SALEM, Va. -

Patients treated at HCA hospitals may soon have another trauma to deal with. Here, that includes LewisGale hospitals.

WDBJ7 learned Wednesday that patient information from the hospital's billing department may have been compromised. The Secret Service tells WDBJ7 this is a multi-state investigation.

A LewisGale spokesperson says approximately 40 local patients are affected. The billing company says the billing information of 400 people may have been compromised. We're talking about patients' names, addresses, insurance information and social security numbers.

As one LewisGale patient says, it doesn't take much more than that to ruin someone's credit and someone's life.

Jim Clendenen received the letter about a week ago. The letter says that his private, personal information may have gotten into the wrong hands.

“We're retired now and everything we got is taking care of. I'd hate to have somebody stumble in there and take care of everything that we've worked all these years for,” Clendenen said.

The letter is from Salem Hospitalists in Tennessee. The group is part of the LewisGale Regional Health System.

According to the U.S. Secret Service, an employee from the group's billing office is being investigated for identity theft.

The letter goes on to read that Clendenen's records were among those accessed by the now former employee between August 27, 2012 and April 23, 2013.

“Wondering how and why they would let an employee have access to something that he had no reason to have,” Clendenen said.

The Secret Service tells WDBJ7 the investigation is ongoing, and the suspect hasn't been indicted as of yet.

But investigators say the former employee has fraudulently obtained credit, opened accounts, and even leased apartment with other people's information.

As of right now, Clendenen's credit is clear, but he continues to worry about "what if.”

“I just hope maybe something can be done to prevent you or someone else going through what I’m going through right now,” Clendenen said.

Click here to read the letter from the Secret Service: http://www.wdbj7.com/blob/view/-/25290570/data/26410166/-/neak6b/-/Letter-informing-LewisGale-patient-about-data-breach.pdf

Here is a statement from LewisGale Regional Health System:

LewisGale Regional Health System was recently informed that a former employee, whose job function required access to Patient Health Information protected by HIPAA, is under investigation for misuse of that information related to approximately 40 of our patients. All of these patients have been notified in writing and provided complimentary credit monitoring through a national credit reporting agency. We have also established a toll-free call center for patients with questions, as well as an email address to which they may submit written communications.

We are fully committed to the security of Patient Health Information and the privacy of our patients. The employee in question has been terminated and we support this person’s prosecution to the fullest extent of the law.