Coronavirus test results and confidential details of dozens of people were sent out by NHS Orkney to a local business by mistake.
The data included more than 50 patient names, addresses and the results of Covid-19 testing.
NHS Orkney said an investigation had established it was an “isolated case of administrative error”.
The health board has apologised and the incident has been reported to the Information Commissioner.
The data was sent out on 15 May, and all patients involved have been written to.
Julie Colquhoun, head of corporate services at NHS Orkney, said: “Data on 51 patients was sent to a local business in error.
“NHS Orkney takes the management of patient data extremely seriously and all staff have been reminded of the correct procedures to follow.
“I would like to take this opportunity to apologise again to those people affected.”
‘Ensure lessons are learned’
The Scottish government said: “The recipient organisation has been contacted and has deleted the personal information they received erroneously.
“NHS Orkney has informed the Information Commissioner’s Office of the breach. This was not a cyber-attack but a result of human error.
“NHS Orkney will be fully investigating the incident to understand any failings and what lessons can be learned.”
The statement added: “The Scottish government takes the data protection rights of the people of Scotland seriously and will everything in our power to ensure that lessons are learned and this doesn’t happen again.”
Orkney Lib Dem MSP Liam McArthur described it as a “serious breach of highly sensitive, personal data” and that those involved had every right to feel let down.