Two health boards broke data protection rules by leaving personal patient information at former hospital sites.
Medical records containing the sensitive data were found by members of the public earlier this year at Strathmartine Hospital in Dundee and Law Hospital in Carluke.
Following an investigation, the Information Commissioner's Office (ICO) has found the health boards were in breach of the Data Protection Act.