Royal Cornwall NHS Trust Exposed Staff Health Records in Public Excel Workbook

Royal Cornwall Hospitals NHS Trust exposed sensitive sickness absence and health records in an Excel workbook published in February 2023 in response to a Freedom of Information request. Hidden information remained publicly accessible for 33 months until a member of the public discovered it in November 2025. The breach affected 8,003 people, including thousands of current and former staff. The trust acknowledged significant distress, loss of trust, and ongoing anxiety among affected employees.

An independent review identified failures in request allocation, spreadsheet sanitization, procedural compliance, and final approval. It also found inadequate preparation and support for helpline staff handling distressed callers, leaving them with a significant emotional burden. The trust strengthened its information governance controls, and the Information Commissioner’s Office closed its case after the trust implemented its recommendations. The findings highlight the need to inspect hidden spreadsheet content before publication and prepare incident-response teams to support both affected individuals and frontline staff.