NHS trust launches urgent probe after unauthorised access to dead toddler Noah Woods's medical records

An NHS trust has issued an apology to the family of three-year-old Noah Woods over the unauthorised accessing of his medical records, saying the breach caused the family "extra anguish" at an already devastating time. The trust said it had begun an "urgent" investigation into how the records were accessed and by whom.

The disclosure, detailed in a statement issued on Sunday, centres on the case of Noah, who went missing from the village of Brantham in Suffolk on 15 September. A major, community-run search followed, with at least 1,300 people joining the hunt for him in the 24 hours before he was located. Police divers found his body in nearby water the following day.

Speaking for East Suffolk and North Essex NHS Foundation Trust, deputy chief medical officer Dr Martin Mansfield said any unauthorised access to patient data was "completely unacceptable". The trust added that disciplinary action would be taken where necessary — a step that opens the door to internal HR proceedings and, potentially, dismissal for any member of staff found to have breached confidentiality rules.

Dr Mansfield said that immediate steps had also been taken to secure the records involved and to stop any further access that was not for a legitimate, clinical purpose. That distinction is central to the case: the issue is not whether a clinician viewed a file as part of treating a patient, but whether someone looked at the records of a child who had died without a clinical justification.

The trust has also reported the incident to the Information Commissioner's Office, the UK's data protection regulator, and said it would keep Noah's family updated as its internal inquiry progresses. Referral to the ICO does not determine blame — the Commissioner's team assesses whether the circumstances suggest a breach of the UK GDPR and the Data Protection Act 2018 — but it typically triggers its own information-gathering process.

Health information is treated under UK data protection law as "special category" data, carrying a higher level of protection than ordinary personal records because of the harm that misuse can cause. Regulators and NHS organisations have long stressed that although the majority of breaches are accidental — a misaddressed letter, a lost device, a phishing email — the harm to individuals can be severe and lasting even where no data is exploited commercially.

Noah's family described him in a tribute as a "happy, cheeky, playful" boy who loved to laugh. His mother used the family's statement to urge other parents to hold their children closely and to cherish every moment with them. Those remarks came at the end of an inquest the previous week, which heard that the three-year-old had left the play area through a gap in the fence.

Assistant coroner Jyoti Gill, opening and then adjourning the inquest in Ipswich, described the death as very sad and tragic. The hearing was opened and adjourned rather than concluded on the day, leaving outstanding formal questions about registration and the circumstances of his death still to be resolved.

The data breach arrives at a moment when the family is already navigating an open inquest and a period of intense local and national interest. Any unnecessary intrusion into a grieving child's private medical history can compound that distress, which is why the trust's admission of "extra anguish" carries weight beyond the administrative inconvenience of a confidentiality lapse.

The episode also raises broader questions about who can access patient records within a busy trust, and how thoroughly systems record and audit such access. NHS trusts are required to keep confidential patient information secure, and senior leaders have repeatedly warned that breaches often come from trusted insiders or from slips in day-to-day working practices rather than from outside hackers.

For the trust, the immediate test is whether its investigation identifies who viewed Noah's records, and why. The outcome could shape whether the case becomes a disciplinary matter, a safeguarding referral, or a wider failure in information governance. The trust's board will also face scrutiny over how quickly the breach was identified — the fact that the unauthorised access came to light around the time of the inquest suggests it may not have surfaced immediately after his death.

Regulators, meanwhile, are likely to scrutinise the trust's access controls, audit trails and record-keeping practices more broadly, not simply the single file involved. Any enforcement action would follow only after the ICO has completed its own assessment, and both the trust and the Commissioner have previously stressed that the reporting of a serious incident is not itself an admission of fault.

For now, the family has asked only for an explanation and for reassurance that it will not happen again. What Noah's parents will be watching is whether the trust's findings — and any sanctions that follow — arrive quickly, and whether the wider NHS treats his case as an isolated error rather than a warning about how the digital medical record is guarded.