Ten staff at the trust that runs Ipswich, Felixstowe and Aldeburgh hospitals are off duty after Noah Woods' records were viewed. What patients can do.

Ten people working for East Suffolk and North Essex NHS Foundation Trust (ESNEFT) have been removed from duty or suspended. The trust is investigating concerns that the medical records of three-year-old Noah Woods were viewed without a clinical reason.

ESNEFT runs Ipswich Hospital and Colchester Hospital. It also runs the community hospitals at Felixstowe and Aldeburgh, so it holds the hospital records of many people on the Suffolk coast.

What the trust has said

The trust published a statement on its website on Saturday night. It came from Dr Martin Mansfield, the deputy chief medical officer. He is also the trust’s Caldicott Guardian, the senior person responsible for how patient information is used.

He said: “Any unauthorised access of patient data is completely unacceptable.”

The statement says the trust:

  • has apologised “unreservedly” to Noah’s family “for the extra anguish this breach of trust has caused them at an already devastating time”
  • launched an urgent internal investigation as soon as it learned of the concerns
  • secured the records to stop any further access “that was not for a legitimate, clinical reason”
  • has reported the matter to the Information Commissioner’s Office (ICO)
  • will take disciplinary action “where needed”, in line with its own policies

The figure of ten staff is not in the published statement. A trust spokesperson gave it to the BBC and to the PA news agency, whose report carries it as ten people removed from direct active duty or suspended pending further investigation. The trust has not said what jobs the ten do or which of its sites they work at.

Who Noah was

Noah was reported missing on the afternoon of Tuesday 15 September in Brantham. The village is in Babergh district, about 12 miles west of Felixstowe. He had become separated from a relative after visiting the playground in Merriam Close, Suffolk Police said.

About 1,300 members of the public joined police, the coastguard, the fire service and volunteer search teams. The Metropolitan Police Dive Team recovered his body from Decoy Pond in Brantham on Wednesday 16 September.

His family described him as “a happy, cheeky, playful three-year-old boy who loved to laugh”.

The national order that came first

The breach came to light in the same week NHS England tightened the rules. On Thursday 25 September its chief executive, Sir Jim Mackey, wrote to every trust telling them to act at once when staff are suspected of looking at records without a proper reason.

Under the new approach:

  • staff suspected of snooping are suspended while the incident is investigated
  • their access to NHS computer systems is paused straight away
  • a registered professional dismissed for it is referred to their regulator, which can stop them practising

“Anyone who thinks they can satisfy their curiosity by looking at a patient’s record should know this: they will be found out, they may lose their career, and could end up with a criminal record,” Sir Jim said.

NHS England says systems keep a record of who opened a patient’s information and when. That audit trail is how unusual access is found.

What it means for you

If you are treated at Ipswich, Felixstowe or Aldeburgh hospitals, your records sit with the same trust. Every access to them leaves a trace.

  • You can ask what the trust holds about you. ESNEFT’s data rights page sets out your right to request access to your personal data, and evidence that it is handled within the law.
  • You can complain to the regulator. If you think your own records were viewed without reason and the trust’s answer does not satisfy you, the ICO takes complaints about how organisations handle personal information.
  • Look after yourself. If Noah’s death has affected you, your GP or NHS 111 can point you to support.

We will update this page when the trust’s investigation or the ICO reports.