Eleven members of staff have been sacked by an NHS trust for inappropriately accessing medical records of the Nottingham attacks victims.
Nottingham students Barnaby Webber and Grace O'Malley-Kumar, and grandfather Ian Coates, were stabbed to death on 13 June 2023 by Valdo Calocane, who was diagnosed with paranoid schizophrenia in 2020.
On Thursday, Nottingham University Hospitals (NUH) NHS Trust confirmed it had dismissed 11 members of staff, while 12 had received final written warnings and two had first written warnings.
The families of Barnaby, Grace and Ian welcomed the action by the trust but called the development a "kick in the teeth" amid an ongoing inquiry examining the attacks.
The trust said it had informed Nottinghamshire Police and the Information Commissioner's Office (ICO) of the outcomes of the investigation.
A spokesperson for the ICO said: "We will assess any evidence provided by the trust in due course and consider our next steps, including whether any criminal investigations need to be opened for breaking data protection law."
Nottinghamshire Police said there was "no criminal investigation".
A public statutory inquiry, which is examining the lead-up to the attacks and decisions and actions taken in the aftermath, is ongoing in London.
It emerged in 2025 that staff at the trust had accessed the victims' records without need, prompting an internal investigation.
NUH confirmed the staff involved in the investigations included doctors, nurses, registered medical professionals, and administrative and clerical employees.
The families of Barnaby, Grace and Ian were informed of the outcome of the investigations this week, the trust added.
Further investigations are ongoing into inappropriate access, the trust said, including into the files of the surviving victims of the attacks - Wayne Birkett, Sharon Miller and Marcin Gawronski.
The bereaved families told the BBC they were glad action was being taken, but called for further transparency from the trust and other organisations.
James Coates, one of Ian's three sons, said he believed the initial investigation by NUH and subsequent outcome to be "the tip of the iceberg".
"Morbid curiosity and inappropriate voyeurism have become a huge issue, not just with the NHS, but with the Nottinghamshire Police force.
"The council, the mental health trust, the probationary and prison service amongst others.
"Unfortunately, the numbers continue to grow with each update we receive, and it is a huge kick in the teeth when we are already down," he said.
Grace's father, Dr Sanjoy Kumar, said: "Grace was a medical student and attended lectures at the Queen's Medical Centre [run by the trust].
"One day she would have qualified and started her chosen profession in Nottingham, treating the people of Nottingham, working in the NHS hospitals there.
"This news brings enormous hurt and adds to the pain of losing our beloved daughter."
Barnaby's mother, Emma Webber, added: "I'm under no illusions that had it not been for the inquiry, and had it not been for the amount of noise and pressure that we families have put on to this hospital trust, the other [mental health] trust and other agencies, it would have never come forward, it would have never seen the light of day.
"Whilst I'm glad it has been addressed, it's certainly nowhere near closure."
Greg Almond, a lawyer representing survivors Wayne and Sharon, said the data breaches were of "significant concern", and that they had not yet had the full details if the ongoing investigations.
He asked that the investigations were thorough and the fullest details of the outcome "shared in a timely manner".
Dr Manjeet Shehmar, medical director at NUH, said: "The families of Ian, Grace and Barnaby have had to endure much pain and heartache, and I am truly sorry that the actions of some of our staff have added to that.
"To access the medical records of our patients without a legitimate reason is totally unacceptable and we are doing all we can to identify where and how that has happened."
Shehmar is expected to give her evidence to the Nottingham Inquiry next week.
The trust said follow-up activity would take place with independent regulators such as the Nursing and Midwifery Council and General Medical Council (GMC).
Shehmar said appropriate access was a "fundamental principle of our duty of care", which the "vast majority" of staff understood.
She added: "By accessing records inappropriately, staff are damaging the valuable contributions made by those colleagues providing care for those patients.
"In those cases where it does happen, I hope that this is a very clear reminder that we will take appropriate action."
A GMC spokesperson said: "Accessing information where there is no legitimate need is a breach of GMC guidance.
"We expect trusts to fully investigate the circumstances and to make referrals to the GMC."
A spokesperson for the Department of Health and Social Care (DHSC) said: "It is completely unacceptable for NHS staff to inappropriately access people's health records - especially those who have been through such horrific and traumatic experiences. It's right that the trust has apologised and taken robust action.
"The families of the victims of the Nottingham killings have experienced unimaginable pain and suffering, and the statutory inquiry is helping build a clear understanding of the events that led to these horrendous crimes."
Calocane was sentenced to a hospital order in January 2024 after admitting three counts of manslaughter on the grounds of diminished responsibility and three counts of attempted murder.
What later emerged was a series of failings by authorities, including the police and mental health services - which Calocane was known to - prompting calls for a statutory public inquiry.
NUH is among a number of organisations in which staff inappropriately viewed records or information related to the fatal attacks.
In December 2024, an investigation opened into allegations Ministry of Justice (MoJ) staff illegally accessed computer files related to the Nottingham attacks.
The public inquiry has since heard court workers also inappropriately accessed information about the case in January 2024.
Amy Holmes, the interim director general for the chief operating group of the Ministry of Justice (MoJ), told the inquiry she could not detail what information was accessed due to the ongoing police investigation.
The inquiry also heard seven probation service officers were identified as having accessed the information.
HM Prison and Probation Service found four of those officers accessed files legitimately, but three did not have a legitimate reason to do so.
However, it was deemed by the probation service and the Ministry of Justice's data protection unit that the breaches were not serious enough to warrant further action.
Footage and images related to the attacks were also viewed numerous times by Nottinghamshire Police staff without a legitimate policing purpose.
The force confirmed it would carry out an audit of how many times the information was viewed and whether it was appropriate, following a complaint by Barnaby mother, Emma Webber, in March.
Listen to BBC Radio Nottingham on Sounds and follow BBC Nottingham on Facebook, on X, or on Instagram. Send your story ideas to eastmidsnews@bbc.co.uk or via WhatsApp on 0808 100 2210.
