A woman was informed she had cancer by a hospital employee she barely knew who had accessed her medical records days before she was scheduled to receive test results from her consultant. Pippa Boardman said the data breach at Royal Cornwall Hospital in Truro caused her to lose her dignity and privacy. According to The Guardian, the employee who accessed her information was a man she knew only vaguely through sport.
Boardman, from Lostwithiel in Cornwall, described receiving an unexpected phone call at home from the hospital worker. She recalled:
I got a phone call at home from somebody I know through the sport that I play. This man said to me: 'Pippa, I don't want you to worry, but you've got cancer.' I just couldn't really believe it.Two days later, her consultant confirmed the diagnosis of breast cancer during a scheduled appointment.
The incident represents part of a broader pattern of inappropriate record access within the NHS. Royal Cornwall Hospitals NHS Trust previously investigated after staff inappropriately accessed murdered woman Michaela Hall's medical records multiple times over several years, with one employee viewing them seven times including on her birthday. Additionally, nearly 50 NHS staff at Aintree Hospital accessed medical records of Southport knife attack victims inappropriately, a breach involving a 13-year-old and teacher Leanne Lucas that was revealed nearly two years later.
How did the trust respond?
Royal Cornwall Hospital Trust told the BBC it was
truly sorryabout what had happened to Boardman. The trust acknowledged that
Whilst the member of staff had legitimate access to her records as part of their work, it was outside of their role to contact her. This should not have happened and we recognise the distress and concern it will have caused.
Boardman said the trust only apologised once it had been contacted by reporters at the BBC. She expressed frustration about the lack of transparency regarding the staff member's consequences, noting that the trust told her employment rights meant it could not provide further information. She emphasised the emotional toll of the breach, stating:
It really distresses me people can't see just how invasive and intrusive it is if somebody looks at your information and then shares it inappropriately.Boardman said making a complaint took courage given the circumstances.
The trust said it could not disclose individual employment matters but wanted to reassure Boardman it had treated the case
extremely seriously.According to Yahoo News,
Appropriate action was taken following our investigation which was carried out immediately after Ms Boardman raised her concern.
What is the scale of the problem at Royal Cornwall?
Data breaches are not uncommon at the trust. A Royal Cornwall Hospitals Trust freedom of information response recorded 365 incidents classified as data breaches over the preceding 36 months; seven were reported to the Information Commissioner's Office, and none led to ICO action. This suggests systemic vulnerabilities in how patient information is protected across the organisation.
What policy changes are being made?
The trust said it had reminded staff that records must be accessed only for legitimate work reasons and is reviewing its policies in light of strengthened NHS England guidance on inappropriate access to patient information. The review follows a broader national response to record access breaches. NHS England announced a "zero-tolerance crackdown" under which staff in England suspected of accessing patient records without a valid reason would be immediately suspended and locked out of NHS computer systems.
What happens next?
The trust is reviewing its policies in response to strengthened NHS England guidance on inappropriate access, though no completion date has been reported. Boardman, who is recovering well from her cancer treatment, said the trust's handling of the case had reinforced her trauma and highlighted the need for stronger safeguards to prevent similar breaches in future.
