An investigation has been launched into how a file loaded with confidential information on vulnerable mental health patients was picked up by a shopper in Oxford.

A member of the public found the folder — lost by Bromford Housing Group — at Templars Square shopping centre in Cowley.

The folder contained personal records on at least 10 housing association tenants who had been released from hospital after mental health treatment.

The housing association admitted there had been a breach of security and said it was investigating current and former staff.

A spokesman said it would not rule out involving the police if its investigation showed the file was stolen, but officers had not yet been alerted.

A source said the file went missing for two weeks earlier this month.

It was found near Templars Square shopping centre earlier this month and was later returned to the housing association's offices in Garden House, Cowley.

The source said: "This is very embarrassing. I can't believe how this kind of thing can go missing like this.

"The people in this folder would be very vulnerable mental health patients, just released from hospital, with conditions such as schizophrenia and bipolar disorder.

"They would be distraught to learn their personal details were just left somewhere."

The on-call folder is used by staff to hold personal records of patients and workers.

It is believed to have contained information on the care plans of at least 10 people and details on 12 members of staff.

A spokesperson for Bromford Support, which manages Bromford Housing Group, said no personal information other than names and addresses was contained in the file.

The spokesman added: "Bromford Support takes the security of customer information very seriously and has procedures in place to ensure its safekeeping.

"We are currently undertaking an internal investigation, which will cover both existing and former staff. We will then consider taking disciplinary action and/or reporting to the police as a case of data theft."

Bromford Housing Group provides homes for tenants of Oxford City Council, and Oxfordshire and Buckinghamshire Mental Health NHS Trust.

Ed Turner, the deputy leader of Oxford City Council, said: "All public bodies have to be careful about the way in which they handle sensitive information — and all the more so in cases such as this.

"It is essential they take appropriate action so nothing like this can happen again."

Last month, Andrew Chapman, from Botley, sparked a national security alert when he discovered a million people's personal details on computer servers he bought from the Internet auction site eBay.

The highly sensitive information — which included names, addresses, bank details, sort codes, phone numbers and mothers' maiden names — prompted an investigation by the Information Commissioner's Office.