Police are investigating claims hospital patients were sent text messages by a worker who accessed their personal details.
The male member of staff has been excluded from work after female patients reported receiving messages from an unknown number.
The data breach involves patients who have been for an X-ray at Crosshouse Hospital, near Kilmarnock. It is understood to have come from within the radiology information system and included phone numbers and addresses.
NHS Ayrshire and Arran confirmed it is investigating the matter, and police are also involved.
Patients have received a letter informing them.
Gemma Erskine, 31, from Kilmarnock, is one of the women who received a string of messages after being in hospital over the summer.
She said: “A couple of months ago I kept getting messages from a number I didn’t recognise.
“They just said ‘hello’ and nothing else.
“I didn’t know the number so I didn’t reply.
“After I got the letter I called the police and they said they were involved.
“I am so angry about the whole thing.”
Another woman said she had received messages complimenting her appearance, before the sender sent a picture of himself and asked her out on a date.
She added: “I got a letter from the hospital and that’s when it clicked it was him, and that he had got my details from my medical records.”
The breach took place between April and September.
Dr Alison Graham, medical director for the NHS Ayrshire and Arran, said: “We are currently investigating and are contacting a number of patients to ascertain the extent of this breach.
“We wish to apologise to anyone affected by this.
“We take patient confidentiality extremely seriously and will ensure a full investigation is conducted.”
A police spokesman said: “Inquiries are at an early stage to establish the full circumstances.”