Data breach caused staff 'significant distress' - Yahoo
A large data breach at the Royal Cornwall Hospitals NHS Trust exposed personal health information of nearly 8,000 staff, causing significant distress and loss of trust.
A large data breach at the Royal Cornwall Hospitals NHS Trust led to staff experiencing "significant distress, loss of trust and ongoing anxiety", according to a trust board meeting. The breach exposed personal health information relating to almost 8,000 current and former staff.
Breach details
A spreadsheet published in February 2023 exposed hidden sickness absence data, including sensitive health information, relating to 7,715 trust staff and 288 non-trust workers. The information remained publicly available until November 2025.
Board chairman David Allen emphasized that the trust wanted to deal with the data breach "honestly, openly and transparently".
This is something that clearly should never have happened and I'm sure the board would want to associate itself with the apology to everyone affected, which the chief executive and chief nursing officer have already given.
Investigation findings
An independent investigation identified weaknesses across data preparation, review, sign-off and publication. Bernie George, the trust's acting chief nursing officer, acknowledged the "absolute distress and loss of trust this caused".
We have further work to do to improve safeguards across data sharing, digital literacy, instant preparedness and compassionate staff support.
The investigation found inadequate safeguards against hidden spreadsheet data and failure to follow the requirement to convert the response to PDF. Controls have been strengthened, and the Information Commissioner's Office has closed its case following implementation of its recommendations.
Related
