NHS breach helpline left staff carrying a 'significant emotional burden'

The Royal Cornwall Hospitals NHS Trust published an Excel workbook in February 2023 while answering a Freedom of Information request. The file appeared to provide the requested information, but it still contained underlying sickness absence records. Those records included sensitive health data that should not have been publicly accessible.

A member of the public discovered the exposure in November 2025. The affected information covered 7,715 staff, 288 non-trust workers, and a small number of unidentified records. The wider figure reported by the trust was 8,003 people, including current and former trust staff and non-trust workers.

The breach mattered because health information can be highly personal and could cause distress or create safety risks when exposed. Some callers to the trust’s helpline were distressed by the disclosures, while others raised domestic abuse and safeguarding concerns. The trust later reviewed both the publication failure and its response.

A pivot table is an Excel tool that organises and summarises large amounts of data. It can show totals or categories without displaying every underlying record. However, the workbook can retain the source data and connections behind that summary. If those elements remain accessible, users may be able to investigate information that was meant to stay hidden.

That happened in the Royal Cornwall Hospitals NHS Trust spreadsheet. The workbook was uploaded in response to a Freedom of Information request, but its pivot table remained available. Users could reveal underlying sickness absence records through the pivot-table functions. The exposed material included sensitive health data related to staff and non-trust workers.

The trust’s Document Inspector could flag pivot tables and hidden cached data, but it could not judge sensitivity or remove the cache automatically. Investigators also found that converting the file to PDF prevented users from clicking through to the underlying records. Converting it to CSV would have removed the pivot-table functionality and embedded cache.

The Royal Cornwall Hospitals NHS Trust reported that 8,003 people were affected by the data breach. This included current and former trust staff, non-trust workers, and a small number of unidentified records. The detailed breakdown listed 7,715 staff and 288 non-trust workers whose sickness absence and health information was exposed.

The spreadsheet was uploaded to the trust’s public Freedom of Information disclosure log in February 2023. A member of the public discovered the exposure in November 2025. That means the workbook remained publicly available for about two years and nine months, based on the months given in the article.

The exposure was not caused by a new file being published in 2025. It was an older response that retained hidden or underlying data. After discovery, the trust disclosed the breach, created a helpline, and commissioned a review. The helpline was eventually stood down after 11 weeks because call volumes remained high.

The exposed information was sensitive enough to cause serious distress among people who contacted the trust. Call handlers described shouting, anger, and emotional upset. Some callers feared the disclosure could put them in danger, particularly where domestic abuse was involved. These conversations created safeguarding concerns that staff had to assess.

The helpline staff were not trained or given an established safeguarding process for those situations. They received only a short training session, and some had not finished reading the script before calls began. Many learned that their own information had been exposed while already supporting other affected people. The review described a significant emotional burden.

The helpline was initially planned for two weeks in December 2025. High call volumes kept it operating for 11 weeks, until February 2026. Staff often continued their usual duties, gave up weekends, and worked beyond scheduled hours. The review found that the response affected both callers and the people providing support.

The trust needed people to answer affected workers’ questions after the spreadsheet exposure was discovered. Members of the clinical governance team were told only one day beforehand that they would staff the helpline. The team was chosen partly because its members had experience dealing with patient trauma, but that experience did not prepare them for this breach response.

Most call handlers learned that their own information was exposed while they were already working on the helpline. They therefore supported callers while processing their own concerns. Staff said they had little choice about taking on the work and were expected to maintain their normal duties alongside it. Some worked weekends and stayed well beyond scheduled hours.

The helpline was meant to operate for two weeks in December 2025. Call volumes forced the trust to keep it open for 11 weeks, until February 2026. Preparation was minimal: a short training session was followed by calls within minutes, and some staff had not finished reading the script.

The trust had procedures designed to remove sensitive information before publishing FOI responses. These included checking the workbook with Excel’s Document Inspector and converting the spreadsheet to PDF. The guidance also required careful review before final sign-off. Following these steps mattered because a workbook could retain hidden pivot tables or cached data even when visible content looked safe.

Investigators found that the assigned FOI officer either did not run Document Inspector or did not act on its recommendations. Staff also failed to convert the spreadsheet to PDF. Investigators found that PDF conversion prevented users from clicking through to underlying records. At the time, guidance did not require conversion to CSV, which would have removed the pivot-table functions and embedded cache.

The response was also handled by the e-Rostering team rather than the People Information Unit, which had specialist expertise with complex datasets. The e-Rostering team wrongly believed it had removed the sensitive material. Final review focused on answering questions and public relations, and assumed the data was sanitised.

Health information is treated as especially sensitive because it can reveal private details about a person’s condition, absence, or treatment. In this case, the exposed sickness records caused distress and raised possible domestic abuse and safeguarding concerns. The review described a serious emotional impact on callers and on staff who handled their calls.

When organisations publish information under freedom-of-information laws, they must separate information that can be released from personal data that should remain protected. The trust’s procedures required checks before publication. Document Inspector could flag pivot tables and cached data, while PDF conversion prevented users from clicking through to underlying records. CSV conversion would have removed the workbook’s pivot-table functionality and embedded cache.

The article shows that a visible spreadsheet can appear sanitised while still retaining hidden information. Organisations therefore need specialist handling, meaningful technical checks, and a final review that tests what members of the public can actually access. The trust’s process missed those protections, allowing the workbook to remain public until November 2025.