About 40 members of hospital staff accessed the medical records of a three-year-old boy hurt in a crocodile pit, prompting an investigation, it has been reported.

Cambridge University Hospitals (CUH) has referred itself to the Information Commissioner’s Office (ICO) and is investigating whether all the workers had a legitimate reason for looking at his information.

The boy, from Cambridgeshire, who ended up in a zoo’s crocodile enclosure, is now in a stable condition. He was taken to Addenbrooke’s hospital, run by CUH, last Thursday after the incident at Johnsons of Old Hurst zoo.

A 30-year-old man from Norfolk was arrested on suspicion of attempted murder and later bailed after he was “assessed as not being fit for interview”. The suspect reportedly has learning difficulties and had been on a trip with carers.

A CUH spokesperson said: “We have strict policies in place to safeguard patient data and we take any breach extremely seriously.

“We know the vast majority of our 13,000 staff understand the fundamental importance of maintaining patient confidentiality and uphold the highest professional standards.

“Where any member of staff is found to have accessed patient records without legitimate clinical or operational reasons we take robust disciplinary action, including dismissal. As part of our response to any breach, we notify both the ICO and apologise to patients and their families affected.”

Cambridgeshire police said on Monday that the boy was “no longer critical” and was “in a stable condition in hospital”. It is understood he was attacked by at least one crocodile after he was allegedly thrown into the enclosure.

Police were called to the zoo at 1.24pm on Thursday by the ambulance service to reports that a three-year-old boy had suffered serious injuries.

Cambridgeshire police said the boy “sustained serious injuries while in the enclosure” and “was pulled out by staff from the zoo”.

Tracey Johnson, the wife of the zoo owner, reportedly jumped into the enclosure to save the child.

Last week a former healthcare worker was cautioned by the ICO for trying to obtain and sell the medical records of the Princess of Wales.