NHS Staff Faced Emotional Trauma Managing Data Breach Helpline
Review reveals inadequate training and support for staff handling sensitive data exposure fallout.
1Helpline Staff Faced Trauma
Employees tasked with managing a helpline for victims of a major data breach reported significant emotional distress. Staff were unprepared for the intensity of calls from affected individuals, including those fearing domestic abuse. The helpline was established after the Royal Cornwall Hospitals NHS Trust accidentally exposed sensitive health records online.
2Inadequate Preparation and Training
Clinical governance team members were assigned to the helpline with only one day of notice. Many handlers began answering calls within minutes of the center opening, often before finishing the provided script. Some staff discovered their own personal data had been compromised while actively supporting other victims on the phone.
3Operational Strain and Goodwill
Staff were expected to balance helpline duties alongside their regular professional responsibilities. This led to extended working hours and the sacrifice of weekends to meet the high volume of incoming calls. The helpline, initially planned for two weeks, remained operational for eleven weeks due to the sustained demand from affected individuals.
4Root Cause of Exposure
The breach originated from an Excel workbook published in February 2023 in response to a Freedom of Information request. The file contained hidden pivot tables that retained sensitive sickness absence data for over 8,000 people. The document remained publicly accessible for 33 months before a member of the public identified the issue.
5Procedural Failures Identified
The e-Rostering team handled the request instead of the specialized People Information Unit. Standard sanitization steps, such as using Excel’s Document Inspector or converting files to PDF, were skipped or ignored. The final sign-off process focused on public relations rather than verifying that the sensitive underlying data had been properly removed.
6Limited Oversight of Access
Logs indicated the exposed spreadsheet was accessed 340 times during the year preceding the discovery. However, the trust could not determine how many of these views involved human interaction versus automated web crawlers. It remains unclear how many times the sensitive pivot tables were actually opened by unauthorized third parties during that period.
7Implemented Security Reforms
The trust has introduced mandatory password protection for all Excel workbooks shared in FOI responses. A senior information governance officer must now approve all spreadsheet disclosures before final executive sign-off. Revised guidance also mandates converting files to CSV format to ensure that pivot table functionality and hidden caches are completely removed.
8Accountability and Future Outlook
The Information Commissioner's Office closed its case after the trust implemented the recommended security improvements. The Royal Cornwall Hospitals NHS Trust has published the full independent review to ensure transparency. Moving forward, the organization remains committed to providing ongoing support for the colleagues affected by this significant lapse in data privacy.