NUH has dismissed 15 staff over Nottingham victims' records; its monitoring system is still in testing

The Trust's table lists 34 hearing outcomes, and does not say how many people they are

Nottingham University Hospitals NHS Trust (NUH) published a statement at 12:25 on Friday 16 October 2026, headed "NUH dismisses further staff in inappropriate access investigations". It says the Trust has now dismissed 15 staff over inappropriate access to the medical records of three people killed in the June 2023 Nottingham attacks, "alongside 15 final written warnings and two first written warnings". A table headed "Breakdown of outcomes so far" lists four hearing outcomes: no case to answer 2, first written warning 2, final written warning 15, dismissal 15. Those add up to 34 outcomes (derived).

What that figure does not establish is how many people are behind it. The table counts hearing outcomes, not individuals. The page does not say how many people the 34 cover, how many records were opened, over what period, or what any one person did. The Trust's May statement said actions were being taken against "another 14" people beyond the 11 dismissed, which suggests different people; the October page does not use that word, so its table should not be read as 34 different people.

This briefing was built on Sunday 18 October 2026 from primary pages. The live October statement was fetched again at 12:33 BST and its text is identical to the copy saved earlier. The Trust's May statement of 21 May 2026 was found through the news archive link on the Trust's site and read in full. The Trust's medical director has also given the Nottingham Inquiry three witness statements, published on 27 May 2026. They were read, apart from the legal background and the exhibit index of the first, because they answer questions the October page leaves open: first, second and third. The ICO, NMC, GMC and NHS England pages and the legislation were read as published. No secondary coverage is relied on for any figure.

From May to October: four more dismissals and three more final warnings

The Trust's first outcomes statement is dated 21 May 2026 (09:56). It said 11 members of staff had been dismissed and "a further 14" had actions taken against them: two first written warnings and 12 final written warnings. The 148 days between that statement and the October one (derived) added four dismissals and three final written warnings. That is seven more outcomes with an action (derived), 28.0 per cent more than in May (derived).

The Trust's two outcome statements, 21 May 2026 and 16 October 2026. Changes are derived. The May page said its actions "include" the three listed, so it did not claim to be a complete list.

Outcome	21 May 2026	16 October 2026	Change (derived)
Dismissal	11	15	+4
Final written warning	12	15	+3
First written warning	2	2	0
No case to answer	Not listed	2	Not comparable
Outcomes with an action	25	32	+7 (28.0 per cent)
All outcomes in the table	25 listed	34	Not comparable

Two things changed in the wording. In May the staff were doctors, nurses, "registered medical professionals" and "admin and clerical colleagues". In October they were doctors, nurses, "registered healthcare professionals" and "other staff". The page does not say who the other staff are, or whether the wording change means anything. And in May the Trust said its investigations began in "early 2025"; in October it says it "started thorough inquiries in 2025".

Stated and not stated: what the 16 October page does and does not say

Each row below is checked against the live page. The middle column quotes it. The right column is what a reader might assume the page says. It does not say it.

The Trust's 16 October 2026 statement, line by line, with the Trust's May statement and its evidence to the Nottingham Inquiry noted where they add something

Question	Stated on the page	Not stated on the page
How many people?	15 dismissals, 15 final written warnings, two first written warnings, two cases "found to have nothing to answer"	Whether these are 34 people or fewer. The table is headed "Hearing Outcome"
How much access?	"Inappropriate access of medical records" of three people killed; investigations ongoing into the files of surviving victims	Records, accesses, period, what was viewed. The Trust's evidence gives larger populations (see the section on scale)
How was it found?	"The Trust started thorough inquiries in 2025"	What prompted them. The Trust's evidence gives a route (see the section on how the access was found)
Regulators and police	The Trust "is discussing the outcomes with relevant independent regulators, such as the Nursing and Midwifery Council and General Medical Council" and "has also informed the Information Commissioner's Office and Nottinghamshire Police"	Whether any referral has been made, any fitness to practise outcome, any ICO or police decision
The two no-case outcomes	"Two cases were found to have nothing to answer and no action was taken"	How they were reached, or whether they relate to the nine people the Trust told the Inquiry in February were found at an earlier stage to have no case to answer
Who the staff are	"doctors, nurses, registered healthcare professionals and other staff"	Roles of the "other staff", numbers in each group, seniority
The new system	To "continually monitor access, identify suspicious behaviour, and generate alerts, audits and reports". Testing is "currently underway, followed by a pilot period, with the aim of going live early next year"	Product, supplier, a go-live date (it is an aim), who reviews the alerts, which record systems it covers
Appeals	Nothing	Anything about appeals, or about the people involved

Some of the gaps are partly filled by the Trust's own evidence to the Nottingham Inquiry, taken in the next two sections. Others are not filled anywhere that was read: the outcome of any ICO or police decision on the people involved, any appeal, the outcomes since 5 May other than the two statements, and the identity of the "other staff".

