Privacy advocates are demanding the NSW government explain how hundreds of medical files were left abandoned in a derelict building south of Sydney.

The privacy breach, uncovered in a triple j Hack and ABC News investigation, is believed to be one of the largest of its kind in Australian history.

The documents date from 1992 to 2002 and were found at the former Garrawarra Centre for Aged Care in Helensburgh.

NSW Health said it was investigating the matter and that the site was surrounded by signs warning of asbestos and was illegally trespassed.

ABC sources maintain the building was not secured and was being accessed by members of the public.

The Australian Privacy Foundation’s health committee chair, Dr Bernard Robertson-Dunn, said an appropriate explanation was needed.

“For NSW Health to claim the site was (accessed illegally) is a little weak,” he said.

“NSW Health should have looked after it so it couldn’t have been.

“You have to look after health data very carefully.”

Calls for external investigation

The documents contain personal information belonging to more than 400 patients from 1992 to 2002.

The ABC understands that the majority – if not all – of the affected patients are deceased.

NSW Health Minister Brad Hazzard told the ABC he had directed his department to conduct an audit.

“As a result of the finding of medical records deposited during the 16 years of Labor in what has proved to be inadequate secured premises, I have directed the Ministry of Health to instigate an audit of archived medical records,” he said.

“To those people whose medical records were put in such storage arrangements in the early 2000s, I express my sincere apologies and can assure them and their families I will get NSW Health to do whatever I can to rectify the situation.”

NSW opposition spokesman for health Walt Secord said the families of those affected must be informed.

“There should also be an independent, external investigation into how the inappropriate disposal of these medical records occurred,” he said.

“This is private, personal information you wouldn’t even share with your closest family members.”

The building is situated within the South-East Sydney Local Health District.

The district’s medical executive director, James Mackie, said the public should not be concerned.

“We understand this might be a distressing event for some. However, we want to reassure people that any of the material that was stolen from these premises relates to historic material and non-active patient files,” he said.

Dr Mackie said officials would need to work through the medical records.

“We need to be able to identify exactly what files are there and what files are in possession of the ABC, and certainly if patients’ files have been exposed we would contact anyone who has been so affected,” he said.

-ABC