NHS trust issues public apology to Nottingham attack victims over medical data breaches

The medical director of an NHS trust has issued a public apology over "failures" at an inquiry after staff inappropriately accessed the medical records of the Nottingham attacks victims.

Nottingham University Hospitals (NUH) NHS Trust is investigating employees over data breaches in the aftermath of attacks carried out by Valdo Calocane, who killed three and seriously injured three others on 13 June 2023.

NUH medical director Manjeet Shehmar also apologised for "not considering" the surviving victims in initial investigations and vowed that the trust would "continue to learn".

Calocane - who was diagnosed with paranoid schizophrenia in 2020 - stabbed to death Barnaby Webber, Grace O'Malley-Kumar and Ian Coates.

He then stole Ian's van and used it to strike pedestrians Wayne Birkett, Sharon Miller and Marcin Gawronski, who were left with serious and life-changing injuries.

Shehmar became the strategic commander of the investigations, which remain ongoing, the inquiry heard.

On Wednesday the inquiry was told that of the 11 NUH staff members sacked, four were nurses, one was classed as an "other registered professional", with six "other staff" dismissed.

It was also revealed four doctors, five nurses, one "other registered professional" and two "other staff" members received final written warnings.

None of the medical professionals who inappropriately accessed the records came forward to the trust to admit it before it was discovered, the inquiry heard.

Addressing the families during her evidence, Shehmar said: "I acknowledge that there have been failures and we will work towards putting them right.

"I cannot change what has happened, but what I can do is formally apologise to you because we have caused additional distress to you.

"You have already had to endure unimaginable pain and suffering, and I know that the actions of some of our staff have added to that distress, and continue to add to that distress.

"I want to reaffirm our commitment to work with you for the duration of these investigations and engage with you, and I would also like to give the commitment that we will continue to learn, we will continue to improve."

Initially, the trust only looked into inappropriate access of the deceased victims' records, rather than all of the victims.

It was not until the solicitor of survivors Wayne and Sharon contacted the trust in March 2025, that NUH considered them, the inquiry was told.

Questioned on why, Shehmar said the trust's "focus" at the time was "very much on the deceased victims".

She added: "The second point to mention that myself as strategic commander - if I'm completely honest with you... I'm not from Nottingham.

"What I knew about this matter was really what I knew in the media and what I had read about previously in 2023 and with the media at that point.

"It had not come to my attention and at that point, I had not really considered the surviving victims."

Shehmar said she did not have the "in-depth context" to be able to ask for further information from others in the strategic group, who she said were "closer to the detail".

The executive medical director admitted she was not aware there were any surviving victims, but that if she had "sat and thought about it, [she] probably would have remembered".

Shehmar told the inquiry: "I apologise that we did not consider them from the beginning."

Shehmar also admitted NUH would not have been aware of the data breaches in relation to the Nottingham attacks - had the bereaved families not helped to bring it to the trust's attention.

The inquiry was told the trust was contacted by Nottinghamshire Healthcare NHS Foundation Trust - which was responsible for Calocane's care - regarding data breaches, which was then passed on to NUH, in October 2024.

Tim Moloney KC, representing the bereaved families, said they were "instrumental" in ensuring the audit of the data breaches happened.

He said: "And but for that audit, let's face it, you'd have been none the wiser of the systemic failings that you've spoken about today, and the failings of your campaigns in relation to education, in relation to access to data.

"You wouldn't know all this would you?"

Shehmar admitted the trust "would not have known about this matter" but said the trust was aware data breaches were happening.

The inquiry heard the trust had been running communication campaigns warning staff against inappropriate data access for several years before its investigations.

NUH had also failed to contact Ian's partner of 25 years, Elaine Newton, in relation to the breaches, the inquiry heard.

Shehmar said the trust sought advice on who should be contacted in Ian's family, and was told his three sons James, Lee and Darren should be.

NUH had discussed seeking advice on whether Elaine should be contacted.

Moloney asked: "You didn't ultimately contact Ms Newton. Do you know what Elaine Newton does for a living?"

Shehmar replied: "I don't."

Moloney asked: "Do you know where she works?"

Shehmar replied: "I don't."

Moloney said: "She works at the City Hospital in Nottingham. Which trust essentially controls the City Hospital in Nottingham?"

Shehmar replied: "We do."

"She actually works for your trust," Moloney said.

"As the strategic commander, are you not appalled that a woman whose partner was horribly killed and members of your staff accessed her records, who actually works for your organisation, has not had an apology from you, her employer?"

Shehmar said it was "distressing to hear".

The survivors, their families and the bereaved families are still awaiting further details about the data breaches - what was viewed, by whom and why, the inquiry heard.