Cooper calls for sackings over NHS patient record breaches

What happened

Health secretary Yvette Cooper has called for NHS employees who improperly examine patient records to lose their jobs, following an investigation involving information about a man killed by a tiger at Yorkshire Wildlife Park. Her intervention also follows disciplinary action over access to the records of victims of the Nottingham and Southport attacks.

Yorkshire Ambulance Service NHS Trust is investigating two employees over suspected attempts to obtain information about William Chapman without a work-related justification. The concern covers both possible viewing of information and attempts to retrieve it. The investigation concerns their handling of confidential information following his death, rather than the emergency response at the park.

Chapman, a 24-year-old former child actor, died after entering an enclosure at the Doncaster attraction containing Altai, an Amur tiger weighing about 200kg. Paramedics and an air ambulance attended, and he was pronounced dead at the scene.

The ambulance trust identified the suspected breaches through routine checks of its information systems. Those audits raised concerns about two instances involving two members of staff. The trust announced on Friday that it was examining what had happened and the conduct of the employees involved.

Chapman's family has been informed about the investigation. The trust has also referred the matter to the Information Commissioner's Office, the UK's information rights regulator. That referral brings the suspected misuse of information to the regulator's attention alongside the ambulance service's own examination of staff conduct.

Speaking on Sky News on Sunday, Cooper said employees suspected of inappropriate access should be suspended during investigations. She said dismissal should follow where breaches were established, making a distinction between the immediate response to a concern and the disciplinary consequence of a finding against an employee.

The background

The Yorkshire investigation comes as another NHS trust has taken disciplinary action against staff who viewed records connected to the Nottingham attacks. At Nottingham University Hospitals NHS Trust, 15 employees have been dismissed during an investigation into access to the victims' medical information.

The trust has also issued 15 final written warnings and two first written warnings. Those figures describe different employment outcomes: dismissal ends employment, while a written warning is a formal disciplinary sanction for someone who remains in their job. The Nottingham investigation has therefore resulted in action short of dismissal as well as sackings.

The staff under investigation in Nottingham have included doctors, nurses, other registered healthcare professionals and employees in other roles. The breadth of that inquiry places the issue beyond any single profession or department: confidentiality obligations apply to everyone whose work gives them access to patient information.

Valdo Calocane killed students Barnaby Webber and Grace O’Malley-Kumar, both 19, and school caretaker Ian Coates, 65, in Nottingham in June 2023. He also attempted to kill three other people. The families of those killed received the latest update on the records investigation during the week.

A separate admission in May concerned records belonging to victims of the Southport knife attack. The NHS trust responsible for Aintree Hospital in Liverpool acknowledged that nearly 50 employees had looked at those records inappropriately. That case involved information about people receiving care after another widely publicised violent incident.

Confidentiality is not simply a restriction on passing information to someone outside the NHS. It also governs whether an employee should open a record in the first place. A member of staff may have the technical ability to retrieve information without having a legitimate reason to examine that particular patient's details.

Healthcare organisations need staff to exchange information for treatment and other authorised work. The relevant distinction is between access required for a person's duties and access driven by personal interest. Public attention surrounding an emergency does not turn the associated clinical or incident records into information that employees may browse freely.

What people are saying

Cooper said interest in a news event or personal curiosity could not justify looking through medical information. She described respect for confidentiality as a basic professional requirement, rather than an optional standard that changes according to how prominent a patient or incident becomes.

She said she had discussed the issue with the NHS chief executive and that they agreed on the need for suspension while inappropriate access was investigated. Her call was also for a faster response across the service, with firmer handling of conduct that fell below those standards.

The health secretary distinguished the employees involved in breaches from the wider workforce. She said the overwhelming majority of NHS staff respected and valued confidentiality. Her criticism was directed at misuse of access, rather than at the routine sharing of information needed to provide patient care.

Yorkshire Ambulance Service expressed sympathy for Chapman's family and said it took the protection of patient information seriously. It pointed to its auditing arrangements as the means by which the concern had been detected, illustrating the role of internal monitoring rather than relying solely on complaints to identify possible misuse.

In the Southport case, Nicola Ryan-Donnelly of Fletcher's Solicitors, which represents many of the injured children, condemned the inappropriate viewing of records as an abuse of staff access and a serious intrusion into privacy. Her criticism focused on the responsibility attached to being entrusted with sensitive information about patients.

What happens next

The ambulance service's inquiry will examine the circumstances of the two suspected incidents and the actions of the employees involved. Establishing whether someone sought information, whether they reached it and whether their duties justified doing so are distinct questions within an investigation of this kind.

An audit can identify activity that warrants scrutiny, but the employment process must consider the circumstances surrounding it. Staff responsibilities matter because legitimate access depends on the work being undertaken, not merely on whether an employee holds an account that allows them into a system.

Cooper's proposed approach has two stages: removing staff from duties through suspension while suspected misconduct is examined, followed by dismissal when a breach is established. Suspension is an interim employment measure, not itself a finding of wrongdoing. Her comments set out the response she wants NHS employers to take.

The referral to the Information Commissioner's Office serves a different purpose from an employer's disciplinary investigation. The regulator oversees information rights and organisations' handling of personal information; an NHS employer considers whether its employees have complied with workplace duties and confidentiality requirements. Those responsibilities can arise from the same incident.

Why this matters

For UK patients, confidentiality makes it possible to discuss health problems and disclose personal circumstances when seeking care. Information supplied for treatment can be particularly sensitive. The boundary on staff access protects that information even when an emergency attracts substantial public interest.

For NHS employees, these cases underline that permission to use a records system is not permission to inspect every record within it. The Yorkshire concern was detected through auditing, while the Nottingham investigation has produced dismissals and warnings: information access is both a monitored activity and a matter of professional accountability.