Four HIV-positive patients are suing Massachusetts General Hospital for breach of privacy after an employee left their medical records on a train, The Boston Globe reports.

According to the article, the hospital notified 66 patients treated at the Infectious Disease Associates outpatient practice that billing records—bearing their names, Social Security numbers, physicians and diagnoses—were lost by a manager riding the Massachusetts Bay Transit Authority Red Line train. After bringing the paperwork home for the weekend, the manager claims, she left them on the train when returning to work Monday, March 9.

Last week, two of the 66 patients filed a breach-of-privacy suit against the hospital and the unnamed billing manager; two more patients soon joined the suit. All four are HIV positive.

“Although much has changed about HIV over the years, one of the things that hasn’t changed is that for so many people the public disclosure of HIV status is still profoundly distressing and harmful,” said Ben Klein, a lawyer with the Gay and Lesbian Advocates and Defenders. “Even though we don’t know what has happened to the records, the sense of powerlessness that people have about not knowing what has happened to this very sensitive health information is profoundly distressing.”