Leanne Lucas, a yoga teacher seriously injured in the 2024 Southport knife attack, has said she feels "violated" again by the "inexcusable morbid curiosity" of NHS staff who accessed her medical records without authorisation.
In May, the University Hospitals of Liverpool Group (UHLG), which runs Aintree Hospital in Liverpool where some survivors were treated, admitted that nearly 50 staff had wrongly looked at victims' medical files. This week, it emerged that two more NHS staff are being investigated over claims they inappropriately accessed victims' medical records at Liverpool Heart and Chest Hospital, uncovered by a "retrospective audit".
Attack survivor speaks out
Lucas, 36, was helping to run a Taylor Swift-themed dance class when Bebe King, six, Elsie Dot Stancombe, seven, and nine-year-old Alice Da Silva Aguiar were fatally attacked in the Merseyside town on 29 July 2024. She has now spoken out about the NHS privacy breaches, branding them "inexcusable". It is understood her records were among those accessed by UHLG staff.
She said: "What happened to me was already traumatic enough, but to discover that the very people entrusted with my care have violated my privacy causes further distress and secondary trauma.
"I should not have to fight for answers or accountability from a hospital where I was at my most vulnerable. Time and time again I've been placed in this position, driven by what I can only assume is an inexcusable morbid curiosity by medical staff trained and employed to care [for] and protect patients."
Systemic issue flagged
Lucas's solicitors confirmed that they had asked for an audit to be conducted by the hospital in September. Elaine Macdonald, of Broudie Jackson Canter, said: "Leanne has already suffered the indignity of at least 40 members of medical staff inappropriately accessing her medical records during her care at a hospital under the same trust.
"She is now being told that it may not have ended there. Each breach erodes her trust and is a clear violation of her privacy, when she was at her most vulnerable. This is a systemic issue that needs to be addressed urgently."
A third investigation is also being held at North West Ambulance Service Trust in relation to staff looking up the victims of the attack without authorisation.
Hospital response and next steps
Liverpool Heart and Chest Hospital said it was "carrying out an investigation into two potential instances of inappropriate access connected to the Southport incident". It added: "The cases were detected as part of retrospective audit and two members of staff have been placed on precautionary suspension whilst an investigation is concluded."
The trust's medical director Manoj Kuduvalli said: "We are deeply sorry that this has happened. Our patients trust us with their most personal information at some of the most vulnerable moments in their lives, and any inappropriate access to those records is a serious violation of that trust.
"We have been clear with all colleagues that patient records must only ever be accessed for legitimate reasons connected to their role and the patient's care. We will not accept behaviour that compromises patient confidentiality or undermines the trust our patients place in us. We have spoken to those that are affected and will keep them informed as our investigation continues."
The data breach at UHLG happened at Aintree Hospital in Liverpool, where some of those injured were treated, in the days after the 29 July 2024 attack. It is claimed the three patients affected included Leanne Lucas and a 13-year-old girl who had been helping to supervise the dance class.
In May, UHLG described the breach as "inexcusable" and stressed that changes had been made, although no-one had been sacked. The case has been reported to the Information Commissioner's Office and the health regulator the Care Quality Commission, and the hospital has said it will keep those affected informed as its investigation continues.
