Urgent NHS probe after unauthorised access to records of three-year-old Noah Woods

An NHS trust has apologised to the family of three-year-old Noah Woods for what it describes as the "extra anguish" caused by a data breach of his medical records, as it launched an urgent internal investigation into how the confidential files were accessed.

Dr Martin Mansfield, deputy chief medical officer at East Suffolk and North Essex NHS Foundation Trust, said unauthorised access to patient data was "completely unacceptable". The trust added that disciplinary action will be pursued where necessary, signalling that staff conduct is among the lines of enquiry being examined by the organisation.

The scale of public interest in the case is unprecedented for a data protection incident. Noah's death in Suffolk last September prompted extensive national coverage, thousands of tributes and a lengthy inquest, which made the disclosure of his medical history a particularly sensitive matter. Speaking through a statement issued on Sunday, the trust said immediate steps had been taken to secure the records and to stop any further access that had not been for a legitimate clinical reason.

Three-year-old Noah Woods went missing from the village of Brantham on 15 September, prompting a major search operation. His body was found the following day in nearby water by police divers. At least 1,300 people are reported to have joined the search during the 24 hours before he was found, a figure that underlines the scale of the community response to his disappearance.

In a tribute, his family described him as a "happy, cheeky, playful" boy who loved to laugh. His mother asked other parents to hold their children a little tighter and to cherish every moment with them, a message that resonated widely as the story moved beyond Suffolk and prompted an outpouring of sympathy across the country.

An inquest last week was told that Noah had left a play area through a gap in a fence. Assistant coroner Jyoti Gill described his death as "very sad and tragic" as she opened and adjourned the hearing in Ipswich. The inquest was formally concluded, but the trust's statement indicates that formal scrutiny of his case continues in a different form.

The trust confirmed it has reported the matter to the Information Commissioner's Office, the independent regulator responsible for enforcing data protection law in the UK. That reporting means the incident will be assessed separately from the trust's own internal review, and the ICO has the power to compel the disclosure of further information, order remedial changes and, in serious cases, bring enforcement action.

Medical records occupy a particularly protected place in the health service's information systems. Alongside routine clinical details, they can contain test results, diagnoses, correspondence between clinicians and, in some cases, entries recording a patient's death and the circumstances surrounding it. Access is supposed to be limited to staff with a direct care relationship with the patient, and the trust's own statement frames any view outside that boundary as illegitimate.

For the Woods family, the consequences go beyond a technical privacy failure. Confidential information about a child who died in widely reported circumstances can be sensitive in ways that extend well beyond data protection rules, particularly for surviving relatives who are still living in the community where the death occurred. The trust's apology acknowledged that dimension directly by referring to the additional distress inflicted on the family.

The incident also raises broader questions about how NHS trusts police access to records, including whether routine monitoring of logins is sufficient, whether departing or temporary staff retain valid credentials, and whether staff are told clearly enough about the circumstances in which a look at a patient's file is appropriate. Investigators will be expected to address not only who accessed the records and why, but how the trust's systems either enabled or failed to prevent it.

Attention will also focus on whether the trust's response has been fast enough and broad enough. A trust that identifies unauthorised access in a single case may face questions about whether the same flaw allowed viewing of other patients' data, and whether any wider notification is owed to families whose records were also touched. The trust said it would continue to update Noah's family as its investigation progresses.

Support is available for anyone affected by the death of a child, with the BBC's Action Line signposting bereavement help and advice across the UK.