The information was found on a memory stick in a car park
A member of staff has been suspended after medical records belonging to patients at a secure hospital near Falkirk were found in a car park.
A computer memory stick containing the sensitive information was found by a 12-year-old boy outside an Asda store.
It reportedly contained the criminal histories of some violent patients as well as details about staff at the Tryst Park unit at Bellsdyke Hospital.
The centre provides care for adults with severe mental health problems.
The information was found outside the Asda store in Stenhousemuir, according to the Daily Record newspaper.
A spokeswoman for NHS Forth Valley said: "We are very concerned to learn of this incident and are looking into it as a matter of urgency.
"We have clear policies in place on the safe use of portable data devices.
"We can confirm a member of staff has been suspended in connection with this incident."
The memory stick is being returned to NHS Forth Valley.
A Scottish government spokesman said it had introduced "tough" new rules for health boards 18 months ago making it clear that patient identifiable data should not be stored on unencrypted memory sticks or laptops.
He added: "We expect the highest standards of data security from everyone working in the NHS.
"Leaving patient records on an unencrypted memory stick in a car park is clearly a major breach of those standards and, as a result, NHS Forth Valley has suspended a member of staff.
"We expect NHS Forth Valley to take the appropriate action to deal with this violation of the rules and to ensure it does not happen again."
The breach comes a month after the health authority admitted it had lost the records of all patients being treated by its audiology department.
A computer failure at NHS forth Valley was blamed for the loss.