NHS breach helpline left staff carrying a 'significant emotional burden'

NHS staff who handle sensitive data are now more likely to receive training and support for dealing with distressed callers, a change that comes after an 11-week helpline operation.

The Royal Cornwall Hospitals NHS Trust's helpline, established after an August 2025 data breach exposed the health and sickness absence records of 8,003 individuals, placed a significant emotional burden on staff. Drawn from the clinical governance team with only a day's notice, these staff handled distressed callers, including those experiencing domestic abuse, and were forced to make safeguarding assessments without adequate training or established processes. Many handlers learned their own data was compromised while on duty, and reported feeling they had little choice but to take on the work, often sacrificing personal time. The helpline, initially intended for two weeks, operated for 11 weeks due to call volume, concluding in February 2026. The data breach itself occurred when a spreadsheet, initially uploaded in February 2023 in response to a FOI request, was found to contain pivot tables revealing sensitive sickness absence records, a failure attributed to incorrect handling by the e-Rostering team instead of the designated People Information Unit, and a lapse in standard data sanitization procedures.

The incident highlights a critical gap in how public sector organizations manage sensitive data disclosures and the human cost of such breaches. The trust's reliance on 'goodwill' and the lack of preparedness for call handlers underscore a systemic issue in resource allocation and staff support during crises. This situation is likely to prompt a re-evaluation of incident response protocols, emphasizing the need for dedicated, trained personnel and robust support mechanisms to mitigate the psychological impact on employees.

Going forward, this breach may lead to stricter mandates for data sanitization, particularly for FOI requests involving complex datasets. The extended operation of the helpline and the emotional toll on staff suggest that future protocols must proactively address the potential for extended support needs and ensure that employees are adequately resourced and psychologically prepared for such scenarios, rather than being treated as an expendable resource.