Hospital staff probed over confidentiality after crocodile attack -

Written by

June 26, 2026

Hospital staff probed over confidentiality after crocodile attack

Cambridge University Hospitals (CUH) has referred itself to the Information Commissioner’s Office (ICO) after it found that about 40 members of hospital staff accessed the medical records of a three-year-old boy hurt in a crocodile enclosure.

The hospital is investigating each of the workers’ actions to determine if they had a legitimate reason for looking at his information.

“Where any member of staff is found to have accessed patient records without legitimate clinical or operational reasons we take robust disciplinary action,” said a spokesperson from CUH.

NHS culture failings

Ockenden report: toxic culture and bullying at NHS trus

NHS staff survey reveals stability, not improvement

Temporary workers in the NHS need a stronger voice

The boy, from Cambridgeshire, who may have been pushed into the zoo’s crocodile enclosure, is in a stable condition. He was taken to Addenbrooke’s hospital, run by CUH, last Thursday after the incident at Johnsons of Old Hurst zoo.

A 30-year-old man from Norfolk was arrested on suspicion of attempted murder and later bailed after he was “assessed as not being fit for interview”. The suspect reportedly has learning difficulties and had been on a trip with carers.

The CUH spokesperson added: “We have strict policies in place to safeguard patient data and we take any breach extremely seriously.

“We know the vast majority of our 13,000 staff understand the fundamental importance of maintaining patient confidentiality and uphold the highest professional standards.”

Police were called to the zoo at 1.24pm on Thursday by the ambulance service to reports that a three-year-old boy had suffered serious injuries.

Cambridgeshire police said the boy “sustained serious injuries while in the enclosure” and “was pulled out by staff from the zoo”.

Tracey Johnson, the wife of the zoo owner, reportedly jumped into the enclosure to save the child.

Last week a former healthcare worker was cautioned by the ICO for trying to obtain and sell the medical records of the Princess of Wales.

In May 2026, Liverpool University Hospitals Group admitted that 48 staff members had inappropriately accessed the medical records of victims of the Southport knife attack. The breach, which went undisclosed to the affected patients for nearly two years, triggered anger from victims, MPs, and data protection campaigners. The trust said disciplinary outcomes ranged from informal counselling to a final written warning.

In March 2025, Nottingham University Hospitals Trust investigated staff who accessed the medical records of the three people killed by Valdo Calocane, a man with paranoid schizophrenia. Families described the access as “gross invasions of privacy.” The trust confirmed that staff had been identified and that police and the ICO had been notified.

Paul Arnold the ICO’s chief executive wrote earlier this week: “Across the UK every day, medical records are accessed thousands of times by healthcare staff who legitimately need this information to deliver the best possible care. Inappropriate access is rare and does not represent the behaviour of the vast majority of healthcare staff who take their duty of confidentiality extremely seriously.”