A man who tried to change a hospital appointment over the phone instead heard a stream of voicemail messages left by other patients.
Brian Newton, 58, from Manchester was “shocked” to hear recordings of people giving personal data to Manchester Royal Eye Hospital.
A BBC Radio Manchester journalist also heard the voicemails after calling the number Mr Newton used.
Manchester University NHS Foundation Trust said it was investigating.
A spokesman, who “apologised unreservedly”, said the “small number” of affected patients would be contacted.
“I couldn’t believe it,” said Mr Newton, a taxi-driver from Blackley.
“I started thinking ‘Is somebody hearing my message?’.”
‘Patient’s husband died’
“I pressed ‘zero’ to speak to an operator and started hearing the messages,” he told the BBC.
“One lady was very distressed – she was cancelling an appointment because her husband had died.
“I was thinking anybody could exploit this personal information.”
Mr Newton contacted the hospital the following day to report the problem, only to later find it had still not been fixed.
Mr Newton, who had already left a message on Tuesday to cancel an appointment at the Macular and Diabetic unit, called the unit again because he wanted to speak to someone from the department.
“I was even more shocked,” he said.
A Trust spokesman said he was aware of an issue “which has arisen on a telephone line” at the hospital.
“The Trust has launched an immediate investigation which will examine the circumstances surrounding the incident and we will be contacting the small number of patients which this has affected,” he said.
The matter has been referred to the Information Commissioner’s Office (ICO).
A spokesman said: “Manchester Royal Eye Hospital has made us aware of an incident and we will assess the information provided.”