NHS trust launches urgent probe after unauthorised access to Noah Woods medical records

An NHS trust has formally apologised to the family of three-year-old Noah Woods for the "extra anguish" they have experienced following a data breach involving the boy's medical records, as it opened an "urgent" internal investigation into how the information was accessed.

The apology came in a statement issued on Sunday by Dr Martin Mansfield, deputy chief medical officer at East Suffolk and North Essex NHS Foundation Trust. In it, he said that any unauthorised access to patient data connected with the case was "completely unacceptable" — language intended to leave little doubt about the trust's view of what happened. The statement added that disciplinary action would be taken if the investigation finds it warranted.

The case centres on records held for Noah, whose death aged three prompted an inquest in Ipswich last week. According to the trust, immediate steps were taken once the breach was identified to secure the records and to prevent any further access that was not for a legitimate, clinical reason — a distinction the trust stressed, since routine access by doctors, nurses and other staff treating a child is entirely expected.

The trust also confirmed that the matter has been reported to the Information Commissioner's Office, the UK regulator responsible for overseeing how personal information and medical data are handled. It said Noah's family would continue to be kept informed as the investigation progresses, signalling that the organisation expects the review to run over a number of weeks rather than conclude immediately.

The circumstances of Noah's death remain at the centre of public attention. A major search was launched in the village of Brantham, Suffolk, after he went missing on 15 September, and his body was found the following day in nearby water by police divers. At least 1,300 people joined the search effort in the 24 hours before he was found — a figure that underscores the scale of the community response to his disappearance.

In a tribute, his family described him as a "happy, cheeky, playful" boy who loved to laugh. His mother issued a message to other parents, urging them to "hold their children a little tighter and cherish every moment" — words that now sit in a markedly different context following the disclosure about his medical records.

At the inquest, the court heard that the three-year-old had left a play area "through a gap in the fence". Assistant coroner Jyoti Gill said it was a "very sad and tragic death" as she opened and adjourned the hearing in Ipswich. The adjournment left outstanding questions about how Noah came to leave the area unanswered, with further sessions expected.

Attention now turns to what the data breach may have involved. Information governance specialists note that investigations of this type typically look not only at the individual records affected but at wider questions: who had legitimate access, how access was logged and reviewed, whether alerts were triggered, and whether password-sharing, weak authentication or excessive permissions played a role. Where records are accessed for reasons unrelated to care, the concern is not only about privacy but about the distress caused to bereaved families already dealing with profound loss.

The referral to the Information Commissioner's Office is significant. The ICO can require organisations to explain what happened, order changes to systems and processes, and in some circumstances impose penalties, particularly where investigators find that protections were inadequate or that a breach was reported too slowly. The trust's public statement that it has already secured the records and notified the regulator is intended to demonstrate both speed and cooperation.

Data breaches in the health service attract particular scrutiny because medical records contain some of the most intimate information a person holds, and because patients have little ability to choose whether or not their data is shared once they are in the system. Security experts say a common thread in insider-threat cases is the use of valid staff credentials by someone whose access is not properly checked against the specific record being viewed — the sort of question the trust's investigation is expected to answer.

There are also wider implications for trusts across the country. Cases of this kind tend to prompt fresh scrutiny of who can browse patient records without a clinical need, how quickly suspicious activity is detected, and whether staff are given regular training on their obligations of confidentiality. Regulators and watchdogs have repeatedly argued that high volumes of access to individual patient records are one of the clearest indicators of a security or governance failure.

Noah's case adds another element: the records of a child who died. Parents have previously raised concerns that bereaved families can be targeted, sometimes by people seeking to make contact or by those with a harmful interest, which makes controls on access especially sensitive. The trust's own wording — that access "not for a legitimate, clinical reason" would be prevented — suggests it believes the breach falls into that category, rather than being a routine administrative mix-up.

Timeline-wise, the disclosure comes just days after the inquest opened and adjourned, and around a fortnight after the search that ended with the recovery of Noah's body by divers. That timing has placed the family back in the public eye at one of the most difficult moments of their bereavement, and the trust's apology makes explicit its recognition of the burden that carries.

For now, the outstanding questions centre on the findings of the urgent investigation, whether the Information Commissioner's Office opens its own assessment, and whether any individuals are disciplined. The trust said it will keep the family updated as that work continues, while Noah's relatives continue to receive the tributes that followed his death — including the appeal to other parents to cherish every moment with their children.

For anyone affected by child bereavement, support and information about available help in the UK remain accessible through BBC Action Line, which signposts a range of bereavement support services for families.