Health & Safety
NHS Patient Informed of Cancer Diagnosis by Acquaintance Who Accessed Records
A patient at Royal Cornwall Hospital was told she had breast cancer by an NHS employee she knew, two days before her official consultation, as data breaches plague the health service.
Share this article
THE PRIMARY BRIEF
- 01 · The primary finding
On October 21, 2026, a patient at Royal Cornwall Hospital was informed of her breast cancer diagnosis by an NHS employee she knew, two days before her official consultation, an incident contributing to over 2,900 data breach cases investigated by NHS trusts since 2021.
- 02 · The primary evidence
The Royal Cornwall Hospitals Trust apologized to Pippa Boardman, confirming the staff member had legitimate access to records but acted outside their role in contacting her about her diagnosis. NHS England chief executive Sir Jim Mackey has issued new guidance and policies, including immediate suspension for staff suspected of unlawful access, following numerous incidents like the dismissal of 15 staff members at Nottingham University Hospitals NHS Trust for accessing victims' records.
- 03 · Why it matters
These incidents underscore persistent challenges in safeguarding sensitive health data, eroding patient trust and prompting stricter enforcement measures against NHS staff for privacy violations.
On October 21, 2026, Pippa Boardman was informed of her breast cancer diagnosis by an NHS employee she knew, two days before her official consultation with a consultant, an incident occurring amidst more than 2,900 data breach cases investigated by NHS trusts since 2021. Boardman, from Lostwithiel, Cornwall, expressed profound distress over the privacy violation.
This incident highlights significant and ongoing failures in protecting sensitive patient data within the National Health Service. Such breaches erode public trust in healthcare systems and have prompted top NHS officials to implement stricter enforcement policies, including immediate suspensions and dismissals for staff who unlawfully access medical records.
Patient Notified of Cancer by Acquaintance
Pippa Boardman recounted receiving a phone call from an acquaintance, an NHS employee, who told her, "Pippa, I don't want you to worry, but you've got cancer". This call came two days before her scheduled consultation where she was officially diagnosed with breast cancer. Boardman stated she felt she lost her dignity and privacy due to the breach. The Royal Cornwall Hospitals Trust issued an apology to Boardman after being contacted by the BBC. The Trust acknowledged that while the staff member had legitimate access to her records, contacting her to discuss her diagnosis was outside their role and should not have happened. An immediate investigation led to appropriate action, the Trust confirmed.
NHS England Cracks Down
In response to a growing pattern of inappropriate data access, NHS England (NHSE) has intensified efforts to prevent such incidents. On July 8, 2026, NHSE chief executive Sir Jim Mackey issued new guidance, warning that accessing patient histories out of curiosity is "illegal, damages public trust, and risks undermining long-term data initiatives". Sir Jim stated that misuse of data could lead to disciplinary action, dismissal, referral to the Information Commissioner's Office (ICO), and potential criminal prosecution. Trust boards were urged to reinforce staff education and adopt a "zero-tolerance" approach. Around September 25, 2026, Sir Jim Mackey further announced that NHS staff suspected of unlawfully accessing patient records would face immediate suspension and removal of access to NHS computer systems.
Recent High-Profile Cases
This policy reinforcement followed several high-profile incidents. Just before the Pippa Boardman story, on October 19, 2026, Nottingham University Hospitals NHS Trust (NUH) dismissed 15 staff members and issued 15 final written warnings for inappropriately accessing the medical records of victims of the June 13, 2023, Nottingham attacks. These victims included Barnaby Webber, Grace O'Malley-Kumar, Ian Coates, and surviving victims Wayne Birkett, Sharon Miller, and Marcin Gawronski. Dr. Manjeet Shehmar, medical director at NUH, assured ongoing investigations and staff education. Health Secretary Yvette Cooper condemned these breaches as a "disgrace," expecting action, including dismissals, for confidentiality violations. Separately, 10 NHS staff members were suspended after the medical records of three-year-old Noah Woods were inappropriately accessed. Sky News research revealed that NHS trusts have investigated over 2,900 data breach cases since 2021, with only 409 referred to the ICO; 67% of these cases resulted in informal or written warnings or no further action.
What we could not confirm
PrimaryBrief could not confirm the specific disciplinary action taken against the employee who contacted Pippa Boardman. The number of criminal prosecutions resulting from data misuse across all reported incidents also remains unconfirmed.
SHOW YOUR WORK