Confidential patient information has been left lying in an abandoned hospital in Lanarkshire, BBC Scotland can reveal.
X-rays marked with patients' names, photographs and other paperwork were found scattered at Law Hospital in Carluke, which closed in 2001.
The health secretary said she was concerned by the incident, which follows a similar discovery in Dundee.
NHS Lanarkshire said it was taking the matter extremely seriously.
The finding came to light after amateur photographer Gary Whittle sent shots of the hospital to the BBC Scotland news website.
Mr Whittle said he and three friends, who have an interest in taking "atmospheric" photographs of abandoned buildings, were simply able to walk into the hospital.
The 28-year-old finance director, from Edinburgh, said: "I was pretty surprised that I could get into the building.
BBC Scotland's health correspondent Eleanor Bradford went into the abandoned buildings to look at the records
"It's a massive place. It looks as though people just upped and left.
"There were loads of photos and X-rays scattered about. There was one black and white photograph of a little girl that really stood out."
BBC Scotland health correspondent Eleanor Bradford visited the hospital and found X-rays clearly marked with patients' names, photographs of injuries, and other material marked "confidential".
She said that although the former hospital has a security guard at the front gate, there was open access from the side.
Tim Davison, chief executive of NHS Lanarkshire, said he was "hugely disappointed" by the discovery and said the health board would launch an investigation into the incident.
He said: "We have clear policies about the safety of patient information and there were clear policies and procedures followed in 2001 when the hospital transferred from Law to the new hospital in Wishaw. So this came as a very unpleasant surprise to us.
"We discussed with staff who had been responsible for decommissioning that hospital, and many others that we've decommissioned, and were reassured that our procedures had been followed."
In May it emerged that documents had been found at Strathmartine Hospital on the outskirts of Dundee, including details about a girl's adoption and a child with foetal alcohol syndrome.
NHS Tayside has admitted responsibility for the situation and the Scottish Government health directorate launched an investigation into the matter.
The Scottish Liberal Democrats called for all former hospital buildings to be examined to prevent such an incident happening again.
Robert Brown MSP said: "Once again, patients in Scotland have been badly let down.
"The Scottish Government must order an investigation and full audit into all former hospital buildings to ensure that there are no more patient records or information lying discarded and open to public view."
A Scottish Government spokesman said Health Secretary Nicola Sturgeon was concerned to hear about the incident in Carluke.
He said: "The cabinet secretary has been advised that NHS Lanarkshire were not aware that the information was at the site and has asked the board to provide her with full details of the situation as quickly as possible.
"Following an earlier incident in NHS Tayside, chief executive of the NHS in Scotland, Kevin Woods, wrote to all boards reminding them of their responsibilities concerning patient records and their protection."
Experts said the data found at Law Hospital could be enough to identify individuals, which would be a breach of the Data Protection Act 1998.
It's very difficult to see how patient records found in an derelict hospital could be said to have been kept confidential
Grant Campbell Data protection expert
Grant Campbell, an expert on data protection at the law firm Brodies, said medical records came very close to the top of the list of confidential information protected by the act.
He said: "NHS bodies have an obligation to keep patients' records confidential, it's a very established principle.
"It's very difficult to see how patient records found in a derelict hospital could be said to have been kept confidential."
The information commissioner's office said breaches of personal security were taken very seriously and it would look into the incident.
The hospital in Carluke was built in 1939 as an emergency medical service hospital and closed its doors on 25 May, 2001.
In January this year developers announced a £100m project to create 500 homes on the site.
Are you a former patient at Law Hospital? Are you concerned at the discovery of the confidential information? Send us your comments using the form below.
The BBC may edit your comments and not all emails will be published. Your comments may be published on any BBC media worldwide.
This page is best viewed in an up-to-date web browser with style sheets (CSS) enabled. While you will be able to view the content of this page in your current browser, you will not be able to get the full visual experience. Please consider upgrading your browser software or enabling style sheets (CSS) if you are able to do so.