NHS trust launches urgent investigation over data breach involving Noah Woods medical records

An NHS trust has formally apologised to the family of three-year-old Noah Woods for the "extra anguish" caused by a data breach of his medical records, as it launched an urgent investigation into how the confidential information was accessed.

The statement, issued on Sunday by East Suffolk and North Essex NHS Foundation Trust, was made days after an inquest into the child's death was opened and adjourned in Ipswich. Noah went missing from the village of Brantham in Suffolk on 15 September, and his body was found the following day in nearby water by police divers.

Dr Martin Mansfield, the trust's deputy chief medical officer, said unauthorised access of patient data was "completely unacceptable". He added that disciplinary action would be taken if required — a clear signal that the trust is treating the matter as a potential misconduct case as well as a data protection incident.

Noah's case has become one of the most closely followed tragedies in the county. More than 1,300 people joined the search for the boy in the 24 hours before he was found, a response his family later acknowledged with gratitude. Assistant coroner Jyoti Gill told the inquest that the three-year-old had left a play area "through a gap in the fence", and described his death as a "very sad and tragic death" before adjourning the proceedings.

In a tribute, his family described him as a "happy, cheeky, playful" boy who loved to laugh. His mother issued an appeal to other parents to "hold their children a little tighter and cherish every moment" — words that have circulated widely since, and that underlined to a national audience the private grief the family is now carrying in public.

It is against that backdrop that the trust disclosed the breach. Mansfield said: "Immediate steps were also taken to secure the records and prevent further access that was not for a legitimate, clinical reason." He confirmed the matter had been reported to the Information Commissioner's Office, the UK's data protection regulator, and said the trust would keep Noah's family informed as the investigation progresses.

The Information Commissioner's Office routinely investigates concerns raised about how personal information has been handled, and a formal report allows it to examine whether the organisation's controls, policies and staff practices complied with data protection law. Its findings can prompt corrective orders, and in serious cases lead to financial penalties. Whether any sanction follows will depend on the outcome of both the trust's internal inquiry and the regulator's assessment.

Speaking to the substance of Mansfield's remarks, the distinction he drew is an important one. Hospital clinicians routinely access patient records as part of their day-to-day work; that access is lawful and necessary. What the trust said was unacceptable was access that was not for a legitimate clinical reason — in other words, curiosity or intrusion rather than treatment.

Among the questions likely to shape the investigation are how many records were viewed, who accessed them, whether the access could be traced through the trust's audit logs, and whether the incident was isolated or part of a wider pattern. Investigations of this kind typically examine access rights, password and security practices, and whether logging systems can show precisely what was opened, when, and from where.

For the family, the significance of the breach is difficult to overstate. Noah's medical records are among the most intimate documents an individual ever generates, covering his health, his treatment and the circumstances of his death. Learning that such records were viewed by someone outside the clinical team at such a deeply distressing moment has added a further layer of hurt on top of an already profound loss — hence the trust's acknowledgement of "extra anguish".

The timing has sharpened the criticism directed at the trust. The disclosure came immediately after the family had spent a week reliving the loss of their son in court, and after a wave of public attention had focused on the small rural community of Brantham and on a bereaved family still receiving condolences from strangers.

There is also a wider implication. Cases involving access to the records of a dead child attract a degree of scrutiny that routine clinical data incidents rarely receive, and the outcome is likely to be watched closely by other NHS trusts managing similar systems. Any findings that point to weak controls, poor supervision or misuse of privileged access could prompt wider demands for reviews, and regulators and NHS leaders alike will be looking to see whether disciplinary action, if it comes, is swift and visible.

For now, the trust's commitment to keeping the family informed is the measure by which it can begin to rebuild trust, and the family has not been drawn into public comment beyond its earlier tribute. Families who have been affected by the death of a child can find information about support and help through the BBC Action Line.

What happens next depends on the pace of the urgent investigation Mansfield announced, and on what the Information Commissioner's Office decides once it has reviewed the trust's report. But the central commitment is already clear: the trust has conceded that what happened should not have happened, and that someone in a position of trust within its systems accessed a grieving family's most private records for reasons the organisation says were "completely unacceptable".