorised access to patient records is painting an extremely worrying picture," the ICO said in a statement carried by the BBC.

What is the trust doing to prevent further access?

Turner said the trust is taking additional steps to stop unlawful access to records beyond the technical block already placed on Noah's file. "We train all of our staff on information governance practice, with regular reminders, including posters in staff areas," she said, per the BBC. The trust has not detailed what disciplinary outcomes the 10 removed or suspended staff face, saying only that action would follow if the ongoing investigation supports it. The ICO's involvement means the trust could also face a separate regulatory finding tied to its data-protection obligations, independent of any internal disciplinary process.

The case adds to a run of incidents that prompted Mackey's nationwide directive last week, and the ICO's reference to "a series of recent high-profile incidents" suggests regulators are treating the Noah Woods breach as part of a broader pattern rather than an isolated lapse at one trust. No timeline for completing the investigation or for any ICO enforcement decision has been made public.

Read the original reporting from the BBC.