Woman told she had cancer by hospital employee who contacted her outside his role

Pippa Boardman says she lost her dignity and privacy after a Royal Cornwall Hospital worker contacted her before her consultant's appointment

By LineZotpaper

Published21 October 2026

Read Time2 min

Sources2 outlets

A woman was told she had cancer by a hospital employee who accessed her medical records days before she was due to receive test results from her consultant. Pippa Boardman, from Lostwithiel in Cornwall, said the breach at the Royal Cornwall Hospital in Truro left her feeling that she had lost her dignity and privacy.

Pippa Boardman said she received a phone call at home from a man she vaguely knew through sport who worked at the hospital. "This man said to me 'Pippa, I don't want you to worry, but you've got cancer'," she told the BBC. Two days later, her consultant confirmed she had breast cancer.

Nine months on, Boardman, who is now recovering well, said the experience had caused lasting harm. "I lost my dignity and I've lost my privacy," she said. She also criticised the hospital trust's handling of her complaint, saying it took a lot of courage to report the breach and that the trust only apologised after the BBC contacted it.

Boardman said the trust told her it could not give her information about the employee because of his rights. "I kept thinking where are my rights in this," she said.

The Royal Cornwall Hospitals NHS Trust said it was "truly sorry" and that "appropriate action had been taken" following an immediate investigation. It added: "Whilst the member of staff had legitimate access to her records as part of their work, it was outside of their role to contact her. This should not have happened and we recognise the distress and concern it will have caused."

The trust said it had reminded staff that records "must only ever be accessed for a legitimate work-related reason" and was reviewing its policies in light of strengthened NHS England guidance on inappropriate access to patient information.

The case comes after other recent NHS data breaches, which Health Secretary Yvette Cooper described as a disgrace.

Analysis

Why This Matters

The case highlights the vulnerability of patient data within the NHS, where staff with legitimate access can view and share sensitive information without proper safeguards.
It underscores the emotional toll of such breaches, particularly when patients are told life-changing news by someone unauthorised before they have received official medical advice.
The trust's initial handling of the complaint raises questions about how patient data rights are balanced against employment law and staff privacy.

Background

NHS staff have access to patient records as part of their duties, but strict rules prohibit sharing or using that information outside those duties. Recent breaches have included staff accessing records of high-profile cases, prompting stronger guidance from NHS England. The Royal Cornwall Hospital Trust has not disclosed the exact employment outcome for the employee involved, citing individual employment matters.

Key Perspectives

Pippa Boardman (patient): She feels her dignity and privacy were violated and that the hospital did not adequately support her after the breach. She wants to prevent others from experiencing the same trauma. Royal Cornwall Hospitals NHS Trust: It has apologised and says it took immediate action, but cannot share details of disciplinary measures. It emphasises that the employee had legitimate access as part of their role, but contacted the patient outside that role.

What to Watch

Whether the trust provides more transparency on the outcome of its investigation or any changes to access policies.
Any further NHS data breach cases that may prompt stricter enforcement or legislative changes.
Public and political pressure, following the Health Secretary's comments, for stronger patient data protections.

Sources

Data-breach NHS worker told woman she had cancer · BBC News
Data-breach NHS worker told woman she had cancer · BBC News

Checked

11 claims in this story checked against 1 source: 10 supported.

Show each claim

SupportedA hospital employee told Pippa Boardman she had cancer and contacted her outside his role.BBC News: “The Royal Cornwall Hospital Trust said it was “truly sorry” about how Boardman was contacted. It said: “Whilst the member of staff had legitimate access to her records as part of their work, it was outside of their role to contact her.””
SupportedBoardman was told she had cancer before her consultant appointment, after the employee accessed her record.BBC News: “A woman was told she had cancer by a hospital employee who accessed her record days before she was due to receive test results from her consultant.”
SupportedBoardman said the breach left her feeling she had lost her dignity and privacy.BBC News: “Pippa Boardman, from Lostwithiel in Cornwall, said she had lost her dignity and privacy through the data breach at the Royal Cornwall Hospital in Truro.”
SupportedBoardman quoted the man as saying, “Pippa, I don't want you to worry, but you've got cancer”.BBC News: ““This man said to me 'Pippa, I don't want you to worry, but you've got cancer'.””
SupportedTwo days later, Boardman's consultant told her she had breast cancer.BBC News: “Two days later Boardman was told by her consultant she did have breast cancer.”
SupportedNine months later, Boardman said the experience had caused lasting harm, although she was recovering well from cancer.BBC News: “Boardman, who is now recovering well from cancer, said her strong recovery did not undo the damage done by the experience... Nine months on, she said her strong recovery did not undo the damage done by the experience”
SupportedBoardman said she lost her dignity and privacy.BBC News: ““I lost my dignity and I've lost my privacy.””
SupportedBoardman said the trust apologised only after the BBC contacted it.BBC News: “She said she did not receive an apology from the hospital until it was contacted by the BBC.”
SupportedBoardman said the trust told her it could not give her information about the employee because of his rights.BBC News: “She said the trust told her the breacher's rights meant it could not give her information”
SupportedThe trust said it had reminded staff that records must only be accessed for a legitimate work-related reason and was reviewing policies in light of strengthened NHS England guidance.BBC News: “The trust said it had reminded staff records “must only ever be accessed for a legitimate work-related reason” and it was also reviewing policies “in light of the strengthened NHS England guidance on inappropriate access to patient information”.”
Partly supportedThe case came after other recent NHS data breaches that Health Secretary Yvette Cooper described as a disgrace.BBC News: “Along with Boardman's case there have also been other recent NHS data breaches, described by Health Secretary Yvette Cooper as a disgrace.”

Correction

21 October 2026An earlier version of this story said the hospital employee accessed Pippa Boardman's records without authorisation. The trust said he had legitimate access to her records but contacting her was outside his role.