Urgent probe over access to Noah Woods medical records as NHS trust apologises to family

An NHS trust has formally apologised to the family of three-year-old Noah Woods for the "extra anguish" caused by a data breach of his medical records, as it launches an urgent investigation into how the child's information was accessed.

Dr Martin Mansfield, deputy chief medical officer at East Suffolk and North Essex NHS Foundation Trust, said in a statement issued on Sunday that any unauthorised access to patient data was "completely unacceptable". The trust confirmed it has begun an "urgent" investigation and said disciplinary action would be taken if needed.

The apology comes less than a week after an inquest into Noah's death, and follows days of intense public attention on the case. It is the latest twist in a story that has moved from a large-scale missing child search to an inquest and now to a data protection investigation.

Noah, who has been described by his family as a "happy, cheeky, playful" boy who loved to laugh, went missing in the village of Brantham in Suffolk on 15 September. His body was found the following day in nearby water by police divers. At least 1,300 people joined the search for him in the 24 hours before he was found.

In a tribute, his family said his mother had urged other parents to "hold their children a little tighter and cherish every moment" — words that have echoed widely since the case first broke.

The trust's statement said that immediate steps had been taken to secure the records and to prevent further access that was "not for a legitimate, clinical reason" — language that indicates the concern is not about routine medical use of Noah's file by staff treating him, but about viewing by someone with no clinical justification.

Details of the breach have not been made public. The statement does not set out who accessed the records, when the access occurred, how many individuals were involved, or whether records relating to other patients were also affected. The trust said it would continue to keep Noah's family informed as its investigation progresses.

The matter has been reported to the Information Commissioner's Office, the independent data protection regulator. Referrals of this kind allow an external body to examine how a breach happened, how the organisation responded, and what risk individuals' rights and freedoms were exposed to. Serious cases can lead to enforcement action, orders requiring changes in systems, or referral for criminal prosecution, although the outcome of any regulatory process typically takes time.

The trust said disciplinary action would be taken if required — a commitment that separates internal HR or professional discipline from the regulatory investigation, meaning staff could face consequences from the trust even if the eventual regulatory findings fall short of enforcement.

The data breach investigation follows an inquest last week, which heard that Noah had left a play area "through a gap in the fence". Assistant coroner Jyoti Gill said it was a "very sad and tragic death" as she opened and adjourned the inquest in Ipswich.

The timing of the trust's apology is significant. It arrived days after the inquest and after sustained national coverage of the family's grief, meaning the family's distress was renewed at a moment when they had hoped to be able to move forward. The trust's words — an apology for "extra anguish" — acknowledge that a breach of a bereaved child's private medical information adds a further layer of hurt on top of the loss itself.

Health records are among the most sensitive categories of personal data, and their protection continues after a patient dies. Information about a child's medical history, treatment and death is not something a family would expect to be viewed without a clinical purpose, and a breach of that kind can feel like an intrusion into the most private part of a family's experience.

For the wider case, attention now turns to what the investigation finds and whether the trust can explain — and demonstrate — how unauthorised viewing happened in the first place. The trust has not said whether the investigation will examine access by individual staff members, system permissions, or both, nor how long the process is expected to take.

The story has also drawn attention to the scale of the community response. More than 1,300 people searching for Noah within a day, alongside the family's tribute, became one of the most widely shared accounts of grief and community solidarity in the case — and the data breach now risks adding a very different kind of chapter to it.

For families in similar circumstances, the BBC has compiled information and support resources on child bereavement, available through BBC Action Line.

What happens next will be shaped by three things: the trust's internal investigation and any disciplinary steps, the Information Commissioner's assessment, and whether the family receives a fuller account of how its son's records were accessed. For now, the trust's written words stand: the unauthorised access was unacceptable, the records have been secured, and the family will be kept informed.