Southport survivor says medical-record access violated her
Yoga teacher Leanne Lucas says she feels violated after two more NHS staff came under investigation over alleged access to Southport victims’ medical records…
Southport survivor Leanne Lucas says she feels violated after two more NHS staff came under investigation over alleged access to victims’ medical records. Liverpool Heart and Chest Hospital said its retrospective audit identified the cases and that both staff members were suspended as a precaution.
The investigation adds to scrutiny over the handling of sensitive patient information following the attack. Lucas says the alleged access has caused further distress after the trauma she suffered in Southport.
Why does the Southport survivor say she was violated?
Lucas, a yoga teacher who was seriously injured in the knife attack, said medical staff entrusted with her care had violated her privacy. She was helping run a Taylor Swift-themed dance class when three children were fatally attacked in the Merseyside town on 29 July 2024.
Six-year-old Bebe King, seven-year-old Elsie Dot Stancombe and nine-year-old Alice Da Silva Aguiar were killed. Lucas was one of two adults injured, alongside eight other children.
“What happened to me was already traumatic enough, but to discover that the very people entrusted with my care have violated my privacy causes further distress and secondary trauma,” Lucas said.
She said she should not have to seek answers or accountability from a hospital where she had been at her most vulnerable. Lucas also described repeated concerns about medical staff accessing records, saying she believed the conduct was driven by “inexcusable morbid curiosity”.
What did the hospital investigation find?
Liverpool Heart and Chest Hospital said it was investigating two potential instances of inappropriate access connected to the Southport attack. The cases emerged through a retrospective audit, and two members of staff were placed on precautionary suspension while the investigation proceeds.
The trust said it had reported the matter to the Information Commissioner’s Office and the Care Quality Commission. Its medical director, Manoj Kuduvalli, apologised and said patient records should only be accessed for legitimate reasons related to staff members’ roles and patient care.
“Any inappropriate access to those records is a serious violation of that trust,” Kuduvalli said. He added that the trust had spoken to affected patients and would keep them informed as the investigation continues.
Lucas’s solicitors said they had asked the hospital to conduct an audit in September. Elaine Macdonald, the solicitor representing Lucas at Broudie Jackson Canter, said at least 40 medical staff had already inappropriately accessed Lucas’s records during her care at a hospital under the same trust.
Macdonald said Lucas had been told the alleged breaches may not have ended there. She called the issue systemic and said each breach further eroded her client’s trust and violated her privacy.
How does the case connect to earlier record breaches?
In May, the University Hospitals of Liverpool Group admitted that nearly 50 staff had wrongly viewed victims’ medical files. The group runs Aintree Hospital in Liverpool, where some survivors were taken after the attack.
The earlier breach occurred at Aintree in the days after the 29 July 2024 attack. The patients affected included Lucas and a 13-year-old girl who had helped supervise the dance class, according to the account of the case.
UHLG described that breach as inexcusable and said it had made changes, though no staff had been sacked. A separate investigation is also under way at North West Ambulance Service Trust over allegations that staff looked up attack victims without authorisation.
For patients, the investigations concern who can see highly personal medical files and whether hospitals can protect that information when people are receiving care. The latest audit has placed two further staff members under investigation, with both on precautionary suspension.
