Royal Cornwall Hospital data breach exposes staff information

Cornwall's main hospital has issued an apology after a data breach resulted in staff absence information being published online.

Royal Cornwall Hospital said it has contacted all individuals who have been directly impacted to offer guidance and support.

In a letter to staff, which has been seen by CornwallLive, the hospital stated that the incident involved sickness absence data for a number of individuals between April 2020 and May 2023.

It said the breach occurred when a spreadsheet containing hidden data was inadvertently disclosed as part of a Freedom of Information (FOI) request.

The FOI response and spreadsheet was then published on the disclosure log on the Royal Cornwall Hospitals Trust website in 2023 but the error has "only very recently been brought to our attention by someone who accessed the file".

A spokesperson for Royal Cornwall Hospitals said it wants to reassure its community that no patient data or financial information has been compromised.

It has since written to 8,100 current and former staff to inform them of the breach.

The hospital said it has also taken immediate action to report the incident to Information Commissioner’s Office and remove the spreadsheet from its website disclosure log and temporary suspension of the log while a full review is conducted.

It added that a new process is in place to ensure all electronic spreadsheet files are fully disabled before any FOI disclosure and it has introduced additional checks to reinforce data handling procedures.

A spokesperson for the Royal Cornwall Hospitals said: "We have informed current and former staff working with us between April 2020 and May 2023 of a data breach. We want to reassure our community that no patient data or financial information has been compromised.

"We have contacted all individuals directly impacted to apologise and to provide them with guidance and support. Anyone who has not received a letter from us is not affected and no action is required. We have also informed the Information Commissioner’s Office.

"We know that any data breach can cause concern. We want to reassure people that we have acted swiftly to contain the issue and strengthen our safeguards.

"We take the security of personal information extremely seriously. This incident has reinforced our commitment to learning and improving our processes to maintain the highest standards of data protection.

"We thank our staff and community for their continued trust and support as we work diligently to safeguard information."