A woman awaiting cancer test results was told she had the disease in a phone call from a hospital employee she barely knew — a man who had inappropriately accessed her confidential medical records to contact her. Pippa Boardman, from Lostwithiel in Cornwall, described losing her dignity and privacy through the data breach at the Royal Cornwall Hospital in Truro, the BBC reported.
Boardman told the BBC the call came at home, from a man she knew only through the sport she plays. He told her: "Pippa, I don't want you to worry, but you've got cancer." She said she could hardly believe what she was hearing.
The call came days before she was due to receive her results from her consultant. Two days later, the consultant confirmed what the unauthorised caller had said: Boardman had breast cancer, the British Bulletin reported. She is now recovering well — but says the way she learned of her diagnosis has left lasting damage.
"I lost my dignity and I've lost my privacy," she said, nine months on. She added that the trust had apologised only after the BBC contacted it about her case, and that its handling of the affair had deepened her trauma.
Royal Cornwall Hospital at Treliske, Truro
The Royal Cornwall Hospital site at Treliske, Truro. (David Dixon, CC BY-SA 2.0, via Wikimedia Commons)
A breach of trust — and of the law
NHS staff are only permitted to access patient records when they have a direct clinical or administrative reason to do so. Accessing a patient's file out of personal curiosity — or to pass on their diagnosis in a private phone call — is a serious breach of data protection rules and NHS professional standards.
The trust said it was "truly sorry" for what happened and that appropriate action had been taken, NewsATW reported. It declined to disclose details of any employment action, saying it could not discuss individual staff matters, but insisted it had treated the case extremely seriously.
The case raises questions that go well beyond one phone call. Patient record systems log every access, and NHS trusts are required to audit access and act on inappropriate snooping. For Boardman, the failure was not only that her records were accessed, but that the institution's response deepened the harm: she says the apology came only after media involvement, not through the trust's own complaints process.
Part of a wider pattern
Boardman's case is not isolated. Recent months have seen a string of NHS data breaches that prompted the Health Secretary, Yvette Cooper, to describe them as a "disgrace", The Guardian reported. The incidents have fuelled growing concern about whether health services under pressure are maintaining the data governance standards patients expect.
Trust in the handling of medical records is foundational to the NHS. Patients share their most sensitive information — diagnoses, mental health histories, family circumstances — on the understanding that it will only ever be seen by those directly involved in their care. When that trust is broken, the damage extends beyond the individual case: it can make patients reluctant to seek care or to be fully honest with their clinicians.
The NHS's own support services and public health programmes depend on patients' confidence that the system is safe. Each breach of the kind Boardman suffered erodes that confidence a little further.
Accountability and the questions that remain
The trust has not disclosed what "appropriate action" means in practice, citing the confidentiality of employment matters — a standard position, but one that leaves the public unable to judge whether the response was proportionate. Data protection law allows serious cases of unauthorised access to be referred to the Information Commissioner's Office, which can investigate and fine organisations that fail to protect personal data, as wider coverage of the case noted.
For patient advocates, the case highlights a recurring tension in health system governance: institutions often move quickly to contain reputational damage while being slow to acknowledge fault to the person harmed. Boardman's account — that contrition arrived only after journalists called — will be familiar to families who have fought for answers after NHS failings.
Why how a diagnosis is delivered matters
Delivering a cancer diagnosis is one of the most delicate tasks in medicine. Standard practice is for the news to be broken by a clinician — usually the consultant responsible for the patient's care — in a setting where the patient can ask questions, bring someone for support, and receive immediate information about next steps. The manner of delivery is part of the care itself.
Boardman's experience inverted all of that. She received life-altering news from someone with no clinical responsibility for her care, at home, without warning or support — and from a person who had violated her privacy to obtain it. The shock of the diagnosis and the violation of the breach became inseparable, compounding one another in a way no complaints process could easily untangle.
Why this matters
Beyond the headlines, Boardman's story is a reminder of what data protection means in human terms. A diagnosis of breast cancer is one of the most consequential pieces of news a person can receive. It should be delivered by a clinician, in a setting where questions can be asked and support offered — not blurted out over the phone by an acquaintance who had no right to know.
Nine months after the call, Boardman is recovering well from her cancer. But recovery from the illness, she says, has not undone the damage done by the breach. Her dignity and privacy, she told the BBC, are gone — and no apology, however belated, can return them.
