Identity · Privacy
NHS Worker Accessed Patient Records and Shared Cancer Diagnosis Without Consent
A hospital worker at Royal Cornwall hospital accessed a patient's records and told her about her cancer diagnosis before her doctor. The NHS trust apologised and is reviewing its policies.
Ross Grant3 min read
The short version
A hospital worker at Royal Cornwall hospital looked at a woman's medical records and told her she had cancer before her doctor did. The woman said this was a serious invasion of her privacy. The NHS trust apologised and is reviewing its rules. This shows why protecting patient data is important.
What happened?
A hospital worker at Royal Cornwall hospital accessed a patient's medical records and told her about her cancer diagnosis before her doctor did. The NHS trust apologised and said it is reviewing its policies. The incident was reported by The Guardian and has not yet been confirmed by primary sources.
What happened at Royal Cornwall hospital
According to The Guardian (opens in a new tab), a woman named Pippa Boardman was told she had cancer by a hospital employee she barely knew. This person accessed her medical records at Royal Cornwall hospital in Truro before her official test results were delivered by her consultant. Boardman said the call came from a man she only knew vaguely through sport, who told her not to worry but that she had cancer. Two days later, her consultant confirmed the diagnosis.
Boardman described the experience as a loss of dignity and privacy. She said the way the hospital handled her complaint made her trauma worse, and that the trust only apologised after the BBC contacted them. The hospital trust has since apologised publicly and said it is reviewing its policies.
How the NHS responded
A spokesperson for the Royal Cornwall hospitals trust said the staff member had legitimate access to patient records as part of their job, but it was not their role to contact Boardman or discuss her diagnosis. The trust said this should not have happened and recognised the distress caused. They stated that an immediate investigation took place after Boardman raised her concerns. While the trust did not share details about any disciplinary action, it said it took the matter seriously and reminded staff about the importance of patient confidentiality.
The trust also said it is reviewing its policies and processes in light of new NHS England guidance on inappropriate access to patient information.
Why patient data privacy matters
Medical records contain sensitive personal information. In the UK, NHS staff are only allowed to access patient data for work-related reasons, and sharing information without consent is a breach of both NHS policy and data protection law. When someone accesses or shares your medical information without permission, it can cause distress and erode trust in healthcare providers.
The Information Commissioner's Office (ICO) can investigate serious breaches of patient confidentiality. Under UK GDPR, organisations can face fines of up to £17.5 million or 4% of global turnover for serious failures to protect personal data.
What happens next
The Royal Cornwall hospitals trust says it is reviewing its procedures and has reminded staff of their responsibilities. It is not yet clear what disciplinary action, if any, was taken against the staff member involved. The trust has apologised to Boardman and said it is taking the incident seriously.
For patients, this case is a reminder that they have the right to know who has accessed their records and to complain if they believe their privacy has been breached. NHS trusts are required to investigate such complaints and report serious incidents to regulators.
What you should do if you suspect a privacy breach
If you believe your medical records have been accessed or shared without your consent, you can:
- Ask your healthcare provider for an audit trail of who has accessed your records.
- Make a formal complaint to the NHS trust or GP practice.
- Contact the Information Commissioner's Office if you are not satisfied with the response.
Healthcare workers should only access patient records when it is necessary for their job, and never share information outside official channels.
Claimed vs confirmed
- Confirmed
A hospital worker accessed and shared a patient's cancer diagnosis without consent.
The Guardian reported this based on the patient's account and a statement from the NHS trust.
- Unconfirmed
The NHS trust only apologised after being contacted by the BBC.
This is based on the patient's statement to The Guardian; not confirmed by the trust.
Why it matters
Anyone using NHS services expects their medical records to be private. When staff access or share this information without permission, it can cause distress and undermine trust in the healthcare system. This case highlights the need for strong controls and clear consequences for misuse of patient data.
How does it work?
This incident involved inappropriate access to patient records by an NHS staff member. While the staff member had legitimate access for work, they used it outside their role and shared confidential information directly with the patient, which is against NHS policy and data protection law.
Key points
- A hospital worker accessed and shared a patient's cancer diagnosis without consent.
- The NHS trust apologised and is reviewing its data privacy policies.
- Patient data should only be accessed for legitimate work reasons.
- Breaches of medical privacy can cause distress and legal consequences.
- Patients have the right to know who accessed their records and to complain.
Sources
The Guardian
Reference
