Nearly 50 NHS Staff Improperly Accessed Southport Attack Victims' Records

A hospital trust admitted that nearly 50 staff members inappropriately accessed the medical records of victims from the Southport knife attack.

The breach occurred at Aintree Hospital in Liverpool, where some injured people received treatment, in the days after the July 2024 attack. It came to light this week.

The BBC learned that the three affected patients included a 13-year-old girl who helped supervise the Taylor Swift-themed dance class targeted in the attack, and adult teacher Leanne Lucas.

The NHS University Hospitals of Liverpool Group, which operates Aintree, called the breach inexcusable. The trust made changes, but no staff lost their jobs.

Lucas suffered five stab wounds in the attack, which killed three young girls and seriously injured eight children and another adult.

"I am absolutely devastated and horrified that my privacy has been invaded when I was at my most vulnerable," she said. "Nothing will take away my gratitude to the staff who saved my life, but 48 people not involved in my care abused their position of trust to access the files of victims who have suffered unspeakable trauma."

The breach surfaced during a standard information access audit the trust conducted shortly after the attack.

Nicola Ryan-Donnelly of Fletcher's Solicitors, which represents the teenage patient, said: "This is a deeply disturbing abuse of power and a shocking breach of privacy into the care of several Southport victims, including a young girl. Our client, who is now growing into a young woman, is old enough to properly understand what this means: that staff opened her records, not to aid her recovery but to pry."

James Sumner, chief executive of the NHS University Hospitals of Liverpool Group, said the trust was sincerely sorry for any distress caused to the patients. Staff who accessed the records faced disciplinary measures from informal counseling to final written warnings. None were dismissed.

Lucas said: "The decision to keep this from me for almost two years is a new low. I am speaking out as I want this scandal and the attempted cover-up by senior management exposed for what it is."

She told the BBC that the hospital's chief nurse informed her of the breach on Thursday. Lucas believes the revelation came only after a Health Service Journal reporter contacted the hospital.

"I'm also angry that the Information Commissioner's Office was told about it in August 2024, and I've only been told now because I was about to read about it in a paper," she added.

The trust denied any cover-up. Sumner said clinical advice guided the choice not to notify patients, given the potential psychological impact at the time. The trust contacted relevant regulators and professional bodies.

The Information Commissioner's Office stated it did not plan a criminal investigation at this time but continues to remind healthcare organizations to secure patient data.

Nicola Brook of Broudie Jackson Canter, which represents adult survivors, said: "This is a truly unbelievable breach of privacy for victims of one of the most horrific attacks this country has ever seen. This is more than a few bad apples when it was 48 different members of staff who for no legitimate reason chose to access vulnerable victims' records. That speaks to a culture, and one that will only change if there are real consequences for those responsible. For the trust to then try to hide that it happened is appalling. The trust has many questions to answer and we will be ensuring our clients get those answers as soon as possible."

Ryan-Donnelly called the two-year delay in informing her client absolutely shameful. She urged the trust to provide more answers to the girl's family and for staff to face proper accountability.

Southport Labour MP Patrick Hurley told the BBC he was deeply concerned. "The suggestion that confidential records may have been accessed without legitimate reason, particularly at a time when survivors and families were at their most vulnerable, is profoundly troubling," he said. He called for steps to prevent repeats in Southport or other high-profile cases.

Layla Moran, chair of the Health and Social Care Committee, said such breaches fundamentally undermine patient confidence.

Shadow Health Secretary Stuart Andrew said: "Any inappropriate access to confidential medical records is a serious violation of that trust and should never have happened. The vast majority of NHS staff uphold the highest professional standards every day under immense pressure. Where those standards are breached, it is right that disciplinary action is taken."

Sumner added that the trust notified regulators including the ICO and stayed transparent on findings and actions. Lessons from the incident led to a digital tool that curbs such inappropriate access.