NHS staff removed in data breach probe involving Noah Woods
East Suffolk and North Essex NHS Foundation Trust says it has launched an "urgent" investigation.
Source: BBC Health · September 27, 2026 at 7:31 PM · AI-assisted report
Single-source
KUALA LUMPUR, 28 SEPTEMBER 2026 —
Ten NHS staff have been removed from duty or suspended following a data breach involving the digital medical records of three-year-old Noah Woods, according to the East Suffolk and North Essex NHS Foundation Trust.
Market Impact
Dr Martin Mansfield, deputy chief medical officer at the trust, stated that an urgent investigation had been launched and described any unauthorised access of patient data as completely unacceptable. The trust has issued an unreserved apology to Noah's family and confirmed that disciplinary action will be taken if required.
The security breach occurred following a major search for Noah in the village of Brantham, Suffolk, after the child went missing on September 15. His body was found the next day in a nearby pond by police divers. At least 1,300 people had helped in the search for Noah in the 24 hours before he was found.
An inquest into his death opened on Friday in Ipswich, where assistant coroner Jyoti Gill stated that the three-year-old had left a play area through a gap in the fence, calling it a very sad and tragic death before adjourning the proceedings.
A spokesperson for the East Suffolk and North Essex NHS Foundation Trust said that 10 employees had been removed from active duty or suspended while investigations are concluded. Dr Mansfield stated in a Sunday statement that immediate steps were taken to secure the records and prevent further access that was not for a legitimate, clinical reason, adding that the matter has been reported to the Information Commissioner's Office (ICO).
He also confirmed that the trust will continue to keep Noah's family informed as the investigation progresses.
Anna Turner, the trust's deputy director of communications, explained that the breaches were discovered through a proactive search initiated because the case was high profile. Turner noted that the trust has taken steps to prevent further unlawful access, stating that they have made it impossible to find Noah's record, which is something they are able to do in this specific case.
On Saturday, the trust wrote to all staff to inform them about the breach and to make it clear that very swift action is being taken. Turner added that all staff are trained on information governance practice with regular reminders, including posters in staff areas.
The incident follows an order from NHS England chief executive Sir Jim Mackey, who wrote to every trust on Friday to mandate stronger measures to tackle data breaches.
Sir Jim stated that they have seen too many cases of people abusing that trust and that enough is enough, warning that anyone who thinks they can satisfy their curiosity by looking at a patient's record will be found out, may lose their career, and could end up with a criminal record.
The ICO stated that it is making enquiries with the East Suffolk and North Essex NHS Foundation Trust, noting that a series of recent high-profile incidents involving unauthorised access to patient records is painting an extremely worrying picture. The ICO stressed that healthcare professionals who knowingly or recklessly access patient data beyond their remit risk their livelihood and professional accreditation, and could face criminal sanctions.
In a tribute issued by his family, Noah was remembered as a happy, cheeky, playful boy who loved to laugh, while his mother urged other parents to hold their children a little tighter and cherish every moment.