How the access was found, in the Trust's own evidence to the Nottingham Inquiry

The October page does not say what prompted the inquiries. The Trust's medical director has put an account before the Nottingham Inquiry, the statutory public inquiry into the attacks. There are three witness statements, each closing with a statement of truth, drafted with the Trust's lawyers and published on 27 May 2026: the first dated 5 December 2025 (stating the position as at 15 July 2025), the second dated 19 February 2026, the third dated 5 May 2026. They are the Trust's own account. The Inquiry's hearings ended on 5 June 2026 and closing submissions were on 8 and 9 September; its pages, read on 18 October, list no report and no finding on them.

The route, in the Trust's words and paragraph numbers:

• The first statement says the Trust "did not become aware of any suggested unauthorised access until early October 2024", although it held the information from 13 June 2023 (paragraph 17; paragraph 148 repeats it).
• On 4 October 2024 another NHS trust, Nottinghamshire Healthcare NHS Foundation Trust, asked for audit data after the families' solicitor asked it who had accessed the records. The request was about that trust's own staff (paragraph 151). On 9 December 2024 its data protection officer identified a clinician who worked for both organisations, and on 4 February 2025 its medical director raised the matter directly with NUH's medical director (paragraphs 155 and 161).
• NUH's digital services team produced audit reports on 10 February 2025. On 12 February the Caldicott Guardian screened the audit data, decided a full HR investigation was needed, and reported a potential breach to the ICO through the Data Security and Protection Toolkit. The report said the initial review indicated "in the order of 20 to 30 likely inappropriate access events" (paragraphs 161 to 167).
• An incident command group was set up on 13 February 2025. Letters to the families followed on 20 February (paragraphs 169 and 180).

That is 479 days from the attacks to the first audit request, 608 to the audit reports and 610 to the screening (all derived).

On the Trust's account, then, the access came to light through an audit that was requested after a solicitor asked who had looked. The statements describe no alert that flagged it. That last point is an inference: the statements do not say in terms that no monitoring existed, but they describe proactive monitoring only as something explored and, from January 2026, funded. The first statement also says the Trust "did not initially take any specific steps" to restrict who could open the information generated by the attacks, and relied on the controls it already had (paragraph 84).

The Trust described those controls in the first statement. Access was by a role-based scheme that "is not patient-specific" (paragraph 139). Every access was logged and could be audited, but audits were run by an application management team on request, and apart from one system "users are unable to generally see who else has accessed a record without an audit being requested from this team" (paragraph 142). Its main record system showed a login warning, including "All activity is auditable", but nothing on opening an individual record; four other systems showed no warning at all (paragraph 146). Its core record systems did not enable access to a single record to be restricted (March 2025, paragraph 195), and a break-glass prompt was not built into the newer system replacing its main one (the July 2025 position, paragraph 226). The Trust's data protection officer had raised unauthorised access to medical records in six-monthly Audit Committee briefings "since at least as early as 2023" (paragraph 31), and a 2022 staff campaign had addressed the same subject (paragraph 236).

On monitoring, the first statement said the Trust had explored a patient privacy intelligence tool "a number of years ago" and found it "ineffective due to the extent of results it provided" (paragraph 243), and it cited its own scale: around 350 million database rows added and 150 million updated every day (paragraph 234). On 27 January 2026 the Chief Executive's Team supported "a more proactive monitoring approach" and agreed funding (second statement, paragraph 71). The Trust told the Inquiry it had agreed to procure Imprivata Patient Privacy Intelligence, which another NHS trust uses to monitor access to the same record system. The supplier has a commercial interest in monitoring being bought, and the Trust's evidence is not an independent evaluation of the product. On 5 May 2026 the Trust said the project had started, that it was "in discussion with the supplier as to timeframes for implementation", that it had not yet decided how large a team would be needed to review alerts, and that an "initial backlog" was likely (third statement, paragraphs 47 and 48).

