A Leicestershire businesswoman discovered shredded records of NHS patients, with some information still showing, in packaging material used to protect gift boxes.
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
The records originated from Papworth Hospital NHS Foundation Trust in Cambridge, which is investigating the incident.
Kerry Wilkinson of PennyDog Jewellery in Rothley, Leicestershire, found the patient records when she took delivery of the boxes and bags for her gift-wrapping service.
It appears that the records were sent by the hospital to a solicitor which acts for patients, and were inadequately shredded before they turned up at the jewellers for use as packing for gift boxes
Wilkinson told the Cambridge News: "I phoned the hospital immediately and they are investigating. They said they would contact the solicitors and the company which sent the boxes. I don't want to get the hospital in trouble. They were horrified when I told them about it. I could clearly make out the name and address and the name of the hospital and solicitors."
A spokesperson for Papworth Hospital, which is world-renowned for its pioneering heart surgery, said that when confidential material leaves the site it "resembles unreadable confetti and is not identifiable".
A company collects the shredded material from Papworth and takes it to a secure warehouse where it is packaged into large bales which are delivered to a recycling plant. It is then turned into recycled paper.
But the hospital concedes that the secure process is bypassed when patients ask for their notes to be sent to a third party, such as a solicitor.
The hospital said: "In these circumstances we would expect that extreme care is taken in the disposal of these documents by this third party.
"We cannot take responsibility for the origin of the packaging material used by the mailing company."
The unsafe disposal of confidential patient records could be a breach of the Data Protection Act. The solicitors have not been named.