Key Points
- Two Liverpool Heart and Chest NHS Foundation Trust employees have been placed on suspension in a provisional move pending investigations into the possible misuse of Southport attack victims’ medical data.
- According to the hospital’s statement, both cases were detected during an audit, although the identity of the employees involved and the patients whose data may have been improperly accessed remain undisclosed.
- The people who may have had their records accessed have been notified about the ongoing investigation.
- The case has been forwarded for review to the Information Commissioner’s Office and the Care Quality Commission.
- The story was first told by the Health Service Journal, and then it appeared in The Liverpool Echo and Sky News.
- Manoj Kuduvalli, medical director of Liverpool Heart and Chest Hospital, apologized for the situation saying that such an action was “a serious breach of trust.”
- This incident came in the wake of a breach at Aintree Hospital, where close to 50 staff members had improperly accessed the records of the Southport attack victims.
Liverpool (Liverpool standard) October 29, 2026 – Two members of staff at Liverpool Heart and Chest Hospital have been suspended while the trust investigates whether they accessed the medical records of victims of the 2024 Southport attack without a legitimate reason.
As reported by the Liverpool Echo, Liverpool Heart and Chest NHS Foundation Trust confirmed that it is investigating “two potential instances of inappropriate access” connected to the Southport stabbings in July 2024. The hospital, based at Broadgreen Hospital, said the cases were detected as part of an audit.
In a statement quoted by the Liverpool Echo, the trust said: “Two members of staff have been placed on precautionary suspension whilst an investigation is concluded.”
The trust has not disclosed the roles held by the suspended employees, the dates of the alleged access, or the identities of the patients whose records may have been viewed. It has also not said whether the alleged access was connected to treatment at Liverpool Heart and Chest Hospital or to records held elsewhere.
What Has the Hospital Said?
The trust said those affected have been contacted and informed that an investigation is under way. It added that the matter has been passed to the Information Commissioner’s Office, the UK’s data protection regulator, and the Care Quality Commission, which regulates health and social care services in England.
Manoj Kuduvalli, medical director for Liverpool Heart and Chest Hospital, said the trust was “deeply sorry that this has happened”.
As reported by the Liverpool Echo, Mr Kuduvalli said:
“Our patients trust us with their most personal information at some of the most vulnerable moments in their lives, and any inappropriate access to those records is a serious violation of that trust.”
He added that staff had been told that patient records “must only ever be accessed for legitimate reasons connected to their role and the patients’ care”.
“We will not accept behaviour that compromises patient confidentiality or undermines the trust our patients place in us,” Mr Kuduvalli said. “We have spoken to those that are affected and will keep them informed as our investigation continues.”
Why Were the Staff Suspended?
The suspensions are precautionary rather than a finding of misconduct. The trust says it is investigating whether the two staff members viewed Southport victims’ records without a legitimate reason; no conclusions have been published about whether any breach occurred or who was responsible.
The alleged concerns were identified through an audit. The trust has not said when the audit took place, what triggered it, or whether further staff are under review.
The Health Service Journal first reported the investigation, describing Liverpool Heart and Chest as “a second hospital in Liverpool” to suspend staff over alleged inappropriate access to Southport victims’ records. Sky News subsequently reported that the hospital was carrying out an investigation after the cases were detected.
How Does This Relate to the Earlier Aintree Breach?
The new investigation is separate from, but follows, a previously confirmed data breach at Aintree Hospital. In May 2026, NHS University Hospitals of Liverpool Group said that nearly 50 staff members had looked inappropriately at the medical records of Southport victims.
As reported by the BBC, the earlier breach occurred at Aintree Hospital, where some of those injured in the attack were treated, in the days after the July 2024 attack. The trust described the breach as “inexcusable” and said changes had been made, although no one was dismissed.
The Liverpool Echo reported that three patients were affected in that earlier case, including a 13-year-old girl who helped supervise the dance class and adult teacher Leanne Lucas. The breach was understood to have emerged through a standard information-access audit carried out by the trust shortly after the attack.
The Liverpool Echo also reported that an internal trust review identified 64 suspicious access cases. Four staff members resigned before the investigation, while 12 of the remaining 60 were found to have legitimate reasons for accessing records; the other 48 faced disciplinary measures ranging from informal counselling to a final written warning.
What Happened in Southport?
The medical records investigation relates to victims of the Southport knife attack of July 2024. Axel Rudakubana murdered three young girls — Bebe King, aged six; Elsie Dot Stancombe, aged seven; and Alice da Silva Aguiar, aged nine — during an attack at a Taylor Swift-themed dance class in Southport.
The Liverpool Echo reported that Rudakubana also attempted to kill 10 others, including eight children. He was jailed for life with a minimum term of 52 years.
The latest development concerns the handling of confidential medical information after the attack, rather than the attack itself or the criminal proceedings against Rudakubana.
What Happens Next?
The investigation by Liverpool Heart and Chest NHS Foundation Trust remains ongoing. The trust has said it will keep those affected informed as the inquiry continues.
Referrals to the ICO and CQC mean the regulators may assess whether data-protection or regulatory standards were breached. The trust has not announced a timetable for completing the investigation or said what disciplinary action could follow if concerns are substantiated.
Background of the Development
The Southport attack took place on 29 July 2024, when three girls were killed and others were injured at a dance class in the Merseyside town. Some victims received treatment at hospitals within the University Hospitals of Liverpool Group, including Aintree Hospital.
In May 2026, the University Hospitals of Liverpool Group confirmed that nearly 50 employees had inappropriately accessed victims’ medical records. The trust said disciplinary outcomes ranged from informal counselling to final written warnings, and that no staff member was dismissed.
The latest case involves Liverpool Heart and Chest NHS Foundation Trust, a separate NHS foundation trust based at Broadgreen Hospital. The trust says it identified two potential instances of inappropriate access during an audit and has suspended two employees while it investigates.
The development also comes amid wider national attention to NHS “snooping” cases. In September 2026, NHS England announced that staff suspected of accessing patient records without valid reason should be suspended immediately and locked out of NHS computer systems while investigations proceed.
Prediction: How This Could Affect Patients and NHS Staff
For Southport victims, survivors and their families, the investigation may increase concern about who can view sensitive medical information and whether hospitals are consistently preventing unauthorised access. The fact that affected people have been contacted may provide some reassurance, but the outstanding uncertainty over the staff roles and patients involved is likely to keep attention on the trust’s investigation.
For patients in Liverpool and across the NHS, the case may reinforce expectations that record access is monitored, audited and restricted to staff with a genuine care-related reason. If the investigation confirms inappropriate access, it could lead to disciplinary action, regulatory scrutiny and further changes to access controls.
For NHS staff, the development is likely to add to pressure to follow record-access rules strictly. The national policy direction already expects immediate suspension and removal of system access for staff suspected of improper record access, meaning employees should expect closer auditing and swifter action where concerns arise.
