An investigation has been launched after an NHS clinic mistakenly revealed the identities of hundreds of HIV-positive patients.