A hospital trust left a spreadsheet’s hidden rows on a public disclosure page for two years and nine months.
The Royal Cornwall Hospitals NHS Trust published a spreadsheet in February 2023 as part of a Freedom of Information response. Behind the visible cells, the file still carried sickness absence records for 7,715 trust staff and 288 people working for other organisations, and those records included health details. The file sat in the trust’s public FOI log until November 2025.
Hidden rows on a public page
An independent investigation, handed to staff last week and presented to the board on November 5, found weaknesses across preparation, review, sign-off and publication rather than one isolated mistake. The spreadsheet should have been converted to a fixed document before release; that step was skipped. Nothing checked for content hidden beneath the visible sheet.
Acting chief nursing officer Bernie George told the board the disclosure caused “absolute distress and loss of trust.” Board chair David Allen apologised on behalf of the trust.
No contact or financial details were disclosed and patient care was untouched, but sickness absence data is special category information under UK GDPR. The trust has warned regulators it faces compliance, legal and reputational risk, plus unquantified costs for incident management, specialist advice, staff communications and strengthened information governance.
The Information Commissioner’s Office has closed its case after the trust implemented its recommendations. The action plan now extends the same safeguards to every form of data sharing, not only FOI replies, and adds training on spreadsheets and hidden data.
For hospital information teams elsewhere, the lesson is structural: an FOI log is a publication channel with no review gate of its own, and a spreadsheet carries a second layer that a quick scan will not show.
