A three-year-old boy who was attacked by a crocodile at a UK zoo remains in hospital with a suspected broken arm and pelvis, as an investigation finds that 40 hospital staff accessed his medical records without a legitimate reason.
Incident at Johnsons of Old Hurst Zoo
The boy was allegedly thrown into the crocodile enclosure at Johnsons of Old Hurst zoo in Cambridgeshire by a man with learning difficulties. The suspect has since been deemed unfit for police interview. As of Saturday, the child was in Addenbrooke's Hospital in a critical but stable condition.
Breach of Patient Confidentiality
Cambridge University Hospitals (CUH) referred itself to the Information Commissioner's Office (ICO) after discovering that 40 staff members accessed the boy's medical records, potentially without clinical or operational justification. CUH warned that staff could face dismissal, stating: "Where any member of staff is found to have accessed patient records without legitimate clinical or operational reasons we take robust disciplinary action, including dismissal."
Health Bosses Investigate
CUH added: "We know the vast majority of our 13,000 staff understand the fundamental importance of maintaining patient confidentiality and uphold the highest professional standards." The ICO confirmed it is "assessing the information provided" and emphasised that "when medical records are accessed without a legitimate reason, this can be deeply concerning for patients and their families, especially when a child is involved."
Government Response
The Department of Health and Social Care also announced an investigation, with a spokesperson stating: "It is not acceptable for NHS staff to inappropriately access people's health records and we expect the trust to investigate this fully and take appropriate action." The department is "urgently looking into this issue to prevent this happening again."



