The ICO had previously contacted NHS Tayside about documents
The UK's data protection watchdog has demanded to know why children's medical details were left at an abandoned hospital in Dundee.
The Information Commissioner's Office (ICO) contacted NHS Tayside about the documents in December and was reassured they had been taken away.
However, it came to light this week that confidential papers were still lying around at Strathmartine.
NHS Tayside said it was now working to remove all the documents.
The papers found at the former Strathmartine Hospital, which closed in 2005, included the names of patients and their medications, details about the adoption of a young girl and information about a child with foetal alcohol syndrome.
The public health minister and Dundee East MSP, Shona Robison, had also contacted NHS Tayside after constituents raised concerns about the details lying around. She too received assurances that the documents had been removed.
Ken Macdonald, assistant commissioner at the ICO, said: "The Information Commissioner's Office takes breaches of people's privacy very seriously and it is concerning if personal information, particularly sensitive information such as health records, has not been disposed of securely. This is a key principle of the Data Protection Act.
"Following a complaint regarding the disposal of patient health records at the former Strathmartine Hospital in Dundee, we contacted NHS Tayside to establish further details.
"Despite the ICO having received assurances that immediate action had been taken to remove the records from the building, this appears not to be the case.
"We will be contacting NHS Tayside immediately to demand an explanation and, if necessary, we will use our enforcement powers."
A spokeswoman for NHS Tayside said: "We are continuing to investigate how this situation arose. However, our priority is to make sure any documents that remain on site are removed."