Myles Bradbury was jailed for 16 years after admitting abusing 18 victims at Addenbrooke's Hospital in Cambridge.
Bradbury manipulated the system to perform "criminal, intimate examinations", the report found.
Staff noticed he was seeing patients out-of-hours, but presumed he was doing it to help them out.
The hospital had a rule that a chaperone should be present for these examinations but it was often ignored.
A doctor confronted Bradbury, from Herringswell, Suffolk, when she noticed he was seeing a boy on his own, but he said it was at the patient's request.
He told families it was "essential for him to see their child alone" and they should learn to trust doctors, the independent investigation found.
Bradbury, who used a "spy pen" to secretly capture pictures of his partially-clothed victims, was arrested in December 2013. He admitted 25 offences dating between 2009 and 2013, including sexual assault, voyeurism and possessing more than 16,000 indecent images.
However, the report found there had been several clues to his offending prior to this.
The 42-year-old, who worked as a blood cancer specialist at the hospital for five years, phoned families on his personal number to make appointments.
He saw some children more often than necessary but failed to record these consultations, according to the report by Verita, a consultancy which specialises in public sector investigations.
Other key points from the report, commissioned by Addenbrooke's, included:
Doctors explained he spent a lot of time "ingratiating himself" into families' affections and his office wall was covered in letters from children.
Dr Jag Ahluwalia, medical director of the trust, told the investigation his staff were also "duped" by Bradbury.
"To a degree I have beaten myself up over it, and so have his paediatric oncology colleagues, but I think they were all groomed along the way," he told the investigation.
Myles Bradbury always had a plausible answer whenever he was challenged. Always quick with a cover story, his lies kept him safe for years.
The exact number of children he molested is unknown. He abused the trust of everyone, twisting and manipulating hospital policies and systems.
When he drew a curtain around his young patient, he knew no professional or parent would invade his privacy.
It gave him confidence to carry out his attacks, as parents stayed just feet away, unaware of what was going on.
The Cambridge University Hospitals NHS Foundation Trust, which runs the hospital, was praised for acting decisively after a concern was raised in November 2013.
A woman complained her 11-year-old grandson, who was in remission from leukaemia, was asked to strip naked and touch his own genitals.
She rang the paediatric day unit and told the receptionist. Bradbury was then suspended and never returned to the hospital except for formal interviews.
Addenbrooke's contacted Suffolk police, which had two weeks previously been independently alerted to a Canadian police investigation into Bradbury after he purchased an online video of naked children.
Bradbury was initially jailed for 22 years but this was later reduced on appeal to 16 years' imprisonment and six years on licence.
Report authors Lucy Scott-Moncrieff and Barry Morris interviewed Bradbury in prison. He told them he "knew that what he did was wrong" and was "very sorry".
Bradbury said that he "did not want to excuse his behaviour" and was willing to talk in the hope that this would reduce the risk of other children being harmed in the future.
The trust said it wanted "to say sorry again" to its patients and families who "placed their trust" in Bradbury.
"This has been a deeply distressing case and the NHS must learn from it," said David Wherrett, acting chief executive of Cambridge University Hospitals Foundation Trust.
"My message to other organisations is that as well as enforcing robust policies, we need to raise awareness of much more manipulative behaviour by individuals like Bradbury.
"Greater rigour and checks will make it more difficult for abuse to take place."
A paedophile doctor was able to abuse young cancer patients undetected after clues to his offending were missed, an investigation has found.