Urgent probe after NHS trust admits unauthorised access to Noah Woods medical records

An NHS trust has apologised to the family of three-year-old Noah Woods for what it calls the "extra anguish" caused by a data breach of his medical records, as it launches an urgent investigation into how patient information was accessed without authorisation.

The admission from East Suffolk and North Essex NHS Foundation Trust comes just days after an inquest into Noah's death, and it has widened a story that has already prompted an outpouring of grief across Suffolk. In a statement issued on Sunday, deputy chief medical officer Dr Martin Mansfield said any unauthorised access to patient data was "completely unacceptable", and confirmed the trust had begun an "urgent" investigation. The trust added that disciplinary action would be taken if required.

Noah's medical records are held by the trust, which covers hospitals and community services in east Suffolk and north Essex. According to the statement, immediate steps were taken to secure the records and to prevent any further access that was not for a legitimate clinical reason. The trust said it had reported the matter to the Information Commissioner's Office — the UK's data protection regulator — and that it would keep Noah's family informed as its investigation progresses.

The circumstances of the breach have not yet been set out publicly. The statement, as reported, does not detail when the unauthorised access occurred, how many individual records were involved, how many people may have viewed Noah's file, or whether the access was by an individual member of staff or the result of a wider system failure. Nor has the trust indicated whether the case will be referred to the police. Those questions are likely to be central to both the internal inquiry and any assessment by the Information Commissioner.

The issue is unusually sensitive because Noah was a child. A young patient's file can contain details of a diagnosis, medication, treatment plans and family history, alongside an identity — information that, in the wrong hands, could be used for fraud or harassment. His death has also made the confidentiality of those records more delicate, since records about a deceased three-year-old have little or no continuing clinical purpose, making any non-clinical viewing harder to justify.

Dr Mansfield's remarks focused on that principle: access to patient data is only acceptable where there is a legitimate clinical reason for it. Sector-wide concern about the security of medical records has centred in recent years on how staff logins are used, whether credentials are ever shared, and how quickly suspicious activity is identified and reported. Unauthorised access cases are notoriously difficult to detect, which is why regulators typically place emphasis on audit trails and the speed with which organisations themselves escalate an incident.

The Information Commissioner's Office can require an organisation to investigate further, order changes to how data is handled, and ultimately act against a controller that has failed to protect personal information or to report a breach properly. A trust that identifies a problem itself, secures the affected records and notifies the regulator is generally viewed as behaving as expected, but that does not end the regulator's interest in what happened.

Noah went missing on 15 September during a major search in the village of Brantham, Suffolk. His body was found the following day in nearby water by police divers. At least 1,300 people joined the search in the 24 hours before he was found, a response his family acknowledged in a tribute describing him as a "happy, cheeky, playful" boy who loved to laugh. His mother urged other parents to "hold their children a little tighter and cherish every moment".

An inquest held last week in Ipswich heard that Noah had left a play area through a gap in the fence. Assistant coroner Jyoti Gill said it was a "very sad and tragic death" as she opened and adjourned the hearing.

The trust's apology therefore lands at the end of a week in which his family have already had to attend an inquest, read tributes and field a large volume of public and media interest. For relatives now entering a period of long-term bereavement, the trust's acknowledgement that a confidentiality failure added to their distress may be significant, even as they await answers about how a child's records came to be accessed.

What happens next is likely to be shaped by the trust's internal investigation. If it finds that individuals were responsible, disciplinary proceedings could follow; if it identifies wider failures in access controls or monitoring, the findings are likely to prompt changes across the organisation and, potentially, scrutiny from the regulator.

For families more broadly, the episode raises uncomfortable questions about the guarantees of medical confidentiality after a death — including who is permitted to view a child's record, why, and how quickly breaches are detected and disclosed.

Support for anyone affected by child bereavement in the UK is available through the BBC Action Line.