# NHS Staff Faced Emotional Trauma Managing Data Breach Helpline Review reveals inadequate training and support for staff handling sensitive health data exposure. - **Source:** [The Register](https://www.theregister.com) - **Published:** 2026-11-07 - **Topic:** [health](https://brifing.si/c/health) - **Original article:** - **On Brifing:** https://brifing.si/s/6573af9a-03ce-451f-95a7-552496a915b7 ## Severe Emotional Impact Reported A review into the Royal Cornwall Hospitals NHS Trust data breach found that staff assigned to a support helpline faced significant emotional distress. Handlers were forced to manage angry and vulnerable callers without proper preparation. The helpline was established after sensitive health data of 8,003 individuals was exposed online. ## Inadequate Preparation for Staff Clinical governance team members were assigned to the helpline with only one day of notice. Staff received minimal training and were often forced to start answering calls before finishing the provided scripts. Many handlers discovered their own personal data had been exposed while actively working on the support line. ## Operational Strain and Goodwill Call handlers were expected to manage the helpline alongside their regular duties, leading to excessive overtime and weekend work. The helpline, initially planned for two weeks, remained operational for 11 weeks due to high call volumes. Staff reported that the entire response relied heavily on individual employee goodwill. ## Technical Failure in Disclosure The breach originated from an Excel workbook published in February 2023 in response to a Freedom of Information request. The file contained hidden pivot tables that retained sensitive sickness absence records. The e-Rostering team, lacking specialized FOI expertise, failed to sanitize the document before uploading it to the public log. ## Procedural Lapses and Oversight Internal procedures were bypassed during the FOI response process. Staff failed to use Excel's Document Inspector or convert the file to a safer format like PDF or CSV. Furthermore, the final sign-off process focused on public relations rather than verifying that all sensitive data had been effectively removed from the file. ## Long-term Data Exposure The sensitive spreadsheet remained publicly accessible for 33 months before a member of the public alerted the trust in November 2025. Web logs indicated at least 340 access attempts during the final year. It remains unclear how many times the hidden pivot tables were actually accessed by human users. ## Corrective Measures Implemented The trust has introduced mandatory password protection for all Excel workbooks used in FOI responses. A senior information governance officer must now approve all spreadsheet disclosures before executive sign-off. Revised guidance now emphasizes converting files to CSV format to prevent the retention of hidden cached data or pivot tables. ## Accountability and Future Outlook The Information Commissioner's Office closed its case after the trust implemented these recommended security improvements. The trust has issued a formal apology and published the full investigation report to ensure transparency. Ongoing support remains available for affected colleagues as the organization attempts to rebuild trust following this significant incident. ## Sources covering this story - https://www.theregister.com/security/2026/11/07/nhs-breach-helpline-left-staff-carrying-a-significant-emotional-burden/5308201 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._