The October page does not name the system it describes and does not say whether it is the product named in May. If it is, the Trust's own dates put the funding decision on 27 January 2026 and the go-live aim at "early next year". Taking 1 January 2027 as the earliest that phrase can mean, that is at least 339 days (derived), and at least 688 days from the 12 February 2025 report to the ICO (derived). "Early next year" is an aim, and the page gives no date.

Play the timeline below, or step through its dates. It redraws dates already in this briefing and adds no new reporting; every day count is derived, and every date before 21 May 2026 except the attacks is the Trust's own account to the Inquiry, not an Inquiry finding.

The scale the Trust gave the Inquiry, before the 34

The October page gives outcomes. The Trust's evidence gives populations, as at the dates shown. It sorts the people who accessed records into cohorts and runs a two-stage process: stage 1, a manager's fact-find reviewed by a multi-disciplinary group; stage 2, an outside HR investigation, then a disciplinary panel where there is a case to answer.

The Trust's figures to the Nottingham Inquiry, with the date of each statement. The cohorts are not added, because the statements do not say whether any person is in more than one. Shares are derived.

Group, in the Trust's terms	People identified	Position the Trust reported
Cohort 1: records of the three people who died	98 (second statement, 19 February 2026)	48 to stage 2 and 50 judged legitimate access. Nine found to have no case to answer at stage 2; four delayed by long term absence
Cohort 2: records of the surviving victims	164 from 294 audit outcomes (third statement, 5 May 2026)	142 fact-finds done: 81 legitimate (57.0 per cent), 61 to formal investigation (43.0 per cent). 22 outstanding
Cohort 3a: further access to the records of those who died, found by a later re-audit	50 (5 May 2026)	8 legitimate, 5 to stage 2, the other 37 still in fact-finding
Cohort 3b: further access to the survivors' records	542 (5 May 2026)	No outcome stated. The Trust expected "a significant amount" to be legitimate because the survivors kept receiving care

"Legitimate" is a finding the Trust reaches after fact-finding, not a label on the audit. The audit scope also moved. At the time of the first audits the Trust operated 455 IT systems and reviewed five, the core systems used across all specialities: 1.1 per cent (derived). It said the other 450 were mostly non-clinical or departmental systems for particular groups of patients. On 28 October 2025 it decided to re-audit the five and add four, after a concern that not all access had been captured, and that produced cohort 3 (third statement, paragraphs 19 to 24). An independent barrister reviewed the stage 1 "no further action" decisions for cohort 1 and concluded that all instances of access to the audited records had been identified (second statement, paragraph 31). That is a statement about the records audited, not about the systems left out.

None of these figures is on the October page. They show that 15 dismissals sit inside a process whose populations run to hundreds, and that what an audit finds depends on which systems it reaches. The statements also record that the families of the people who died have told the Trust they do not feel assured about its processes and transparency (second statement, paragraph 59).

Five friendly names that are not controls

In an incident like this the comfortable words are accurate and incomplete. Each describes something real. None of them, alone, stops or flags a person looking at a record they have no reason to open.

Labels used in the Trust's evidence and statements, what each does, and what it does not. Descriptions are the Trust's own; the NHS England wording is quoted from its guidance.

Label	What it does	What it does not do
"All activity is auditable"	Makes an investigation possible after someone asks	Tell anyone that a look was unusual. The Trust said audits were run on request, and the access was found that way
"Role-based access"	Limits what a role can open. The Trust restricted main-entrance reception staff to non-clinical information after the audit	Stop a permitted role opening a record it has no care reason to open. The Trust said the scheme is "not patient-specific"
A login warning ("All activity is auditable")	Tells users they may be checked	Check anything. On one system the warning appeared at login only, and four systems showed none
"Legitimate access"	Names the Trust's conclusion after a fact-find	Exist before the event. It is a judgement made afterwards, on a manager's template and a group's review
A monitoring system	Will "generate alerts, audits and reports" (the Trust)	Work until people review the alerts. On 5 May the Trust had not set the size of the review team and expected a backlog

NHS England's own guidance for information governance professionals (page showing 14 August 2026 as last edited) says the same thing from the other side. Electronic patient records "must show who has accessed" records, and an organisation without an automatic monitoring system "should have a process in place for manually checking access reports at regular intervals". It also warns that if staff believe records access is not monitored, "this can make unlawful access attempts more likely".

