Private records containing medical histories of 137 patients have been lost by a health service worker, the NHS said today.

Copies of letters sent to Edinburgh GPs by NHS Lothian over two years were stored on a computer memory stick in breach of data protection rules.

The NHS called in police and set up a helpline to support patients worried that their personal information was stored on the small USB device.

The worker, who could now be sacked, owned up to the loss on Thursday last week.

Peter Gabbitas, NHS Lothian director of health and social care, said: "Any threat to patient confidentiality is very serious and management took action as soon as they were informed.

"Our own IT security specialists were called in and a special investigation team which included highly experienced doctors and nurses was formed to identify every patient whose confidentiality may be at risk."

All patients are being contacted to have face-to-face interviews with NHS staff, he said.

The letters are likely to cover details of patients in the central Edinburgh area between June 2006 and June 2008.

Any threat to patient confidentiality is very serious and management took action as soon as they were informed Paul Gabbitas

Mr Gabbitas said a team assessed the extent of the problem over the weekend and searched the office where the worker is based.

He added: "I would like to take this opportunity to apologise again to the patients involved and to emphasise that we are doing all we can to resolve the situation."

The staff member, who was not identified but is understood to be a respected community worker, has been subject to NHS Lothian's employee conduct policy and admitted contravening data protection rules on storing personal information.

The health board informed the Scottish Government health department and the Information Commissioner on Friday last week.

Police were contacted on Monday after premises were searched for the missing memory stick. The helpline was organised on Tuesday.

USB devices are small pieces of hardware which can be plugged into computers to store information then moved to another computer to transfer the data.

A government spokeswoman said: "We take any loss of patient information extremely seriously which is why there are data protection procedures and guidance in place which all those working in the NHS are required to follow.

"We understand NHS Lothian is informing all those patients concerned and we expect NHS Lothian to provide the appropriate information, care and support to them."

The data loss is the latest in a series of high profile mistakes in Scotland.

It emerged last month that a portable data disk, containing records of 894,629 calls made to the Scottish Ambulance Service's Paisley emergency medical dispatch centre, had been lost by a courier.

The heavily-encrypted disk included the names of some patients, addresses of incidents and phone numbers received in calls to the centre, near Glasgow, since February 2006.

And public health minister Shona Robison faced calls for her resignation in May after confidential health records were found to have been lying for months at the disused Strathmartine Hospital in Dundee.