Oceanside resident Sarah Grimmett has plenty to worry about with her daughter, Faith, whose heart condition requires several monthly visits to the hospital.
Grimmett was shocked to receive a letter from Tri-City Medical Center revealing her daughter's medical records were possibly compromised.
"I felt violated for my 4-year-old," said Grimmett. "It's quite scary because she's so young and identity theft is such a big thing right now."
According to the letter from Tri-City, a former employee wheeled out the records on a cart and took them home on August 8.
Grimmett said she had no idea what happened until she got her letter on August 26 -- nearly three weeks after the incident.
"I feel the minute they knew the information was taken from the hospital by the employee -- we should have been contacted," said Grimmett.
The hospital reported the records contained patients' names, dates of birth and diagnoses -- but no social security numbers or financial information.
The former employee turned the records over the Department of Public Health.
Fox 5 tried to contact Tri-City officials for an update on the investigation, but our calls were not returned Thursday.