Image source, Family handout Image caption, Noah's family paid tribute to a "happy, cheeky, playful" boy ByTom McArthur and Louise Parry Published 27 September 2026, 06:58 BST Updated 4 hours ago Ten NHS staff have been removed from duty or suspended after a data breach involving the digital medical records of three-year-old Noah Woods.
Launching an "urgent" investigation, Dr Martin Mansfield, deputy chief medical officer at East Suffolk and North Essex NHS Foundation Trust, said that any unauthorised access of patient data was "completely unacceptable".
The trust has apologised "unreservedly" to Noah's family and said disciplinary action would be taken if needed.
A major search for Noah was carried out in the village of Brantham, Suffolk, after the child went missing on 15 September.
His body was found the next day in a nearby pond by police divers.
A spokesperson for the trust said 10 employees had been "removed from active duty or suspended whilst investigations are concluded".
It comes after Sir Jim Mackey, the chief executive of NHS England, wrote to every trust on Friday, ordering stronger measures to tackle data breaches.
"We have seen too many cases of people abusing that trust, and enough is enough," said Sir Jim.
"Anyone who thinks they can satisfy their curiosity by looking at a patient's record should know this: they will be found out, they may lose their career and could end up with a criminal record." Image source, PA Media Image caption, Police said at least 1,300 members of the public had joined emergency services in the search for the missing boy At least 1,300 people helped in the search for Noah in the 24 hours before he was found.
A tribute issued by his family called him a "happy, cheeky, playful" boy who loved to laugh.
His mother urged other parents to "hold their children a little tighter and cherish every moment".
An inquest, which opened on Friday, heard that the three-year-old had left a play area "through a gap in the fence".
Assistant coroner Jyoti Gill said it was a "very sad and tragic death" as she opened and adjourned the inquest in Ipswich.
'Swift action' In the statement issued on Sunday,, external Mansfield said: "Immediate steps were also taken to secure the records and prevent further access that was not for a legitimate, clinical reason.
"We have reported the matter to the Information Commissioner's Office (ICO), and we will continue to keep Noah's family informed as our investigation progresses." Anna Turner, the trust's deputy director of communications, said the breaches were found through a "proactive" search because the case was high profile.
She said the trust was taking steps to prevent further unlawful access to records.
"We've made it impossible to find [Noah's] record, which is something we're able to do in this specific case," she added.
On Saturday, the trust wrote to all staff informing them about the breach and "to make it clear we're taking very swift action".
"We train all of our staff on information governance practice, with regular reminders, including posters in staff areas," Turner added.
In a statement, the ICO said: "We can confirm that we are making enquiries with East Suffolk and North Essex NHS Foundation Trust.
"A series of recent high-profile incidents involving unauthorised access to patient records is painting an extremely worrying picture." It stressed that any healthcare professionals knowingly or recklessly accessing patient data beyond their remit risked "your livelihood, your professional accreditation" and could face "criminal sanctions".
If you, or someone you know, have been affected by child bereavement, details of help and support in the UK are available at BBC Action Line Your Voice Contact form Follow Suffolk news on BBC Sounds, Facebook, external, Instagram, external and X, external.
