# NHS Staff Faced Emotional Trauma Managing Data Breach Helpline Review reveals inadequate training and support for staff handling sensitive health data exposure. - **Source:** [www.theregister.com - Articles](https://www.theregister.com) - **Published:** 2026-11-07 - **Topic:** [health](https://brifing.si/c/health) - **Original article:** - **On Brifing:** https://brifing.si/s/70babd9c-0eaa-40b3-b0ab-6ba2b91d00ce ## Data Breach Helpline Crisis A review found that NHS staff assigned to a helpline following a major data breach faced significant emotional distress. The Royal Cornwall Hospitals NHS Trust exposed sickness records of 8,003 individuals online. Call handlers, many of whom were affected by the breach themselves, managed angry and traumatized callers without adequate preparation. ## Operational Failures and Stress Staff were drafted into the helpline with minimal notice and training. Many handlers were still reading their scripts when the first calls arrived. They were expected to balance these intense duties alongside their regular clinical responsibilities, often working weekends and extended hours to manage the high volume of incoming distress calls. ## Sensitive Data Exposure Mechanism The breach originated from a February 2023 Freedom of Information request response. The trust uploaded an Excel workbook containing hidden pivot tables that revealed underlying sickness absence data. This file remained publicly accessible for 33 months, with logs showing at least 340 access attempts before a member of the public reported it. ## Procedural and Oversight Lapses The e-Rostering team handled the FOI request instead of the specialized People Information Unit. Staff failed to use Excel’s Document Inspector or convert files to PDF, which would have mitigated the risk. Furthermore, the final sign-off process focused on public relations rather than verifying that sensitive data had been properly sanitized. ## Lack of Safeguarding Training Call handlers reported encountering callers in dangerous situations, including those at risk of domestic abuse. Despite the clinical background of some staff, they lacked specific training for handling these sensitive disclosures. The review noted that the emotional burden placed on these unprepared employees was a direct result of systemic organizational failures. ## Extended Helpline Operational Period Initially planned for a two-week duration in December 2025, the helpline remained active for 11 weeks due to sustained call volume. It was finally stood down in February 2026. Staff reported that the operation relied heavily on individual goodwill rather than established, well-resourced processes to support both callers and employees. ## New Security Mitigation Measures The trust has implemented mandatory password protection for all Excel workbooks used in FOI responses. A senior information governance officer must now approve all spreadsheet responses before executive sign-off. Revised guidance also suggests converting files to CSV format to strip pivot table functionality, though formal operating procedures require further updates. ## Accountability and Future Outlook The Information Commissioner's Office has closed its case following the trust's implementation of these recommendations. The Royal Cornwall Hospitals NHS Trust has issued a formal apology, acknowledging the distress caused to colleagues. Moving forward, the trust emphasizes its commitment to transparency by publishing the full independent investigation report online for public review. ## Sources covering this story - https://www.theregister.com/security/2026/11/07/nhs-breach-helpline-left-staff-carrying-a-significant-emotional-burden/5308201 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._