The young boy was taken to Addenbrooke's Hospital after suffering serious injuries when he was allegedly thrown into a crocodile enclosure at Johnsons of Old Hurst in Cambridgeshire on 18 June.

A CUH spokesperson said: ‘We have strict policies in place to safeguard patient data and we take any breach extremely seriously.  

‘We know the vast majority of our 13,000 staff understand the fundamental importance of maintaining patient confidentiality and uphold the highest professional standards. 

‘Where any member of staff is found to have accessed patient records without legitimate clinical or operational reasons we take robust disciplinary action, including dismissal. 

‘As part of our response to any breach, we notify both the ICO and apologise to patients and their families affected.'

A Department of Health and Social Care spokesperson said: ‘It is not acceptable for NHS staff to inappropriately access people's health records and we expect the trust to investigate this fully and take appropriate action.

‘The NHS must always protect patients' data, and the department is urgently looking into this issue to prevent this happening again.'

An ICO spokesperson said: ‘People need to trust that their medical information is safe and only available to healthcare staff who need to use it. When medical records are accessed without a legitimate reason, this can be deeply concerning for patients and their families, especially when a child is involved. 

‘This is a wider issue across the health sector that we are supporting organisations to address. We are working closely with the National Data Guardian and NHS England, and we continue to remind all organisations about the importance of keeping patient data secure.

‘We have received a report from Cambridge University Hospitals and are assessing the information provided.'