NHS Tayside is investigating a data breach that exposed the medical records of nine‑year‑old Minnie Merriman, who died on August 3 after being treated at Ninewells Hospital in Dundee. A 35‑year‑old man known to the child was arrested on August 5 on suspicion of murder.

UK law requires NHS staff to access patient information only when there is a legitimate clinical or work‑related need. The Data Protection Act 2018 and GDPR standards govern the handling of such records, and any unauthorized access must be recorded and reported to the Information Commissioner’s Office.

The alleged breach occurred at Ninewells Hospital, where staff accessed Minnie’s file without documented clinical justification, according to NHS Tayside. A spokesperson said the incident is being investigated under the trust’s governance procedures and will be reported to the ICO as required.

Police Scotland confirmed that the man was charged on August 5 and remanded in custody after appearing at Forfar Sheriff Court. Detectives said no additional suspects are being sought in connection with the girl's death.

Family members, who live in West Yorkshire, are being supported by specialist services while police continue their enquiry. A family statement released through Police Scotland expressed grief and asked for privacy.

NHS Tayside has not disclosed the specific data accessed, nor identified the individual(s) responsible for the intrusion. The investigation remains ongoing, and the trust says it will implement additional safeguards to prevent future breaches.