An investigation is underway after the medical records of murdered woman Michaela Hall were accessed without authorisation by staff at Royal Cornwall Hospitals NHS Trust (RCHT) on numerous occasions spanning several years.
Michaela Hall, 49, from Mount Hawke in north Cornwall, was killed in 2021 by her partner Lee Kendall, who received a custodial sentence with a minimum term of 21 years. Her parents have now revealed that trust staff accessed her digital records inappropriately, with one individual viewing them on seven separate occasions—including twice on what would have been her birthday.
The discovery has intensified the family's broader concerns about how Michaela's case was handled by authorities. In June 2026, the family launched a legal challenge under the Human Rights Act against Devon and Cornwall Police and the Probation Service, arguing that failings in their handling of her case contributed to her death.
What prompted the discovery of the unauthorised access?
The trust identified the inappropriate access through a routine audit and subsequently informed Michaela's parents. Alison Thorne-Henderson, the trust's chief people officer, stated that the organisation had written to the family to explain the findings and launched a full investigation into the matter.
Michaela's father, Peter Hall, expressed his determination to obtain clarity about the breach. He stated that he wanted to understand the motivations behind the repeated access and what information may have been obtained. He also called for the matter to be referred to police, though the trust maintained there was no evidence suggesting the access was for criminal purposes and therefore did not meet the threshold for a police referral.
Peter Hall characterised those responsible as "callous" and demanded that "stronger safeguards" be implemented to prevent similar incidents in the future.
How has the NHS responded to this breach?
The trust has issued an apology and committed to strengthening its protections. Thorne-Henderson emphasised that unauthorised access to patient records is unacceptable and warned staff that such conduct could result in dismissal. The trust is also reviewing its policies to align with new guidance issued by NHS England and has circulated reminders to all staff about their obligation to handle patient information with appropriate care and respect.
The breach at Royal Cornwall Hospitals is one of several high-profile incidents involving inappropriate access to medical records of vulnerable individuals. In a separate case, an NHS ambulance trust investigated claims that staff improperly accessed medical records of Southport attack victims, prompting broader calls for a comprehensive review of data breach policies across the health service. Additionally, nearly 50 NHS staff at Aintree Hospital were found to have accessed medical records of Southport knife attack victims inappropriately, with the breach involving a 13-year-old and teacher Leanne Lucas revealed nearly two years after it occurred.
What action has NHS leadership taken?
Following the discovery of the Noah Woods case—in which 10 NHS staff at another trust were removed from duty or suspended after accessing the digital medical records of the three-year-old who was found dead after going missing in Brantham, Suffolk—NHS England chief executive Sir Jim Mackey issued a directive requiring every trust to implement stronger measures against data breaches.
Mackey warned staff directly: "Anyone who thinks they can satisfy their curiosity by looking at a patient's record should know this: they will be found out, they may lose their career and could end up with a criminal record."
The RCHT stated it is seeking further guidance in light of the NHS England directive, including regarding the treatment of former members of staff who may have been involved in unauthorised access.
What does the family's broader legal action reveal about Michaela's case?
Michaela's mother, Anne Hall, expressed her anguish at the breach, saying:
I cannot understand why somebody would want to do this to my daughter and to us. It's caused a terrible upset to all of us. Michaela is dead, she's defenceless, she can't stand up for herself so it's down to Peter and I to do it for her.
The family's civil legal action against police and probation services reflects deeper concerns about systemic failures in Michaela's protection. The coroner's 2024 findings included that probation failings were causative of Michaela's death, with her partner having been incorrectly assessed as posing a lower risk than he actually did. The coroner's Prevention of Future Deaths report followed the inquest, which concluded on 22 March 2024, and made recommendations intended to prevent similar tragedies.
Key Facts
- One staff member accessed Michaela Hall's medical records on seven occasions, including twice on her birthday
- The breach was discovered through a routine audit conducted by Royal Cornwall Hospitals NHS Trust
- NHS England has ordered all trusts to strengthen measures against unauthorised access following multiple recent data breaches involving vulnerable individuals
- The family is pursuing civil legal action against Devon and Cornwall Police and the Probation Service, with a coroner's report finding probation failings contributed to Michaela's death
- Unauthorised access to patient records can result in dismissal and potential criminal charges, according to NHS leadership
