CUH said it is checking whether any access had legitimate clinical or operational reasons; the boy's records had reportedly been restricted to prevent unnecessary viewing, and his family is being informed.
The trust said unauthorized access could bring disciplinary action up to dismissal, stressing that patient confidentiality rules apply across its 13,000 staff.
The case stems from the 18 June attack at Johnsons of Old Hurst near Huntingdon, where the boy suffered serious injuries; police said he is now stable, and a 30-year-old man has been arrested on suspicion of attempted murder.