A private citizen contacted VA police to report she found a bag on the side of the road . The bag contained personal information that belonged to the owner of the bag ( VA physician ) and documents that contained Veterans ' personally identifiable information ( PII ) and protected health information ( PHI ) . The list of diabetic patients contained 13 Veterans ' full names , age , and full SSN . There was also two appointment lists that contained 14 Veterans ' full name , last four digits of the SSN , home phone number . In addition , there was a copy of a PATS report that contained one Veteran 's full name and full SSN , one letter from a pharmacy that contained a Veteran 's full name and date of birth , one letter from insurance company that contained one Veteran 's full name , diagnoses and date of birth . ;