Woman told of cancer diagnosis by staff member she hardly knew

A patient received a breast cancer diagnosis from a hospital employee whom she barely knew after the individual accessed her medical records days before her scheduled consultant appointment.

Pippa Boardman, from Cornwall, stated that an acquaintance from a local sports group phoned her at home to inform her of the diagnosis, causing significant distress and a loss of personal privacy. Her consultant officially confirmed the breast cancer diagnosis two days later. Boardman expressed frustration with the trust's initial response, saying it issued an apology only after the BBC contacted officials.

The Royal Cornwall Hospitals National Health Service (NHS) Trust acknowledged the incident and apologised, conceding that contacting a patient to discuss a clinical diagnosis fell entirely outside the staff member's professional remit, despite the worker having a legitimate reason to access her records. The trust confirmed it conducted an internal investigation and took appropriate action. Officials said they reminded staff of patient confidentiality obligations and are reviewing internal data-handling procedures in line with strengthened NHS England guidance on unauthorised access to patient records.

Training announcement: Freevacy provides comprehensive training for new and existing practitioners on the changes introduced by the DUA Act to the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 (DPA18), and the Privacy and Electronic Communications Regulations 2003 (PEC-Regulations). Our courses are always up to date and provide a forum for learning and discussing how to ensure your data protection processes remain compliant. Find out more.