Urgent NHS probe after unauthorised access to records of three-year-old Noah Woods

An NHS trust has apologised to the family of a three-year-old boy whose medical records were accessed without authorisation, saying the intrusion added to the "extra anguish" they were already enduring. East Suffolk and North Essex NHS Foundation Trust announced on Sunday that it had opened an "urgent" investigation and had reported the matter to the Information Commissioner's Office.

The apology was issued by Dr Martin Mansfield, the trust's deputy chief medical officer, who said that any unauthorised access to patient data was "completely unacceptable". In the same statement, the trust said disciplinary action would be taken if the investigation established that staff had acted improperly, signalling that individuals — rather than only systems — may be under scrutiny.

The case is at the centre of attention because of the circumstances of the child's death. Noah Woods went missing in the village of Brantham, in Suffolk, on 15 September. A major search was mounted, and his body was found the following day in nearby water, recovered by police divers. The trust said it would continue to keep the family informed as its inquiry progresses.

The scale of the response to Noah's disappearance was extraordinary. At least 1,300 people are understood to have taken part in the search in the 24 hours before he was found, a figure that underlines how widely the appeal spread across the local community and beyond.

In a tribute, his family described him as a happy, cheeky and playful boy who loved to laugh. His mother issued a direct appeal to other parents, urging them to hold their children a little tighter and cherish every moment they have together — words that have circulated widely since the news broke.

At an inquest last week, the court heard that the three-year-old had left a play area through a gap in a fence. Assistant coroner Jyoti Gill, opening and then adjourting the hearing in Ipswich, described the death as very sad and tragic. The inquest remains open, meaning formal conclusions about the circumstances will be delivered at a later hearing.

Details of the suspected data breach remain limited. The trust's statement indicates that the concern concerns unauthorised access to patient data, and that immediate steps were taken both to secure the affected records and to block any further access that was not for a legitimate clinical reason. The number of records viewed, the identity of anyone who accessed them, and whether the child's file was targeted deliberately or viewed incidentally are all matters the investigation will need to establish.

The Information Commissioner's Office is the UK's independent data protection regulator. It has the authority to investigate complaints about the handling of personal information, to require organisations to explain what went wrong, and in some circumstances to impose financial penalties. As the body is now investigating, it is likely to scrutinise how the trust controlled access to its record systems and what safeguards were in place around a highly sensitive file belonging to a bereaved child.

Experts in information governance have long warned that the most serious risks to medical confidentiality are not always external attacks, but the behaviour of trusted insiders — staff and contractors who are able to reach records for legitimate reasons and who may browse beyond the purposes for which access was granted. A file connected to a high-profile missing child, and to a family receiving national attention, is precisely the sort of record that raises the risk of curiosity-driven snooping. The trust's promise of disciplinary action appears to be an early indication that it takes that possibility seriously.

For families who have lost a child, the breach carries a weight that is difficult to overstate. Medical records of a three-year-old can hold the most intimate details of a family's life — diagnoses, appointments, and in some cases the circumstances of a death — and bereaved parents often expect them to remain within the closed circle of clinical care. The trust's wording, in apologising for the extra anguish caused, acknowledges that harm which cannot be undone has nonetheless been inflicted.

The trust, which serves communities across Suffolk and north Essex, will now face questions about the wider scope of the incident. Whether other patients were affected, whether any data was copied or retained, and whether existing audit logs were sufficient to identify how the access occurred are all likely to feature in the coming weeks. Police involvement has not been confirmed, and further questions about the family's account of the incident are expected to be raised as the inquiry develops.

For now, attention remains fixed on the family's request for answers, and on a statement that the trust said would be followed by regular updates. Inquest proceedings, the trust's internal investigation and the Information Commissioner's inquiry are likely to progress separately, each adding a different layer of scrutiny to the events.

Anyone affected by child bereavement in the UK can find details of help and support through the BBC Action Line, with further advice and information available through bereavement support services.