The male member of staff has been ‘excluded from work’ after female patients reported receiving messages from an unknown number.
Some of the messages invited the women out on dates and commented on their physical appearance.
Three women who were treated at the Crosshouse Hospital, near Kilmarnock, East Ayrshire, have spokne out.
NHS Ayrshire and Arran, which runs the hospital, were alerted to the security breach by letter.
It is believed that most of the patients whose information was accessed were female and all had been recently referred for an X-ray.
The breach is understood to have come from within the Radiology Information System, for ‘no legitimate clinical or administrative requirement’.
It included phone numbers and addresses.
Gemma Erskine, 31, from Kilmarnock, said: “I got a letter last week and I am really angry.
“A couple of months ago I kept getting messages from a number I didn’t recognise.
“They just said ‘hello’ and nothing else.
“I didn’t know the number so I didn’t reply.
“But I kept getting them over and over until they eventually stopped.
“I was in hospital in August and again in September and had two X-rays and an operation.
“After I got the letter I called the police and they said they were involved.
“I am so angry about the whole thing.
“I have lost faith in that hospital.”
Another woman, speaking on condition of anonymity, said: “I started getting text messages from a number I didn’t recognise around July.
“First they just said ‘hey how are you’ and that sort of thing.
“When I asked who he was and how he got my number, he just said he found it on his phone.
“I told him I didn’t know who he was and then he said ‘I’ve seen your profile picture, you are absolutely stunning and exactly my type’.
“Then he sent me a picture of himself and said ‘what do you think? Do you like how I look?’.
“Then he asked if we could meet up and go on a date.
“I stopped replying after that. I thought he was a bit of a stalker and a weirdo, and showed some of my friends the things he was sending.
“To be honest, we had a bit of a laugh about it.
“I never thought in a million years it would turn out to be this.
“I got a letter from the hospital and that’s when it clicked it was him and he had got my details from my medical records.
“I was in hospital in June for an X-ray because I fell at work and hurt my wrist and ankle.
“You expect that your details will be kept private.
“I just can’t believe this has happened.”
Another patient who’s details were accessed - also a young woman - added: “I broke my ankle in June and obviously had to get an X-ray.
“I got a letter this week saying all my personal details have been accessed by someone using it inappropriately.
“I think it’s really scary that this he has been able to access all that information.
“You just don’t know what he could do.
“There’s phone numbers and addresses and everything.
A member of staff has been ‘excluded from work’ following the breach which took place between April and September.
Dr Alison Graham, medical director for the NHS Ayrshire and Arran, said: “We have been made aware of a member of staff inappropriately accessing patient records.
“This individual is currently excluded from work.
“We are currently investigating and are contacting a number of patients to ascertain the extent of this breach.
“We wish to apologise to anyone affected by this.
“We take patient confidentiality extremely seriously and will ensure a full investigation is conducted.
“We are working closely with Police Scotland and the Information Commissioner’s Office.
“As this is an ongoing police investigation, we are not able to confirm any further details.”
A Police Scotland spokesman said: “We can confirm that Police Scotland has received a complaint regarding the inappropriate behaviour of a male member of staff from NHS Ayrshire and Arran.
“Enquiries are at an early stage to establish the full circumstances.”