"NHS Tayside is currently investigating the circumstances of an alleged data breach which happened in a working clinical area where staff access patient information," a spokesperson for NHS Tayside said.
Ninewells Hospital probe: alleged staff access to a deceased child's records
NHS Tayside has opened an internal investigation after the medical records of a nine-year-old girl who later died were reportedly accessed without authorization at Ninewells Hospital in Arbroath. The trust's statement said the incident occurred "in a working clinical area where staff access patient information" and confirmed the matter would be handled through its governance processes: "Any data protection breach would be recorded and investigated by NHS Tayside and, where appropriate, reported to the Information Commissioner’s Office (ICO)." The trust declined to comment further on individual staffing matters and did not answer questions about the specific nature of the accessed data or who is thought to be behind the intrusion.
Legal guardrails: UK GDPR, the Data Protection Act 2018, and confidentiality rules
The source material specifies that medical records in the UK are protected under the UK GDPR as implemented in the Data Protection Act 2018, alongside several common-law confidentiality rules. The reporting reiterates the long-standing rule in NHS settings that staff are permitted to access patient information only where there is "a legitimate clinical or other work-related need." The alleged incident at Ninewells, as described by NHS Tayside, falls squarely into the category of events those laws and rules are designed to address.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCriminal investigation: arrest, court appearance and the scene
Separately, Police Scotland arrested a 35-year-old man whom officers say was known to the child. The man appeared at Forfar Sheriff Court on August 5 in connection with the death of Minnie Merriman; he issued no plea that day and has been remanded in custody. Police reported that Merriman was found at Elliot Industrial Estate at approximately 0002 on Monday, August 3, with serious injuries and was taken to Ninewells Hospital in Dundee, where she later died. Police Scotland said it was not currently looking for anyone else in connection with her death.
Family statement and local policing
The girl's family—identified in reporting as being from West Yorkshire and camping nearby—were being supported by specialists. A family statement released through Police Scotland read: "We are devastated with the loss of our beloved, absolutely incredible, beautiful and brave Minnie Moo. Our family asks that our privacy is respected at this extremely difficult time." Detective Inspector Mike Ness of Police Scotland’s major investigation team added: "Our thoughts remain with everyone affected by these events, especially Minnie's family." He said a police presence would remain in the area while enquiries continue, and asked anyone with information to contact Police Scotland on 101, quoting incident number 0008 of Monday, 3 August 2026.
How NHS staff, the ICO, and the family are likely to respond
- NHS staff and local management: The trust has signalled it will record and investigate the alleged breach under its governance procedures; staff access logs and local processes for authorizing views of patient records will likely be central to that review, given the statement that the incident occurred in a clinical area where staff routinely access patient information.
- The Information Commissioner’s Office (ICO) and regulators: NHS Tayside said breaches would be reported to the ICO "where appropriate," positioning the regulator as the external body that could be asked to assess compliance with the UK GDPR and the Data Protection Act 2018 once the trust's internal review reaches a conclusion.
- The family and the public: The family has publicly requested privacy and is being supported by specialists; the combination of a high-profile criminal inquiry and the reported unauthorized access to medical records will shape both privacy concerns and public interest in the investigatory outcomes.
The facts reported to date set two parallel lines of inquiry: Police Scotland’s criminal investigation into the death of Minnie Merriman, and NHS Tayside’s data-governance review of who accessed the child’s medical records and why. NHS Tayside has made clear it will record and investigate the alleged breach and may involve the ICO "where appropriate," but it has not disclosed the nature of the accessed records or identified individuals responsible. Those unanswered specifics—what exactly was viewed, by whom, and whether regulatory notification will follow—will determine how the trust, regulators and the family judge whether governance and legal protections were observed.
