NHS Staff Faced Emotional Trauma Managing Data Breach Helpline
Review reveals inadequate training and support for staff handling sensitive health data exposure.
1Data Breach Impact
The Royal Cornwall Hospitals NHS Trust inadvertently exposed sickness absence records and sensitive health data for 8,003 individuals. The breach occurred when an Excel workbook, provided in response to a 2023 Freedom of Information request, retained hidden pivot tables. This sensitive information remained publicly accessible online for approximately 33 months before discovery.
2Helpline Staff Distress
Staff assigned to the emergency helpline faced significant emotional burdens while managing distressed callers. Handlers reported frequent instances of shouting and anger from those affected by the disclosure. Many callers expressed fears regarding domestic abuse or the sensitivity of their exposed health records, leaving staff overwhelmed and lacking necessary psychological support.
3Operational Failures
The helpline was established with minimal preparation, as staff were notified only one day before operations began. Many handlers received only a short training session and had not finished reading the provided scripts before calls commenced. Furthermore, staff were expected to manage these high-pressure calls while simultaneously maintaining their regular job duties.
4Internal Data Exposure
In a compounding failure, many employees staffing the helpline discovered their own personal data had been exposed while actively supporting other victims. This realization occurred minutes before they were required to assist others, adding a layer of personal trauma to their professional responsibilities during the 11-week duration of the helpline.
5Technical Oversight Causes
The breach originated from the e-Rostering team handling an FOI request instead of the specialized People Information Unit. Staff failed to use Excel's Document Inspector or convert the file to PDF, which would have mitigated the risk. Internal sign-off processes focused on public relations rather than verifying the sanitization of complex datasets.
6Duration and Scope
Although initially planned for two weeks in December 2025, the helpline operated for 11 weeks due to high call volumes. The trust reported that the exposed spreadsheet was accessed 340 times in the year preceding the discovery, though it remains unclear how many of these views involved human access versus automated web crawlers.
7Corrective Measures Implemented
The trust has since mandated password protection for all Excel workbooks used in FOI responses. A senior information governance officer must now approve all spreadsheet responses prior to executive sign-off. Additionally, updated guidance encourages converting files to CSV formats to strip hidden cache and pivot table functionality, preventing similar future incidents.
8Accountability and Transparency
The Information Commissioner's Office has closed its investigation following the trust's implementation of these security recommendations. The Royal Cornwall Hospitals NHS Trust has published the full independent report online to ensure transparency. They continue to offer support to affected colleagues while acknowledging the severe distress caused by the mishandling of personal information.