Privacy
NHS investigates possible breach of tiger attack victim’s medical records
Yorkshire Ambulance Service NHS Trust is investigating whether staff accessed the medical records of William Chapman, killed by a tiger, without a valid reason. The incident has been reported to the Information Commissioner’s Office.
Ross Grant3 min read
The short version
After a tragic tiger attack at Yorkshire Wildlife Park, NHS staff may have looked at the victim’s medical records without permission. The ambulance service found possible unauthorised access during routine checks and is now investigating. The incident has been reported to the UK’s data regulator, and the victim’s family has been informed.
What happened?
Yorkshire Ambulance Service NHS Trust is investigating whether two staff members accessed or tried to access the medical records of William Chapman, who died after a tiger attack, without a valid reason. The possible breach was found through routine audits. The Trust has informed Chapman’s family and reported the incident to the Information Commissioner’s Office.
Details of the Incident
William Chapman, a 24-year-old man, died after entering a tiger enclosure at Yorkshire Wildlife Park near Doncaster on Saturday, 10 October 2026. Emergency services responded, but Chapman was pronounced dead at the scene. The inquest heard that he suffered multiple traumatic injuries from the encounter with the tiger. Chapman was known to mental health services and had a diagnosis of schizophrenia, but was described as highly functioning and independent at the time of his death. His family had previously raised concerns about his mental health care. BBC (opens in a new tab), The Telegraph (opens in a new tab), The Independent (opens in a new tab)
Alleged Breach of Medical Records
Shortly after Chapman’s death, Yorkshire Ambulance Service NHS Trust identified two possible incidents where staff may have accessed or tried to access Chapman’s medical or incident records without a legitimate reason. The Trust said these potential breaches were detected through routine audits of access logs. The Trust has launched an internal investigation to determine exactly what happened and whether there was any unauthorised access to confidential patient information. Chapman’s family has been informed, and the Trust has offered condolences and support during the investigation. BBC (opens in a new tab), The Independent (opens in a new tab)
What the NHS Trust Has Said
A spokesperson for Yorkshire Ambulance Service NHS Trust stated that they take the confidentiality and security of patient information very seriously and have robust systems to protect it. They emphasised that the concern was identified thanks to proactive auditing, which checks who has accessed sensitive records. The Trust has also reported the matter to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, as required by law for potential data breaches involving personal information. The Trust promised to keep Chapman’s family updated as the investigation continues. BBC (opens in a new tab), The Independent (opens in a new tab)
Wider Context and Next Steps
The incident comes at a time when the NHS, like many healthcare providers, faces scrutiny over how it handles sensitive patient data. UK law, including the Data Protection Act and the UK General Data Protection Regulation (GDPR), requires that personal health information is only accessed for valid reasons. Unauthorised access can lead to disciplinary action, regulatory investigations, and fines. The ICO can impose fines of up to £17.5 million or 4% of annual turnover for serious breaches. The Trust’s investigation will look at whether the staff involved had any legitimate reason to access the records and what actions should be taken if they did not. The ICO will also review the findings and could take further action if necessary. BBC (opens in a new tab)
Support for Those Affected
Yorkshire Wildlife Park has reopened since the incident and is providing trauma support to staff and visitors affected by the tragedy. The park confirmed that the tiger involved, Altai, would not be euthanised and remains under the care of the animal team. Meanwhile, Chapman’s family is being supported by the NHS Trust and kept informed about both the inquest and the ongoing investigation into the possible data breach. The Telegraph (opens in a new tab)
What Happens Next
The NHS Trust’s investigation is ongoing. The ICO will be involved in reviewing the incident and deciding if any further regulatory action is needed. Chapman’s family will continue to receive updates. The case highlights the importance of strict controls and monitoring over access to sensitive health records, especially in high-profile or tragic cases.
Claimed vs confirmed
- Confirmed
Two NHS staff accessed or attempted to access the victim's medical records without a legitimate reason.
Yorkshire Ambulance Service NHS Trust stated it had identified two possible incidents of staff accessing or attempting to access the records after the incident.
The impact
- Money
- If the Information Commissioner’s Office finds a serious breach, the NHS Trust could face a fine of up to £17.5 million or 4% of annual turnover under UK GDPR rules.
- Reputation
- The incident could damage public trust in the NHS’s ability to protect sensitive patient data, especially in high-profile cases.
- Customers
- Patients expect their records to remain private. Anyone affected should be informed and may be entitled to support if their data was accessed without permission.
Why it matters
Patient medical records contain sensitive personal information. Unauthorised access can harm trust in healthcare and may be illegal. The case shows how important it is for organisations to protect privacy, especially during high-profile incidents.
How does it work?
NHS staff have access to patient records for care purposes. Access is logged and audited. If someone views a record without a valid reason, it is considered unauthorised access and a potential data breach. Routine audits can detect such incidents by checking who accessed which records and when.
Key points
- NHS staff may have accessed a tiger attack victim’s medical records without a valid reason.
- The possible breach was found through routine audits of access logs.
- An internal investigation and a report to the Information Commissioner’s Office are underway.
- Patient data privacy is a legal and ethical requirement for healthcare organisations.
- Unauthorised access can lead to disciplinary action and regulatory fines.
Sources
BBC
Reference
The Telegraph
Reference
The Independent
Reference
