Ten employees at East Suffolk and North Essex NHS Foundation Trust (ESNEFT) have been removed from active duty or suspended following an urgent investigation into a data breach involving the medical records of a deceased toddler.
The internal inquiry was launched after it was discovered that the records of three-year-old Noah Woods had been accessed without authorisation. Noah was found dead at Decoy Pond in Brantham, Suffolk, on 16 September 2026, a day after he was reported missing.
Dr Martin Mansfield, the Trust’s Deputy Chief Medical Officer and Caldicott Guardian, issued an unreserved apology to Noah’s family.
The incident has been formally referred to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data privacy. The Trust is currently exploring disciplinary action against the ten staff members involved. The specific roles of the employees—whether clinical or administrative—have not been disclosed.
The breach occurred during a period of leadership transition for the Trust. Paul Scott took over as Chief Executive in August 2026, succeeding Nick Hulme. Information regarding the current ESNEFT executive board and its governance structure is maintained by the Trust as part of its transparency commitments.
The unauthorised access follows recent national warnings from NHS England regarding “snooping” on patient records. Health officials have repeatedly reminded staff that accessing medical files without a direct clinical or administrative requirement is a breach of both NHS policy and the Data Protection Act.
Patients who have concerns regarding the privacy of their own medical data or how records are handled within the Trust are advised to contact the Patient Advice and Liaison Service (PALS). Further guidance on data rights and how to report a breach can also be found through the Information Commissioner’s Office.
