Hospital staff have been warned they face being reprimanded if they fail to look after confidential patient information.

It came after a leaked internal memo revealed a number of breaches of security at the Queen Elizabeth Hospital, in King’s Lynn.

They included a handover sheet with 11 patients’ details which was found in a hospital car park, another with 19 patients’ details found on a stairwell and patient information found in a staff pool car.

There were also incidents where patients were given other people’s confidential information by mistake and records being found in a linen bin and left on wheelchairs.

Karen Croker, who took over as interim chief executive at the hospital last week, said: “Clearly, it is unacceptable that there have been a number of cases in which patient information has not been looked after to the standards we would normally expect. To put this into context, in January, the trust treated an estimated 38,000 patients.

“All of these incidents are investigated and where staff are found to be incompliant with information governance protocol, they are reprimanded and trained.

“Information governance is something the trust takes very seriously and we have had an internal drive to reduce the number of incidents by raising awareness of the importance of this issue to staff.

“A total of 95pc of our staff are fully trained, the trust surpasses this national target, and we continue to train the remaining pockets of staff.

“We would like to reassure all patients that we do treat their records confidentially.”

Health workers have a legal obligation to protect patients’ confidentiality.

Governing body NHS England has “high level commitments” for safeguarding hospital patients’ data. Its confidentiality policy includes detailed guidelines for staff.

“Do safeguard the confidentiality of all person-identifiable or confidential information that you come into contact with,” it says.

“This is a statutory obligation on everyone working on or behalf of NHS England.

“Don’t share information without the consent of the person to which the information relates, unless there are statutory grounds to do so.”