Boxes of records containing the personal details of patients were discovered at the Narre Warren South site when the shed at the Amberley Park Drive property was broken into in November 2013.

Australian Privacy Commissioner Timothy Pilgrim investigated and found the medical centre that owned the property had breached the Privacy Act by failing to properly secure the information.

The neglected files included names, addresses, Medicare numbers, dates of birth, occupations and results of medical investigations of about 960 patients who used the Amberley Park Medical Centre that operated at the address until April 2011. Most of the records related to patients who visited the centre prior to 2004.

The owners of the property now run Pound Road Medical Centre in Narre Warren South.

Mr Pilgrim found the medical centre had failed to take reasonable steps to secure the sensitive medical records and had also failed to de-identify or destroy the information that it no longer used.

The investigation found the medical centre computerised patient records after November 2004 but that hard copy records were also kept in a locked room on the site.

The paper files remained inside the building for about 18 months after the Amberley Park Medical Centre shut until renovations began at the site and the files were moved to the garden shed, which was secured with three padlocks.

Pound Road Medical Centre told the Commissioner during its investigation that it had not realised the documents included "some health records".

A practice manager at Pound Road Medical Centre told Fairfax Media she did not wish to comment on the investigation.

The Commissioner found Pound Road Medical Centre should have known that the information included sensitive personal and health information and that there were no circumstances under which it would have been reasonable to keep such records in a garden shed, particularly when the property was unused.

The Pound Road Medical Centre has agreed to undertake a risk assessment regarding the way it manages personal information, review its privacy policy, organise privacy training for staff, and develop a data breach repsonse plan.