NHS data breach helpline staff faced 'significant emotional burden', review finds

A member of the public discovered the exposure in November 2025. An Excel workbook published in response to a Freedom of Information request in February 2023 had retained underlying sickness absence records through pivot tables that users could reveal. The breach affected 8,003 people, including current and former trust staff and non-trust workers.

Call handlers described difficult calls involving shouting, anger and distress. Some callers were potentially in danger from domestic abuse, and call handlers said they had to make safeguarding assessments without training or an established process. 'Such occurrences of anger or distress were not infrequent, and this reflected the heightened emotions and distress experienced by callers to varying degrees due to the breach,' the review noted. 'This placed significant emotional burden on individuals working in the contact center, who were not prepared or provided support on how to deal with those.'

Members of the trust's clinical governance team were told just a day beforehand that they would staff the helpline. Despite their experience dealing with patient trauma, they received little preparation. 'The staff working in the call centers had a short training session and then the calls started coming in within minutes of the team being set up,' the review noted. 'Some staff had not finished reading the pre-prepared script which had arrived only 30 minutes before the center went live.'

Most call handlers only learned that their own data had been exposed while already working on the helpline, sometimes minutes before supporting others. They said they had little choice about taking on the work and were expected to maintain their usual duties. The review stated that some staff gave up weekends and worked long past their scheduled hours. 'It's typical NHS, it runs on goodwill,' one staffer told the team that compiled the report.

The call center was only supposed to run for two weeks in December 2025 but was stood down after 11 weeks, in February 2026, because of the volume of calls.

The review traced the breach to how the FOI request was handled. The e-Rostering team, not the People Information Unit, compiled the response and incorrectly believed they had stripped sensitive data. The officer assigned to the response either failed to run the spreadsheet through Excel's Document Inspector or failed to act on its recommendations. Staff failed to convert it to PDF as instructed. At the time, internal guidance did not require conversion to CSV, which would have removed the pivot-table functionality. Sign-off processes assumed the data had been sanitised.

The spreadsheet was available for 33 months. The trust is not sure how many times it was viewed; logs covering only the 12 months before the alert showed 340 accesses, although some may have been web crawlers.

The trust has since implemented changes, including mandatory password-protecting of Excel workbooks in FOIA responses and requiring a senior information governance officer to approve spreadsheet responses before executive sign-off. Revised guidance calls for conversion to CSV, though that requirement has not yet been incorporated into formal operating procedures. The review says the Information Commissioner's Office closed its case after the trust implemented its recommendations.

A spokesperson for the Royal Cornwall Hospitals said the trust was deeply sorry for the accidental sharing of sickness absence data and for the distress and concern it caused colleagues whose data was involved. The trust said an independent investigation had been completed and the report published in full, and measures had been implemented to strengthen processes around FOI requests. 'The protection of personal information is of the utmost importance to us, and we remain committed to learning from this incident and preventing a similar event from happening again,' the spokesperson said.