Why Were Noah Woods' NHS Records Accessed? 10 Staff Removed as Trust Investigates Suspected Snooping

An NHS trust has launched an urgent investigation after concerns that the medical records of three-year-old Noah Woods were accessed without an authorised reason, with 10 staff members removed from direct active duty or suspended.

East Suffolk and North Essex NHS Foundation Trust (ESNEFT) confirmed that Noah's records may have been viewed inappropriately, but said there is currently no confirmed explanation for why they were accessed. A trust spokesperson said the 10 employees had been removed from direct active duty or suspended while the investigation continues.

The case has been reported to the Information Commissioner's Office (ICO), which is making enquiries with the trust. NHS systems maintain audit trails showing who has accessed patient records and when, allowing suspected inappropriate access to be investigated.

Ten Staff Removed As Investigation Continues

ESNEFT said it acted immediately after concerns about Noah's records were raised.

Dr Martin Mansfield, the trust's deputy chief medical officer and Caldicott Guardian, said unauthorised access to patient data was 'completely unacceptable' and that the trust had apologised to Noah's family for the 'extra anguish' caused.

The trust has launched an urgent internal investigation, secured Noah's records and taken steps to prevent further unauthorised access. It said disciplinary action would be taken where required based on the investigation's findings.

ESNEFT has not disclosed the roles or workplaces of the 10 employees involved. It has also not established publicly whether all 10 are suspected of accessing Noah's records.

Noah went missing from an under-fives play area in Brantham, Suffolk, on 15 September after becoming separated from a relative. Metropolitan Police divers recovered his body from Decoy Pond in Brantham the following day.

Suffolk Police said his death was not being treated as suspicious. His inquest was opened and adjourned in Ipswich on Friday.

NHS England Warns Against Unauthorised Access

The investigation comes days after NHS England chief executive Sir Jim Mackey wrote to NHS trusts telling them to act immediately when staff are suspected of accessing records without a proper reason.

Mackey said staff found to have accessed records out of curiosity should expect serious consequences. NHS England guidance states that unlawful access can lead to disciplinary action, referral to a professional regulator and potential criminal proceedings.

The national action follows previous cases involving staff accessing records connected to high-profile incidents, including the 2023 Nottingham attacks and the 2024 Southport knife attack.

However, NHS England's guidance does not establish that curiosity was a motive in Noah's case. The reason for any access to his records remains under investigation.

ICO Makes Enquiries

The ICO confirmed that it is making enquiries after ESNEFT reported the matter.

The regulator said knowingly or recklessly accessing patient data without authorisation is against the law and can carry professional and criminal consequences.

There is currently no indication that Noah's records were shared outside the trust or that its systems were compromised by an external cyberattack. The available information does not establish why the records were accessed, who accessed them or whether all 10 staff members were involved.

Those questions remain part of the investigation, with ESNEFT saying it will keep Noah's family informed as enquiries progress. Any disciplinary action will depend on the findings.