Story highlights Two Washington hospitals notify patients to get tested for hepatitis and HIV

Hospitals in Colorado, Arizona and California where a surgical tech once worked have done the same

Federal prosecutors accuse Rocky Allen of acquiring fentanyl "by deception and subterfuge"

(CNN) The investigation started when someone allegedly saw a surgical tech slip a syringe filled with a powerful pain medication off a cart in a Colorado operating room.

Now, it's extended to include hospitals in at least three other states.

In Colorado, Arizona, California and Washington, nearly 5,000 patients have been told they could have been exposed to hepatitis B, hepatitis C or HIV when they underwent surgery. The notices advising patients to get tested have sparked concern and threats of legal action.

The hospitals involved -- at least six, according to CNN's latest tally -- have one thing in common: a surgical tech was once on their staff who's accused of swapping out syringes full of the liquid painkiller fentanyl and possibly putting patients' safety at risk.

Rocky Allen, 28, has been indicted on charges of tampering with a consumer product and obtaining a controlled substance by deceit, federal officials announced last month. He's pleaded not guilty in federal court in Colorado. The case is set to go to trial in August.