Two Scottish health boards broke data protection laws by leaving patients' personal information at abandoned hospitals, it has been ruled.
In May, it was revealed that documents had been discovered at Strathmartine Hospital on the outskirts of Dundee.
Then in July a similar find was made at the former Law Hospital in Carluke.
The Information Commissioner's Office (ICO) has found NHS Tayside and NHS Lanarkshire guilty of breaching the Data Protection Act.
The ICO has demanded that both health boards sign an agreement to follow the Data Protection Act and stick to recommendations made recently by NHS Quality Improvement Scotland to make sure it does not happen again.
If they do not comply, further enforcement action is likely and could result in prosecution.
The BBC Scotland news website revealed in July that amateur photographers had found x-rays, photographs and other paperwork at the old Law Hospital.
Some of the documents had been marked "confidential".
A couple of months earlier it had been revealed that a member of the public had found personal information at Starthmartine - including details of a girl's adoption and a child with foetal alcohol syndrome.
"Clearly health records can contain particularly sensitive information"
A report found that NHS Tayside had repeatedly been warned about the documents but only made sure they were all removed when the issue broke in the media.
Following the discoveries, NHS Quality Improvement Scotland drew up a number of recommendations, which the Health Secretary Nicola Sturgeon accepted.
Ken Macdonald, assistant commissioner for Scotland at the ICO, said: "The Information Commissioner's Office takes all breaches of data security seriously.
"Clearly health records can contain particularly sensitive information and must be held securely and disposed of appropriately when no longer required.
"It is also a serious concern that both NHS Tayside and NHS Lanarkshire were keeping information for longer than necessary.
"We have ordered both NHS bodies to comply with the Data Protection Act in future or risk further enforcement action by the ICO."
A spokeswoman for NHS Tayside said: "Since the incident at Strathmartine we have reviewed all our medical records and information systems procedures and taken steps to ensure we are in compliance with the Data Protection Act."
^ Back to top | BBC Sport Home | BBC Homepage | Contact us | Help | ©
~RS~q~RS~~RS~z~RS~20~RS~)