An NHS trust has sacked 11 staff members who illegally accessed the medical records of the victims of the Nottingham attacks.

Valdo Calocane killed two 19-year-old students, Barnaby Webber and Grace O’Malley-Kumar, and Ian Coates, a 65-year-old caretaker, before attempting to kill three other people in the city in June 2023.

Nottingham university hospitals NHS trust (NUH) confirmed that 11 members of its staff had been dismissed as part of an investigation into claims the victims’ medical files were inappropriately accessed.

A further 14 staff members have been disciplined with written warnings, but remain in post.

Staff investigated include doctors, nurses, registered medical professionals and administrators. The roles of those who have been dismissed were not made public.

Emma Webber, the mother of Barnaby Webber, expressed her disgust at the scale of misconduct. She said the families of the victims disputed the trust’s claim that as many 48 members of staff legitimately accessed the files.

Dr Manjeet Shehmar, the medical director at NUH, apologised to the victims’ families and said the disciplinary action showed the trust would not tolerate prying into medical records.

The families of Webber, O’Malley Kumar and Coates have been informed of the disciplinary action.

In a statement Shehmar said: “The families of Ian, Grace and Barnaby have had to endure much pain and heartache, and I am truly sorry that the actions of some of our staff have added to that.

“To access the medical records of our patients without a legitimate reason is totally unacceptable and we are doing all we can to identify where and how that has happened. I hope that the families, staff and our communities feel reassured by the outcomes so far, that we are taking this seriously and will continue to do so.”

She added: “It is essential that access to patient records is lawful, justified and directly related to their role. By accessing records inappropriately, staff are damaging the valuable contributions made by those colleagues providing care for those patients. In those cases where it does happen, I hope that this is a very clear reminder that we will take appropriate action.”

The trust has also informed the Information Commissioner’s Office and Nottinghamshire police. It said follow-up activity would take place with independent regulators, such as the Nursing and Midwifery Council and the General Medical Council.

In a statement, Webber said: “To learn that 11 staff have been dismissed and 14 faced disciplinary actions is shocking. What is more shocking is the scale of misconduct – 150 members of staff accessed the records. The process is not yet complete so we anticipate these numbers to escalate considerably.

“The trust is also aware that we do not accept their findings that 48 members of staff had legitimate access. The number is far too high. The rationale given for legitimacy does not stack up and we are formally challenging this in order to scrutinise properly.

“It’s heartbreaking that on top of our tragic loss, we’ve also had to face such appalling additional failures by members of staff who should know better. I’d ask them all to consider how they would feel if it was their child or father.”

Further investigations continue, including into allegations of inappropriate access into the files of surviving victims, including Wayne Birkett, Sharon Miller and Marcin Gawronski.

Shehmar will give evidence later this month at the inquiry into the attacks. It is examining the lead-up to the attacks, and the decisions and actions taken in the aftermath.

Calocane was sentenced to an indefinite hospital order in January 2024 after admitting manslaughter by diminished responsibility and attempted murder.