Data breach caused staff 'significant distress'
BBCA large data breach at a hospital trust led to staff experiencing "significant distress, loss of trust and ongoing anxiety", a meeting has heard.
The Royal Cornwall Hospitals NHS Trust breach exposed personal health information relating to almost 8,000 current and former staff.
A spreadsheet published in February 2023 exposed hidden sickness absence data, including sensitive health information, relating to 7,715 trust staff and 288 non-trust workers, with the information having remained publicly available until November 2025, the trust board meeting heard.
An independent investigation identified weaknesses across many areas. Hospital bosses apologised and said it should never have happened.
Board chairman David Allen said the trust wanted to deal with the data breach "honestly, openly and transparently".
He added: "This is something that clearly should never have happened and I'm sure the board would want to associate itself with the apology to everyone affected, which the chief executive and chief nursing officer have already given."
Bernie George, the trust's acting chief nursing officer, acknowledged the "absolute distress and loss of trust this caused".
The board meeting on Thursday said the independently commissioned investigation had been completed, and a report shared with all staff.
The investigation identified weaknesses across data preparation, review, sign-off and publication, including inadequate safeguards against hidden spreadsheet data and failure to follow the requirement to convert the response to PDF.
George said: "Controls have been strengthened and the Information Commissioner's Office has closed its case following implementation of its recommendations.
"However, we have further work to do to improve safeguards across data sharing, digital literacy, instant preparedness and compassionate staff support."
Follow BBC Cornwall on X, Facebook and Instagram. Send your story ideas to spotlight@bbc.co.uk.