A Surrey college has apologised after accidentally e-mailing the private medical details of more than 300 students to an entire year group.
The list, meant for Godalming College teachers, names one student with a brain tumour and another with anorexia.
Staff tried to recall the message and then asked its lower sixth year group to delete the information.
The Information Commissioner's Office said it was investigating a possible data protection breach.
A spokesman added: "Under the Data Protection Act, information related to the health of an individual is considered to be sensitive data.
"This means that organisations should take particular care when handling this type of information, irrespective of the age of the individuals involved."
David Adelman, the sixth form college's principal, said the personal information was meant to help teachers support students academically.
He added: "We take great pride in the quality of learning support we offer our students and the accidental circulation of the list is the last thing we would have wanted to happen.
"We view this breach extremely seriously."
Mr Adelman said the college had tried to reassure students on the list and written to parents apologising for the mistake.
Also on the list of 328 names was one student described as having depression and mental health problems and another with a "complex family situation" and "possible child protection issues".