The Orange County Register reported that the data, which included names, addresses and social security numbers, was copied to an external hard drive by an employee in April.
That employee has been placed on administrative leave.
State officials said there was no indication that the personal information has been shared or misused.
Most of the 6,000 current employees work in Sacramento and Richmond, according to a health department spokesperson.
