New York Presbyterian Hospital/Columbia University Medical Center says the information included names, clinical data and a few social security numbers.
The hospital said in a statement that the data had been inadvertently placed on a server, which was accessible online. The information has now been taken down.
The New York Times first reported the story. The newspaper said the incident happened in July.
The hospital said it deeply regretted the breach and would contact all the people affected by it. No evidence exists that any of the personal data had been used improperly.
