NHS breach helpline left staff carrying a 'significant emotional burden'

Team given a day's notice faced distressed callers, safeguarding decisions during project that stretched from 2 weeks to 11

NHS staff drafted into a helpline after colleagues' health data was exposed online faced distressed callers, safeguarding concerns, and a "serious emotional impact," a review has found.

The report [PDF] comes almost exactly a year after the Royal Cornwall Hospitals NHS Trust disclosed a data breach affecting 8,003 people, including current and former trust staff and non-trust workers.

A member of the public discovered the exposure in November 2025. An Excel workbook published in response to a Freedom of Information request in February 2023 retained underlying sickness absence records that users could reveal through its pivot tables.

REG AD

Staff assigned to the helpline described difficult calls involving shouting, anger, and distress.

REG AD

Particularly difficult calls involved people distressed by the sensitivity of the disclosures or potentially in danger from domestic abuse. Call handlers said they had to make safeguarding assessments without training or an established process.

"Such occurrences of anger or distress were not infrequent, and this reflected the heightened emotions and distress experienced by callers to varying degrees due to the breach," the review noted.

"This placed significant emotional burden on individuals working in the contact center, who were not prepared or provided support on how to deal with those."

Members of the trust's clinical governance team were told just a day beforehand that they would staff the helpline. Despite their experience dealing with patient trauma, they received little preparation for the calls that followed.

"The staff working in the call centers had a short training session and then the calls started coming in within minutes of the team being set up," the review noted. "Some staff had not finished reading the pre-prepared script which had arrived only 30 minutes before the center went live."

Most call handlers only learned that their own data had been exposed while already working on the helpline, sometimes minutes before supporting others affected.

Call handlers also said they had little choice about taking on the work and were expected to maintain their usual duties alongside it.

The review stated that some staff members gave up weekends and worked long past their scheduled hours to meet the demands of both roles.

REG AD

"It's typical NHS, it runs on goodwill," one staffer told the team that compiled the report.

The call center was only supposed to run for two weeks in December 2025, but due to the volume of calls, it was eventually stood down after 11 weeks, in February 2026.

According to officials speaking at a trust board meeting on Thursday, the review and its findings have since been circulated among staff, and published online.

How the spreadsheet slipped through

Responding to a Freedom of Information Act (FOIA) request thought to be from a journalist researching a story about stress in the NHS, the Royal Cornwall Hospitals NHS Trust uploaded a spreadsheet to its public FOI Disclosure log in February 2023.

This contained personal data and inadvertently exposed sickness absence information and sensitive health data related to 7,715 staff, 288 non-trust workers, as well as a small number of unidentified records.

Crucially, this spreadsheet was uploaded in a format that allowed users to access the pivot table from which some data was derived. The data in these pivot tables would normally have been too sensitive to be included in FOIA responses.

The first failure was that the request was handled by the trust's e-Rostering team instead of the People Information Unit, which had the expertise in responding to FOIA requests with complex datasets.

REG AD

The e-Rostering team compiled the response using the team's own data, but incorrectly believed they had stripped the spreadsheet of the sensitive data that would later be exposed.

Standard procedures instructed request handlers to follow several steps to ensure sensitive data was stripped before documents are published, some of which were skipped.

For starters, one FOI officer assigned to the response either failed to run the spreadsheet through Excel's Document Inspector, which formed part of the usual procedures, or failed to act upon its recommendations.

This feature can flag pivot tables and potentially hidden cached data, but cannot determine whether that data is sensitive or automatically remove the cache.

Staff also failed to follow instructions to convert the spreadsheet to PDF. Investigators found that doing so prevented users clicking through to the underlying records, although they could not guarantee that no hidden data remained technically accessible.

At the time, internal guidance did not require conversion to CSV, which would have removed the workbook's pivot-table functionality and embedded cache.

The trust's sign-off process also focused on answering the request's questions and meeting their public relations duties, and falsely assumed that the data had been adequately sanitized before the final review.

The spreadsheet was made available for 33 months, although the trust is not sure how many times it was viewed during that time.

Its logs only covered the 12 months before a member of the public alerted it to the pivot table issue. These indicated that it had been accessed 340 times, although the review noted there was no way of knowing how many of these, if any, led to pivot tables being accessed, or even if it was viewed by a human, with web crawlers adding to the total view count.

The trust has since implemented a number of changes to prevent a recurrence of the breach, including the mandatory password-protecting of any Excel workbook as part of FOIA responses.

A senior information governance officer must now approve spreadsheet responses before executive sign-off. Revised guidance circulated in November 2025 also called for conversion to CSV, although investigators found that this requirement had not been incorporated into the formal operating procedure and recommended updating it.

The review says the Information Commissioner's Office closed its case after the trust implemented its recommendations.

A spokesperson for the Royal Cornwall Hospitals said: "We are deeply sorry for the accidental sharing of sickness absence data which we reported in November 2025, and for the distress and concern it caused those colleagues whose data was involved.

"An independent investigation has now been completed, and the report has been published in full on our website in the interests of transparency and accountability.

"The investigation has helped us understand what happened and identify areas where improvements were needed. We have already implemented a number of measures to strengthen our processes, particularly around the management of Freedom of Information requests and responses.

"The protection of personal information is of the utmost importance to us, and we remain committed to learning from this incident and preventing a similar event from happening again.

"We continue to provide support to colleagues who have been affected." ®