LAFAYETTE, Colo. -- At least 14 patients of a Lafayette medical clinic have received anonymous letters warning that their medical records are not being disposed of properly.

The letters state that the forms were found outside in unsecured locations and they include pictures of a row of recycle bins.

To prove it, whoever wrote the letters attached private medical forms that included names, social security numbers and dates of birth.

“No on has reported to us any fraudulent activity or identity theft, yet,“ said Lafayette Police Sgt. Gene McCausey.

Boulder Community Hospital owns Family Medical Associates, the clinic where all of the patients received care.

”We learned that while we have good policies for protecting patients' information, those policies weren’t really being followed,” said Rich Sheehan, spokesman for Boulder Community Hospital

Sheehan said private medical records were being thrown into unlocked recycle bins.

“We take this situation very seriously. We understand our responsibility to safeguard this information and we’re going to take every step we can to find out what happened here,” said Sheehan.

He said the hospital has bought upgraded, self-locking recycle bins, will re-educate employees about the importance of disposal policies and will start spot-checks to make sure policies are being followed.

He said the hospital has hired a firm that specialized in identity theft issues to help all of the victims and that the hospital will accept all financial liability related to this incident.

He said all of the mailed records were from the month of October.

The hospital will continue to investigate if more patients may have been affected and notify them by mail.

Meanwhile, the hospital has notified the federal Office of Civil Rights, which oversees patient privacy, about what happened.