Southport Attack Survivor Says Hospital Staff Accessed Her Medical Records Without Reason

A survivor of the Southport attack said she was devastated and horrified after learning that hospital workers had accessed the medical records of victims without good reason. Leanne Lucas, who was the instructor at the Taylor Swift-themed dance workshop targeted in the attack in July 2024, said staff had abused their position.

Three girls were murdered at the event: Alice da Silva Aguiar, nine, Bebe King, six, and Elsie Dot Stancombe, seven.

Ten others were injured, including Lucas. Some of those injured received treatment at University Hospitals of Liverpool Group. An information access audit carried out by the trust in the days following the incident showed that 48 staff accessed the records of the victims without good reason, according to the HSJ.

The patients involved were not informed until this week. Lucas, who now campaigns against knife crime, has waived her right to anonymity. She said: "I am absolutely devastated and horrified that my privacy has been invaded when I was at my most vulnerable.

Nothing will take away my gratitude to the staff who saved my life, but 48 people not involved in my care abused their position of trust to access the files of victims who have suffered unspeakable trauma. After concluding its investigation, the trust decided not to inform the patients at the time after taking into consideration the potential psychological impact it may have upon them.

Trust chief executive James Sumner said the trust had notified the relevant regulators and professional bodies and were fully transparent about any findings and actions taken. He added that breaches of patient confidentiality are inexcusable and undermine the hard work of those teams who sought to provide the highest standard of care.

The spokesman said anyone inappropriately accessing information in this way may face disciplinary action or even criminal prosecution in some cases. The spokesman added that the trust spoke with the office after identifying the alleged inappropriate access, and support was provided for internal investigations and disciplinary processes.

The office does not intend to start a criminal investigation into anyone for breaking data protection law at this time but will keep this under review should new information emerge.

The attacker, referred to as AR at the request of the victims' families, was jailed for a minimum of 52 years for the murders of the three girls, the attempted murders of eight other children and Lucas, and the attempted murder of businessman John Hayes.