The files provided sensitive personal details of 44 patients.
They were found by a man out walking in Drogheda, Co Louth, on Sunday.
The Data Protection Commissioner and Our Lady of Lourdes Hospital in Drogheda are also conducting investigations.
The local man who found the files passed them on to local radio station LMFM, which contacted the HSE and the Data Protection Commissioner.
A spokesperson for the HSE said maintaining a patient’s confidentiality was not only an issue of professionalism, it was also a legal requirement as defined by the Data Protection Acts and this would form part of the investigation.
The hospital said it was treating the matter very seriously, emphasising that it has policies and procedures to ensure medical information is treated in confidence and not shared inappropriately. The hospital also said it had “facilities in place for the safe disposal of sensitive and confidential information”.
Meanwhile, the Office of the Data Protection Commissioner said it regarded any confirmed breach involving the sensitive personal data of multiple subjects to be very serious in nature.
It will continue to investigate this matter once it is in a position to fully establish the facts.
A listener, named Andrew, yesterday told the morning radio show that he found the files strewn across the ground, close to an overflowing bin.
“I picked up what I thought was rubbish that had overflowed from a bin up in Cross Lanes, beside the main hospital car park. I stuck it in my pocket intending to put it into another empty bin when I found one.
“I carried on with my walk and down by the river I sat on a seat, remembered that I had this rubbish to get rid of, took it out, glanced at it and was horrified at what I saw.
“The most confidential details of people’s stay in the hospital were there to be read, who they were treated by, what they were treated for, who their doctors were, when they were discharged, I was horrified by it.”
Radio presenter Michael Reade told listeners: “I was shocked to read what I did, there were names and addresses of patients, their date of birth was there and, in one case, the phone number of a patient’s brother who had to be contacted in an emergency, after he had sought details of his brother’s progress.
“The injuries the patients suffered were detailed, one person was admitted with chest pains, another had diabetic toes, and one person had partial amputation of their fingers following a work accident, everything needed to identify people was on those files.”
The radio station contacted the HSE and the Data Protection office and, by arrangement, met a HSE official at the station yesterday to hand the files back.
Meanwhile, management at the Drogheda hospital said all patients involved in the breach of confidentiality would be met individually, in order to explain the incident and to provide details of the personal information found.
“A letter of apology will also be issued to each patient, outlining the steps now being taken by the hospital, in the management of this serious incident.”
The hospital also said that it has a mandatory staff policy on data protection and confidentiality which all staff are obliged to read and sign before working at the facility.
He said training programmes are provided on a continuing basis and hospital policy states no patient information should be removed from the hospital.
Recently, over 1,600 hospital patient files were found dumped on a roadside in Co Westmeath.