BRANTHAM, SUFFOLK — Ten employees of East Suffolk and North Essex NHS Foundation Trust have been removed from active duty or suspended pending the conclusion of investigations into unauthorized access of patient data. The trust apologized to the family of Noah Woods for the distress caused by the breach of his medical records. The Woods Family described him as a "happy, cheeky, playful three-year-old boy who loved to laugh, loved to giggle and who brought joy wherever he went."

Dr Martin Mansfield, deputy chief medical officer at East Suffolk and North Essex NHS Trust, addressed the incident in an official statement. “We have apologised unreservedly to Noah Woods’ family for the extra anguish this breach of trust has caused them at an already devastating time,” Mansfield said. He stated that the trust launched an urgent internal investigation upon becoming aware that Noah Woods' medical records may have been viewed inappropriately. Immediate steps were taken to secure Noah Woods' medical records and prevent further access not for a legitimate clinical reason.

Sir Jim Mackey, chief executive of NHS England, addressed the broader implications of such breaches. He stated that NHS staff found accessing patient records for unauthorized reasons would be suspended immediately. “We have seen too many cases of people abusing that trust, and enough is enough,” Mackey said.

Noah Woods, aged three, died after being found in Decoy Pond in Brantham, Suffolk. He went missing from a playground in Merriam Close, Brantham, on the afternoon of 15 September 2024. Noah Woods became separated from a relative while visiting the playground.

An inquest heard that Noah Woods left the playground through a gap in the fence. More than 1,300 members of the public participated in the search for Noah Woods.

Metropolitan Police divers recovered Noah Woods' body from Decoy Pond on the afternoon of 16 September 2024. DCI Matthew Connick stated that Noah Woods was found approximately 5 metres from the bank of Decoy Pond within submerged tree roots at a depth of 1.8 metres. Charlie Peck, Noah's mother, formally confirmed his identity at Ipswich hospital.

Suffolk Constabulary stated that Noah Woods' death is not being treated as suspicious. Assistant coroner Jyoti Gill opened and adjourned the inquest into Noah Woods' death in Ipswich.

Noah Woods was non-verbal, partially deaf, and undergoing an assessment for autism. Rhys Woods, Noah's father, stated: “Noah was the sweetest and most innocent little boy, with nothing but love to give.” He added: “We are going to miss him so very much.” Football players wore black armbands during Everton’s home match against Ipswich Town in tribute to Noah Woods.

Why It Matters

The suspension of ten staff members shows ongoing concerns regarding patient data security within the National Health Service. The Information Commissioner's Office description of the incident as painting an extremely worrying picture of systemic issues suggests broader regulatory scrutiny may follow. Sir Jim Mackey's statement that enough is enough indicates a zero-tolerance approach from NHS leadership toward unauthorized record access.

The breach occurred in the aftermath of a tragic death that drew public attention and community involvement. The combination of a high-profile local tragedy and a subsequent data privacy violation reflects the vulnerability of sensitive medical information even during periods of intense public mourning. The requirement under the Data Protection Act 2018 to report breaches within 72 hours ensures that such incidents are subject to immediate external oversight.

Timeline

On 15 September 2024, DCI Matthew Connick stated that CCTV footage showed Noah Woods playing with a relative at 2:13pm and last seen playing at 2:37pm on 15 September. Noah Woods went missing from a playground in Merriam Close, Brantham, on the afternoon of 15 September 2024.

What's New

Later reporting provided additional details regarding the circumstances of the discovery and the regulatory response. The Information Commissioner's Office (ICO) confirmed it was 'making enquiries' into the East Suffolk and North Essex NHS Trust (ESNEFT) following the data breach, stating the incident 'painted an extremely worrying picture' of systemic issues in patient data protection.

Additional context emerged regarding legal requirements and the child's background. Under the Data Protection Act 2018, organizations must report personal data breaches to the ICO within 72 hours of becoming aware of them, a requirement ESNEFT explicitly acknowledged during its investigation into Noah Woods' case.

How Sources Differ

Sources vary in their focus regarding the apology and the publication of findings. Dr Martin Mansfield, deputy chief medical officer at East Suffolk and North Essex NHS Trust, stated: “We have apologised unreservedly to Noah Woods’ family for the extra anguish this breach of trust has caused them at an already devastating time.” In contrast, research titled “NHS trust suspends 10 staff over Noah Woods data breach” was published in BMJ. The East Suffolk and North Essex NHS Trust statement notes that East Suffolk and North Essex NHS Trust apologized to the family of Noah Woods for the distress caused by the breach of his medical records.

Reports differ on the specific details of the recovery location versus the general outcome.

There is a distinction between the specific recovery details and the general recovery action.

Sources differ on the framing of the administrative response versus the academic record. Research titled “NHS trust suspends 10 staff over Noah Woods data breach” was published in BMJ.