Ten NHS staff taken off duty over Noah Woods records breach

What happened

Ten employees at East Suffolk and North Essex NHS Foundation Trust have been taken off active duties, including through suspension, while the organisation investigates improper access to Noah Woods’ electronic medical records. The three-year-old disappeared from a Suffolk playground on 15 September and was found dead the following day.

The trust issued an apology to his family on Sunday. Its deputy chief medical officer, Dr Martin Mansfield, acknowledged that the breach had added to their distress as they grieved for their son, and said the organisation had begun an urgent internal investigation.

The access was discovered during checks initiated by the trust because Noah’s case had attracted widespread attention. Anna Turner, its deputy director of communications, explained that the organisation had actively examined access to the records rather than waiting for a complaint to trigger action.

The trust then restricted access to Noah’s records to protect them against further improper viewing. Turner said additional controls had made his record impossible to find, a measure the organisation was able to introduce in the particular circumstances of his case.

The Information Commissioner’s Office, the UK’s data protection regulator, has been notified. The trust is considering disciplinary measures as part of its response, with decisions about individual employees to follow the investigation.

On Saturday, the organisation contacted its entire workforce about the breach and the action it was taking. Turner said employees receive information governance training, supported by recurring reminders and posters displayed in staff areas. That training covers the responsibilities staff have when handling patient information.

The background

Noah had been visiting an under-fives play area on Merriam Close in Brantham while relatives were caring for him. Detective Chief Inspector Matthew Connick told the inquest into his death that the visit formed part of the child’s usual routine.

CCTV captured Noah with a relative at the playground, with the earliest footage timed at 2.13pm. The final recording of him playing was at 2.37pm. Connick explained that the camera responded to movement, meaning it did not produce an uninterrupted account of everything that happened at the park.

The inquest heard that Noah passed through an opening in the fence into a memorial garden, then went through a gate that was open. His relative called for him to stop as he ran away from the play area.

He continued along a track beside a newly built housing estate, heading towards water known locally as Decoy Pond. The relative followed closely but was trying to keep pace with him as he moved along the route.

At one point, Noah turned towards steps leading into the housing estate. After the relative called to him, he returned to the track. He subsequently approached another access point towards the homes before continuing in the direction of the pond when called again.

A bend in the route took him out of the relative’s sight. By the time the relative reached the bottom of the track, roughly 200 yards from the playground, Noah was no longer visible. The relative has given police a statement about what happened.

A member of the public helped the relative look for Noah straight away, but they could not find him. Police were alerted, beginning a much wider operation involving firefighters, coastguards, helicopters and search dogs.

At least 1,300 members of the public helped with the search during the 24 hours before Noah was found. Specialist divers from the Metropolitan Police Underwater and Confined Space Unit also joined the operation in the village.

Divers recovered Noah’s body from Decoy Pond on the afternoon of 16 September. The inquest heard that he was found among underwater tree roots, about five metres from the edge. Suffolk Police said they were not treating his death as suspicious.

What people are saying

Mansfield condemned staff access to patient information when there was no proper authorisation. He said the trust had acted as soon as concerns arose about Noah’s records and stressed that the measures introduced were intended to prevent viewing without a valid clinical purpose.

The case comes amid a wider intervention by Sir Jim Mackey, chief executive of NHS England. On Friday, he wrote to every NHS trust demanding tougher action against inappropriate access to patients’ information and warning staff against using clinical systems to satisfy personal curiosity.

Mackey said employees found looking at records without authorisation would face immediate suspension. He also warned that such conduct could cost them their careers and lead to a criminal record, underlining that access to NHS computer systems does not confer permission to examine any patient’s file.

Previous incidents have involved staff viewing records connected with the 2023 Nottingham attacks and the 2024 knife attack at a children’s dance class in Southport. Those cases form part of the wider concern about the handling of confidential information when patients become the focus of public attention.

Noah’s family have asked that memories of his life remain central. In a statement after the opening of the inquest, they described a child who enjoyed laughter and play and whose presence brought happiness to those around him. He lived with his parents and younger brother.

His father, Rhys Woods, posted a tribute in a community Facebook group, remembering his son’s affectionate nature and expressing the depth of the family’s loss. Noah’s mother urged parents to value their time with their children and show them affection.

What happens next

The trust has committed to updating Noah’s family as its inquiry proceeds. The employment measures already imposed apply while that work is completed; removal from duties or suspension is distinct from a final disciplinary decision.

Any disciplinary response will depend on the findings concerning staff conduct. The trust has said it will take such action where warranted, rather than treating the current restrictions on the ten employees as the conclusion of the process.

Separately, the inquest into Noah’s death has been opened and adjourned in Ipswich. Assistant coroner Jyoti Gill conducted Friday’s hearing, where the account of his disappearance and the discovery of his body was set out.

An inquest examines the circumstances of a death rather than determining criminal guilt. It is a separate process from the trust’s investigation into access to medical information, which concerns the handling of Noah’s records by employees.

Why this matters

For NHS patients and families, confidentiality depends on more than keeping information outside public view. It also requires limits on who can consult records within a healthcare organisation: being employed by a trust does not, by itself, justify opening a particular patient’s file.

For staff, the national warning makes the potential consequences explicit, extending beyond workplace discipline to possible criminal proceedings. For families facing bereavement, the breach involving Noah demonstrates how the handling of medical information can become an additional source of distress alongside the loss itself.