"However, it is expressly prohibited for this information to leave the call center office in any way, shape or form," Madrak said. "Access Health CT senior management will be meeting with senior Maximus representatives on Monday morning in Hartford to continue the investigation and determine any actions necessary to ensure this does not occur again."
The exchange is now calling people whose information was on the employee's notepads, and is offering them, at no cost to them, credit monitoring, fraud resolution, identity theft insurance, and security freezes of credit reports, Madrak said.
"We are sorry this happened, and we are working to rectify as quickly as possible, as well doing whatever is necessary to try to prevent it from happening again," he said.
In its prepared statement, Maximus said, the company "takes full responsibility for this incident, and we regret any concern that this has caused Access Health CT consumers. Protecting citizens' private information is our No. 1 priority, and we will be notifying all affected individuals to offer them free fraud prevention services to help ensure peace of mind."
"We are also reinforcing security and training policies and procedures to help ensure that this does not happen again."
Maximus also said the company conducts criminal background checks for prospective employees, and also trains workers in handling personal data.
Read MoreHealth plans had big premium hikes before Obamacare
"The person involved in this incident had cleared all required background checks and training before beginning work in the Access Health CT customer contact center," Maximus said. "The team member violated company policy, which strictly prohibits the removal of personal data."
Connecticut's Obamacare exchange is considered to be among the most successful of all the government-run Affordable Care Act marketplaces. Those exchanges enroll people in private health insurance plans and screen people for Medicaid eligibility as part of the law's mandate that nearly all Americans obtain some form of health coverage this year or pay a fine.
In February, the exchange's CEO, Kevin Counihan, said Access Health CT would look to franchise its exchange platform to other states.
Maryland, whose own exchange badly floundered during Obamacare's open-enrollment period, plans to use Connecticut's exchange system to replace its own.
—By CNBC's Dan Mangan.