Royal Cornwall Hospitals NHS Trust exposed sensitive health information relating to 8,003 workers after publishing an Excel spreadsheet that retained confidential sickness absence records, an independent review has found.
The spreadsheet was uploaded to the trust’s public Freedom of Information (FOI) disclosure log in February 2023. Its underlying records remained accessible through Excel pivot tables until a member of the public discovered the problem in November 2025.
- Royal Cornwall Hospitals NHS Trust exposed sickness absence and sensitive health information relating to 8,003 people through an Excel file published in February 2023.
- The spreadsheet remained publicly available for 33 months before the breach was discovered in November 2025. Available logs recorded 340 accesses, although actual exposure remains unknown.
- Staff assigned to a breach helpline reported inadequate training, safeguarding concerns and emotional distress. The service operated for 11 weeks instead of the planned two.
The breach affected 7,715 trust employees and 288 non-trust workers, alongside a small number of unidentified records.
The review, presented to the trust board on November 5, 2026, also documented the emotional strain experienced by staff assigned to a helpline for affected workers.
Call handlers reported receiving angry and distressed calls, dealing with potential domestic abuse safeguarding concerns and discovering that their own medical information had been exposed.
NHS staff faced distress while handling data breach calls
The trust established a helpline in December 2025 to support workers concerned about the disclosure of their personal information. Members of the clinical governance team were informed only a day before they were expected to staff the service.
Despite experience supporting patients through traumatic situations, employees received limited preparation for handling calls involving sensitive personal data and potential safeguarding risks.
“The staff working in the call centers had a short training session and then the calls started coming in within minutes of the team being set up,” the review stated.
Some employees had not finished reading the prepared script, which arrived approximately 30 minutes before the helpline opened. Call handlers described conversations involving shouting, anger and severe distress.
Particularly difficult cases involved individuals worried about sensitive health disclosures or potential risks associated with domestic abuse.
Staff reported having to assess safeguarding concerns without appropriate training or an established procedure. “This placed significant emotional burden on individuals working in the contact center, who were not prepared or provided support on how to deal with those,” the review found.
Many call handlers learned that their own records were among those exposed only after they had started supporting affected colleagues.
Employees also reported having little choice about participating and were expected to continue their regular duties alongside the additional workload. Several worked beyond scheduled hours or gave up weekends to maintain the service.
Originally scheduled to operate for two weeks, the helpline remained active for 11 weeks because of demand. It closed in February 2026.
Trust officials confirmed that the review and its findings had been shared with staff and published online.
How an Excel spreadsheet exposed confidential NHS records
The breach originated from a Freedom of Information request submitted in February 2023, believed to be from a journalist researching workplace stress in the NHS.
The trust prepared a spreadsheet containing sickness absence information and published it on its public FOI disclosure log.
Although staff believed sensitive information had been removed, the workbook retained underlying records accessible through its pivot-table functionality.
Those records contained personal and sensitive health information that would not ordinarily have been included in a public FOI response.
Investigators identified several failures in how the request was processed. The task was handled by the trust’s e-Rostering team rather than its People Information Unit, which had greater expertise in responding to information requests involving complex datasets.
The e-Rostering team used its own data to prepare the response but incorrectly concluded that confidential information had been removed.
Several established checks intended to prevent sensitive disclosures were missed.
Document inspection and approval procedures failed
The review found that an FOI officer either failed to use Excel’s Document Inspector or did not act on its findings.
Document Inspector can identify pivot tables and potentially hidden cached data, although it cannot establish whether the information is sensitive or automatically remove the underlying cache.
Staff also failed to follow instructions requiring the spreadsheet to be converted into a PDF before publication.
Investigators found that PDF conversion prevented users from navigating through the pivot tables to the underlying records. They could not, however, guarantee that converting the file would eliminate every possibility of hidden data remaining technically accessible.
At the time, the trust’s formal procedures did not require converting spreadsheets into CSV files, a format that would have removed the workbook’s pivot-table functionality and embedded cache.
Reviewers concentrated on whether the response answered the FOI request and met public relations requirements, assuming that the underlying information had already been adequately checked.
As a result, the spreadsheet was approved and published without the sensitive records being removed.
NHS health data remained exposed for 33 months
The spreadsheet remained publicly available for approximately 33 months before the trust was alerted to the issue in November 2025.
The trust could not establish how many people accessed the information during that period. Its available website logs covered only the preceding 12 months and recorded 340 accesses to the file.
Investigators warned that this figure could not be used to determine how many individuals viewed the confidential records.
Some accesses may have involved automated web crawlers rather than human users. The logs also did not establish whether anyone who opened the spreadsheet accessed the underlying pivot-table data.
The full extent of any actual viewing or subsequent use of the exposed information therefore remains unknown.
NHS trust introduces stricter spreadsheet security controls
Following the breach, Royal Cornwall Hospitals NHS Trust introduced changes to its FOI handling procedures. Excel workbooks included in FOI responses must now be password-protected. A senior information governance officer must approve spreadsheet responses before executive sign-off.
Updated guidance circulated in November 2025 also required spreadsheets to be converted into CSV format to prevent the disclosure of embedded pivot-table data.
Investigators found that the CSV requirement had not yet been incorporated into the formal standard operating procedure and recommended that the omission be corrected.
The review also examined the trust’s response to affected workers, including the preparation, training and support provided to employees operating the helpline.
The Information Commissioner’s Office subsequently closed its case after the trust implemented its recommendations.
The review identified failures in data preparation, technical checks and management oversight, alongside shortcomings in how the trust supported employees responding to the breach.
