The data was encrypted but the password was attached
A health worker lost a memory stick containing medical information of more than 6,000 prisoners and ex-prisoners from HMP Preston, an NHS Trust said.
Central Lancashire Primary Care Trust said the USB stick was being used to back up clinical databases at the prison when it was lost on 30 December.
The data was encrypted but the password had been written on a note which was attached when it was misplaced.
The trust said the member of staff concerned has been suspended.
A full investigation is to be carried out.
A spokesman said: "We are taking this very seriously, and we would like to apologise unreservedly for any concern this incident has caused.
"It should never have happened."
He said the information lost included prisoner surnames, their broad age range, prison number, cell location, prison clinic appointment times, and review dates.
It includes details of some prisoners' ailments, such as diabetes, asthma, mental health and sexual health, but not full medical history.
All memory sticks being used by health staff in the area have been withdrawn and a review of data protection practices is under way.
The trust is now contacting prisoners to tell them about the loss and has set up an information line.
The medical records date back to the year 2000