There have been more than 150 data breaches across Welsh NHS trusts over a three-year period.
The details were obtained by the BBC under the Freedom of Information Act.
Among the examples of data breaches are lost or stolen laptops, many of which were not encrypted.
In Wrexham, one staff member found a list of patients of an entire children's ward with their ailments, lying in a puddle.
Welsh Assembly health minister Edwina Hart said she was "quite horrified" by the BBC's findings. Hart said staff losing such data should be disciplined.
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
The data breach information gathered covered the period between April 2005 and March 2008.
All the trusts in Wales responded, apart from Gwent NHS Trust.
It said it "would be too expensive" to gather the data breach information. The BBC is challenging its decision not to reveal the information.
NHS data breach: