After an NHS Data Exposure, the Helpline Staff Paid a Heavy Price

A review has found that NHS staff drafted into a helpline after a data breach faced distressed callers, safeguarding concerns and a "serious emotional impact". The report comes almost a year after Royal Cornwall Hospitals NHS Trust disclosed a breach affecting 8,003 people, including current and former trust staff and non-trust workers.

The exposure was found by a member of the public in November 2025. An Excel workbook released in response to a Freedom of Information request in February 2023 still held underlying sickness absence records, which users could reveal through its pivot tables.

The review describes calls involving shouting, anger and distress. Some callers were upset by the sensitivity of the disclosures, or were potentially in danger from domestic abuse. Handlers said they had to make safeguarding assessments without training or an established process. Members of the clinical governance team were told only a day beforehand that they would staff the helpline. Calls began within minutes of the team being set up, and some staff had not finished reading the script, which arrived 30 minutes before launch. Most learned their own data had been exposed while already on the helpline. They also said they had little choice about the work, were expected to keep up their usual duties, and some gave up weekends and worked long hours.