Where to report the vulnerability of personal data from city clinics?

Question

Information Security

Good afternoon/evening.
I would like to ask you questions about the information that I will provide you.
I have 2 questions on this topic.
1) Where should I go for this issue?
2) Is this information confidential, or is there nothing like that?
The bottom line is that you can access almost any information. Up to all the financial statements of all clinics in the city of X. Of course, you will have to sweat a little, but to achieve the desired result.
I will attach some files so that you can answer my questions. Thank you in advance for your answers.
1. From the name, everything becomes clear. Data up to 2016.
2. Fin. report(1), took the oldest data. There is also data up to 2016.
3. Fin. report(2). There is also data up to 2016.

Also, there is patient data with passports (series, number), policy numbers, internal certificates, cost of the service, name of the service, treatment status and other things. Purchasing or paying for certain services. Full name with date of birth, policy number and place of residence / registration of each person who applied to a particular clinic.
3rd, additional question. What do you think, what is our state thinking about, which tells us that all our data is under serious protection?

Answer 1

Prosecutor's office. The fact is that the collection and storage of personal data impose certain obligations. And this is controlled by the prosecutor's office.