NHS breach helpline left staff carrying a 'significant emotional burden'

NHS workers who answered a helpline following a data breach suffered significant emotional distress, according to a review. The incident involved the Royal Cornwall Hospitals NHS Trust, which disclosed that 8,003 people's health data had been exposed online, including current and former staff members and non-trust workers. The breach was discovered in November 2025, a year after it had occurred.

Call handlers faced difficult calls involving shouting, anger, and distress, particularly from individuals who were distressed by the sensitivity of the disclosures or potentially in danger from domestic abuse. They had to make safeguarding assessments without proper training or a process in place. The review found that staff were not prepared for the calls and received little support on how to handle them.

Many staff members had to work long hours, including on weekends, to meet the demands of the helpline, and some only learned that their own data had been exposed while working on the helpline. The data breach was caused by a spreadsheet containing personal data and sensitive health information being uploaded to the Public FOI Disclosure log in February 2023, containing pivot tables that allowed users to reveal the underlying records.

The response to the Freedom of Information request was handled by the e-Rostering team instead of the People Information Unit, which had the expertise in responding to complex datasets. The spreadsheet was not converted to PDF or CSV, and standard procedures to remove sensitive data were skipped. The trust has since implemented changes to prevent a recurrence of the breach, including mandatory password-protection of Excel workbooks and revised guidance on data handling.