A sensitive document detailing the treatments of premature babies at Mayday Hospital was discovered at a supermarket in Sutton.

An investigation was ordered after a shopper stumbled on the highly confidential patient records while browsing a DVD rack at Morrisons.

John Dunne, 61, discovered the names, dates of birth and NHS numbers of 20 babies being treated at Mayday Hospital in Croydon on the disc.

The lost file also disclosed their medical problems, what medication they were given and plans for their future treatment.

The Mayday NHS trust is to write to distressed relatives after the Sutton Guardian ensured the document was returned safely.

A trust spokesman admitted it should have been shredded on-site.

The lapse follows several highly damaging personal data breaches, including the discovery of HIV results from Kingston Hospital in a discarded courier bag.

A single file being left in such a public place suggests individual carelessness rather than systemic failings.

Mr Dunne, a payroll manager, said: "How the hell it got to be left in a supermarket, I do not know. It must be terrible for the parents. They are under enough pressure as it is without knowing details of their babies' procedures have been left lying around."

The Patients Association, a healthcare charity, called for an independent enquiry. Katherine Murphy, a spokesman, said no amount of apologising could redress parents' anguish.

In a statement, the trust said: "As soon as we have completed our inquiries, we will be writing to the people concerned with a full explanation and personal apology.

"The trust acknowledges that this very regrettable incident should not have happened. We are quite clear that confidential data of this nature should not leave our premises.

"This particular document, which is necessary for the safe delivery of patient care, should have been destroyed on the premises."