THE HEALTH Service Executive (HSE) has begun an investigation into how confidential medical notes from 16 patients treated at a Donegal hospital came to be dumped in an alleyway in Derry.
The Data Protection Commissioner, Billy Hawkes, is also to investigate the incident.
The notes from Letterkenny General Hospital were found on Thursday off Gartan Square in the Bogside area of Derry by a local resident.
They contained the names, dates of birth and medical conditions of 16 patients.
The HSE said last night the hospital had recovered the documentation, which "comprises three small sheets of paper".
"The sheets contain the names of 16 patients, along with their date of birth, hospital number and a clinician's handwritten note indicating their complaint," the spokesman said.
"This handwritten note is, in many cases, simply a single word or abbreviation," he said. "No other details regarding the patients' addresses, personal circumstances or medical history are contained."
He said a full investigation into the source was under way.
Gerry Quinn, whose elderly mother found the files in the alleyway behind her home, said the material was sensitive.
"My mother brought the files into her home with a view to returning them to the hospital," he said. "It is quite a large bundle of files. The only reason we opened them was to determine where they had come from. It's incredible and certainly I wouldn't want my confidential medical information to be dumped and found in such a manner."
A spokesman for the office of the Data Protection Commissioner said it was expecting a report on the incident from the HSE early next week. He said the commissioner would study the report and make recommendations on how to reassure those people whose names had appeared on the documents. Recommendations to be implemented by the hospital to prevent a repeat of the incident would also be made, he said.
He said such cases were often due to human error.
"It can be quite difficult in a large organisation to control all human error," he said. "We do sometimes get systems errors and that is when we examine things more closely."
If necessary, the Data Protection Commissioner could compel the HSE to put appropriate systems in place, but this was usually not necessary, the spokesman said.