Medical records of crocodile attack victim, three, are accessed by up to 40 members of NHS staff as hospital launches investigation