Agency discovers private patient information on Internet