Hospital probe into why 40 people accessed records of boy attacked by crocodile
Investigation follows unauthorised access by 40 hospital staff members
Last updated 26th Jun 2026
An investigation is underway after 40 hospital staff reportedly accessed the medical records of a 3 year old boy from Cambridgeshire who was injured in a crocodile enclosure last week.
Cambridge University Hospitals has referred itself to the Information Commissioner’s Office and is looking into whether all the workers had a legitimate reason for looking at his information.
The young boy is in a stable condition at Addenbrooke's hospital following the incident at Johnsons of Old Hurst near Huntingdon.
A 30-year-old Norfolk man was arrested on suspicion of attempted murder, later bailed due to being "not fit for interview."
A CUH spokesperson said: “We have strict policies in place to safeguard patient data and we take any breach extremely seriously.
“We know the vast majority of our 13,000 staff understand the fundamental importance of maintaining patient confidentiality and uphold the highest professional standards.
“Where any member of staff is found to have accessed patient records without legitimate clinical or operational reasons we take robust disciplinary action, including dismissal.
“As part of our response to any breach, we notify both the ICO and apologise to patients and their families affected.”
Cambridgeshire Police said on Monday the boy was “no longer critical” and was “in a stable condition in hospital”.
It is understood that he was attacked by at least one crocodile after he was allegedly thrown into the enclosure.
Police were called to the zoo at 1.24pm on Thursday 18th of June by the ambulance service to reports that a three-year-old boy had suffered serious injuries.
Cambridgeshire Police said the boy “sustained serious injuries while in the enclosure” and “was pulled out by staff from the zoo”.
Tracey Johnson, the wife of the zoo owner, reportedly jumped into the enclosure to save the child.
Last week, a former healthcare worker was cautioned by the ICO for trying to obtain and sell the medical records of the Princess of Wales.
Officials condemn breach
A Department of Health and Social Care spokesperson said:
“This is a serious breach – it is completely unacceptable for NHS staff to inappropriately access people’s health records, and we expect the Trust to take suitable actions.
“Patients’ data must always be protected by the NHS, and we are ensuring measures are being taken to prevent this happening again.”
MP for South Cambridgeshire Pippa Heylings said the situation was completely unacceptable: "Given recent breaches in patient data protection at other NHS trusts following tragic events, it’s incredibly disappointing to see that safeguards were still too weak here.
"As I’ve insisted with earlier investigations and inquiries, the Trust must now be transparent, for the sake of the victim and his family, about how this could happen and what redress will now be taken.”