Central Health CEO Rosemarie Goodyear says the document obtained by a local news outlet had information on 16 patients, including name, age and diagnosis.
"I think any information pertaining to our patients is certainly sensitive information," Goodyear said in an interview on Friday.
"When you get into a patient's diagnosis, for example, depending on what that diagnosis may be and depending on the individual patient, then that may be of varying degrees of concern to a particular patient when that information goes out into the public domain."
She says the health authority was contacted by a patient who told them the document had been found in the community and the patient had been contacted by a journalist.
Goodyear says the document was a daily report on patients assigned to a health-care provider and disposed of at the end of the shift.
She says the authority became aware of the breach when the patient contacted them on Wednesday and the authority has since contacted all 16 patients or their families.
"They are concerned that there has been a lapse in our security when it comes to this information going outside of the health custodian that they entrusted it to," said Goodyear.
Central Health regards the incident as an accident and no discipline is expected.