The ICO, NMC and GMC: what each body's pages say, and what they leave open

The October page names four outside bodies. What follows is only what each body's own pages say, read on 18 October 2026. The ICO's own site search and filter forms were not used (no form was submitted), so a negative about the ICO means that none was found by web searches limited to its domain and by fetching its pages.

What each body's pages say, as read. The right column is what the page does not tell the reader about this case.

Body and page	What it says	What it leaves open
Law: Data Protection Act 2018, section 170 (legislation.gov.uk)	An offence "knowingly or recklessly" "to obtain or disclose personal data without the consent of the controller". Penalty under section 196: a fine, on summary conviction or on indictment	Whether any person involved has been or will be reported or charged
ICO: reply to a freedom of information request, 24 January 2025	Its prosecutions are "against the individual not the organisation". It listed 16 NHS healthcare prosecutions with decision dates from 3 March 2017 to 15 November 2023 (count derived)	Whether it has prosecuted since 15 November 2023, and whether the list is complete (it says it collated it from its own records and from outside sources)
ICO: statements of 17 June and 21 July 2026	A formal caution under section 170(5) to a former healthcare professional in a London Clinic matter, and no failings by the provider that met the threshold for regulatory enforcement. A council worker given a suspended sentence under section 1 of the Computer Misuse Act 1990 after accessing about 490 records	Neither concerns this Trust or an NHS trust's staff accessing patients' records for curiosity
ICO: refusal letters of 10 November 2025 and 28 July 2026	878 Health "unauthorised access" breach cases in two years and 195 investigation cases (November); 964 "unauthorised access" cases among 1,699 Health cases (July). It says its system cannot extract whether a case "involved a healthcare staff member"	How many cases involve staff, or this Trust. No ICO statement about this Trust's access cases was found
ICO, as the Trust describes it (first statement, paragraph 186)	On 21 February 2025 the ICO said no further action was needed on the first notification, because UK GDPR applies only to identifiable living individuals and the people concerned were dead when the records were accessed. The ICO told the Trust to consider the police	The ICO's email was not read. The Trust's notification about the survivors in March 2025 has no outcome stated
NMC: statement of 8 July 2026 and screening guidance, last updated 25 March 2026	Registrants must access records only "where there is a legitimate professional reason"; inappropriate access can "amount to a breach of professional standards resulting in fitness to practise action". Local investigation is "always the preferred way" unless a risk employers cannot manage; "It's not our role to punish people for past events"	It does not mention this Trust. The Trust told the Inquiry on 5 May it understood NMC referrals must await its own processes unless the person has left
GMC: confidentiality guidance, and its page for employers who refer a doctor	"You must not access a patient's personal information unless you have a legitimate reason to view it" (paragraph 120). "Your duty of confidentiality continues after a patient has died" (paragraph 134). An employer's referral needs "a chronology of events", "details of any action taken locally" and "disciplinary records" so the GMC can decide whether to investigate	Whether a referral about this Trust is open. On 5 May the Trust said the GMC had been told "on a named basis" and intended to await the Cohort 1 outcomes

Three readings follow, each marked as such. First, an employer's dismissal and a regulator's decision are separate: the NMC's own guidance says many issues are "more appropriately investigated and dealt with by an employer", so fitness to practise outcomes cannot be assumed from the Trust's table. Second, the ICO's prosecutions are of individuals. The ICO's own list is 16 prosecutions with decisions between March 2017 and November 2023 (derived), a different route from, and not a like for like comparison with, 15 employer dismissals at one trust in one investigation. Third, the Trust's account of the ICO's first reply matters for anyone holding records of people who have died. Section 3 of the Data Protection Act 2018 defines personal data as information about an "identified or identifiable living individual", while the GMC says the duty of confidentiality continues after death. That points to a gap, in the data protection route alone, for the records of the dead. The Computer Misuse Act 1990 offence of unauthorised access to computer material is not framed around living people.

