NHS Tayside has launched an investigation into an alleged data breach involving the medical records of a nine-year-old girl who died earlier this week, after staff members reportedly accessed her file without authorisation or a clinical need.
The alleged breach took place at Ninewells Hospital in Dundee, where the girl, Minnie Merriman, was taken after being found with serious injuries at Elliot Industrial Estate at around 0002 on Monday 3 August. She later died at the hospital. She was named publicly for the first time on Wednesday, after a 35-year-old man known to her was arrested and charged in connection with her death.
A spokesperson for NHS Tayside, which oversees Ninewells Hospital, said: "NHS Tayside is currently investigating the circumstances of an alleged data breach which happened in a working clinical area where staff access patient information."
The spokesperson added: "As a matter of governance, any data protection breach would be recorded and investigated by NHS Tayside and, where appropriate, reported to the Information Commissioner's Office (ICO). It would not be appropriate for us to comment further on individual staffing matters."
NHS Tayside did not respond to questions about the nature of the data accessed or who is believed to have been responsible for the intrusion.
Medical records in the UK are protected under UK GDPR, as set out in the Data Protection Act 2018, alongside common law rules on patient confidentiality. NHS staff are permitted to access patient information only where there is a legitimate clinical or work-related reason to do so. Breaches of this kind can be reported to the Information Commissioner's Office, which has powers to investigate and take enforcement action against organisations that fail to safeguard personal data appropriately.
The investigation comes amid a wider police inquiry into Minnie's death. A 35-year-old man appeared at Forfar Sheriff Court on 5 August, the day of his arrest, over the death of the girl. He entered no plea and has been remanded in custody. Police Scotland said the man was known to the child.
Officers said they are not currently seeking anyone else in connection with the case. Other members of Minnie's family, who are from West Yorkshire and had been camping in the area at the time, are being supported by specialist officers.
A family statement released through Police Scotland said: "We are devastated with the loss of our beloved, absolutely incredible, beautiful and brave Minnie Moo. Our family asks that our privacy is respected at this extremely difficult time."
Detective Inspector Mike Ness of Police Scotland's major investigation team said: "Our thoughts remain with everyone affected by these events, especially Minnie's family. A police presence will remain in the area while our enquiries continue."
He added that anyone with concerns or information should approach officers in the area or contact Police Scotland on 101, quoting incident number 0008 of Monday 3 August 2026.
NHS Tayside has not confirmed a timeline for the completion of its internal investigation into the alleged data breach, nor whether any staff members have been suspended pending its outcome. The trust said any confirmed breach of data protection rules would be handled in line with its governance procedures, with referral to the ICO where appropriate.
