Hospital managers have been defending their decision not to tell patients that they may have been given stolen bone implants from America.
The hospitals have acted to reassure patients
Up to 15 patients received the grafts in two NHS and one private hospital in the Cardiff area.
But the process of informing 12 of the NHS patients only began after news of the stolen bones emerged.
Doctors said there had been no reason to inform them previously, because their health was not at risk.
Police in New York are investigating claims that the managers of a company called Biomedical Tissue Services took body parts without the consent of next of kin.
More than 80 body parts were involved in the UK which could have been used on dozens of patients.
The three Welsh hospitals - University Hospital of Wales, Llandough near Cardiff and Bupa in north Cardiff - were named in a list of 25 UK hospitals which have bought the potentially contaminated body parts to be used in operations called bone allografts.
The UK Medicines and Healthcare Regulatory Authority (MHRA) concluded last October that the possibility of infection is low and has said it up to hospitals whether they inform patients.
BBC Wales understands that the three patients treated privately at the Bupa hospital have already been informed.
Another three who had surgery at Llandough hospital under the NHS have been identified and there may be up to nine others treated with the stolen bone material at the University Hospital of Wales.
Patients treated under the NHS were not informed until the news became public because there was no clinical risk. The authorities said there was only a one in a million chance of contamination.
'Worst of all worlds'
Ian Lane, from Cardiff and Vale NHS Trust, said: "We based it entirely on clinical risk and we did not think there was any clinical risk over and above that when the usual bones were used."
But the decision not to inform patients has been criticised.
Liberal Democrat AM Jenny Randerson, said "Patients have the right to know.
"The risk of contamination may be small but its nevertheless the right of those patients to know.
"And, of course, the way the information has been made public is the worst of all worlds from the point of view of the patients
'Carefully regulated industry'
Allografts have become a regular part of NHS work and sourced under tight regulation but there is also high demand which makes them expensive.
Jonathan Davies, orthopaedic consultant, said: "They come from donors. It's a carefully regulated industry. The donors have to give consent. The donors have to be screened for blood borne diseases like HIV or hepatitis. and they have to be specially prepared as well."
Up to 12 patients given allografts under the NHS have been sent letters or reassurance that they are in no risk.
Patients affected are also being offered counselling.
The hospitals were named following a freedom of information request submitted by the BBC.