UK law and guidance: a confidentiality breach by authorised users

The people who opened these records were, on the Trust's own account, authorised users of its systems, in roles with access "restricted to only those staff working in roles providing or supporting clinical care" (first statement, paragraph 144). Access without a legitimate reason is a confidentiality breach by an authorised user. The control that finds it is access monitoring and audit, not a perimeter. The sources below are read from the pages named.

UK law and guidance relevant to access by authorised users, as read on 18 October 2026

Source	What it says	What it means for a health-data holder
Data Protection Act 2018, sections 3, 170 and 196 (legislation.gov.uk)	Personal data is information about a "living individual". Section 170 makes unauthorised obtaining an offence. Section 196 provides a fine	A data protection route exists for the living. The Trust's evidence is that the ICO decided on no further action on its first notification, for the dead, on this point
Computer Misuse Act 1990, section 1	Unauthorised access to computer material is an offence; up to two years on indictment	The ICO's July 2026 news item reports a council worker sentenced under it. NHS England's guidance lists it too
NHS England letter PRN02591, 8 July 2026	Where a record has been accessed "without a lawful reason", employers "must consider reporting it to the Information Commissioner's Office (ICO) and police"	The Trust's page says it has informed both
NHS England news item, 25 September 2026	Staff suspected of improper access face "immediate suspension" and their system access cut off while it is investigated. Registered professionals who are dismissed are to be referred to their regulator	Suspend at suspicion, not at the panel. The Trust's October page does not say whether or when the staff were suspended or had access removed
NHS England guidance for IG professionals (last edited 14 August 2026)	Names role-based access, break-glass prompts, manual audits where there is no automatic monitoring, live monitoring, and flags including "the record of someone who has died" and "a person who is well known locally or nationally"	The checklist below follows it
Data Security and Protection Toolkit and the National Data Guardian's standards	The toolkit is a self-assessment against the ten standards, and "organisations that have access to NHS patient data and systems must use this toolkit". Standard 4: "All access to personal confidential data on IT systems can be attributed to individuals"	Attribution is necessary, not sufficient: an attributed look is only found if someone reviews it
Caldicott Guardian (UK Caldicott Guardian Council)	"a senior person responsible for protecting the confidentiality of people's health and care information"; every NHS organisation "must have" one	In the Trust's evidence the Caldicott Guardian screened the audits, decided that some access was legitimate and runs the fortnightly check of the victims' records
NCSC Cyber Assessment Framework, principle C1	Log collection "should capture the activities of users both regular users and privileged users". The NHS England Digital page for the CAF-aligned toolkit lists Objective C, detecting cyber security events	The CAF is written about security events generally and does not mention patient records. It is stated here only for the logging point

What to do, in the order worth doing

These steps are for NHS organisations and any holder of health records. They follow NHS England's guidance and the Trust's own evidence of what was missing. They are not a claim about what any particular trust did or did not have.

What could not be verified

This briefing could not establish the following. Each is handled as stated.

• The number of people behind the 34 outcomes. The Trust's page does not give it, and the Trust's evidence stops at 5 May.
• Whether the two October no-case outcomes include the nine the Trust told the Inquiry in February had no case to answer at stage 2. Not stated.
• Any ICO, police, NMC or GMC decision on the people involved. The ICO's own site was searched and its pages fetched; the ICO's search form was not used; its breach datasets (spreadsheets) were not opened. The ICO's reply of 21 February 2025 is known only as the Trust describes it.
• Whether the system in testing is the product named in May. The October page does not say.
• The Inquiry's oral evidence of May 2026 and the Trust's exhibits. Only the three witness statements were read, not the transcripts or the exhibited documents. The first statement's legal background and exhibit index were not read.
• Anything after 5 May in the Trust's evidence. Its populations will have moved since.
• The GMC pages returned a block to a script fetch; no bot check was bypassed, and the pages were opened in an ordinary browser tab, where they loaded.
• Secondary coverage was not relied on. One report of 18 October (BritBrief) was read; nothing in it is used here.

The question that exposes the gap

If the control that finds this is a monitoring system that goes live in 2027, what found it in 2025? The October page does not say. The Trust's own evidence does. On its account, an audit found it, requested after a family's solicitor asked another trust who had looked, 479 days after the attacks (derived), and the Trust says it knew of nothing before then.

So the question for every holder of health records is the other half of that sentence. If the person who asked had not asked, what in your organisation would have found it, and how long after the first look?

Key facts