A man and his six-year-old daughter picked up the hospital document while walking on Friday morning.
The patient records relate to a date in January and refer to 18 named patients on ward 2 South Medicine at Craigavon Area Hospital.
The man, who prefers not to be named, said he saw similar papers across the road but was unable to get to them.
Thousands expected to take part in 'Derry Day' this weekend
Brexit: There’s a fundamental con trick being played over Liz Truss’ Northern Ireland Protocol Bill says Lord Empey
Apprentice Boys of Derry: new era of respect makes for enjoyable ‘Relief’ parade
BBC political editor Enda McClafferty sees the funny side after he’s caught on camera underdressed for live TV report
Feile organisers asked if they have warned Wolfe Tones about leading young people in pro-IRA chants
Shocked by the level of detail on the paper, which is dated January 17, 2020, the man contacted the Portadown Times and handed over the document.
It outlined in detail the patient, their age, social history as well as a brief medical history and why they had been admitted to hospital.
A spokesperson for the Southern Health Trust, which oversees Craigavon Hospital, admitted that confidential documents such as this should not have left the hospital site.
The man who found the documents said: “I would like to know how records, which are supposed to have been kept in a secure location, made their way to the Wood Lane in Lurgan and were found discarded on the roadside.”
The man suggested, that given there is a date, this may pinpoint who was involved in taking these papers.“I would expect that they may pinpoint who was involved.
“Someone had to have taken them out of the office in which they were kept,” he said.
Many of the patients documented were elderly.
The document finder asked: “How would you feel if it was your mother or father or grandparent?
“These are very personal details and should never have left the hospital never mind end up at the side of a road”
He added: “I hope these patients and their families or carers will be informed of this confidentiality breach.”
“Whoever took those documents from the hospital clearly has a total disregard for patient confidentiality. Was this the first time this person took documents? How many documents have been taken and how many patients are effected by this breach and what is the full extent of this breach of confidentiality?” he asked.
The documents shows the name, bay and bed of each patient on one ward followed by their age and social history.
Most of the patients were elderly and some had a ‘Do Not Resuscitate’ notice.
It also gives their reason for admission, diagnosis/investigation.
Furthermore it details relevant medical history as well as allergy status, infection and Control DNAR.
Notes also detail assessment and recommendations for each patient.
Finally it details critical meds and the level of care.
A Trust spokesperson said: “These confidential patient records should not have left Craigavon Area Hospital.
“We take patient confidentiality very seriously and this incident will be fully investigated and we have reported this breach to the Information Commissioner’s Office.
“We appreciate that this information once found was kept confidential and we were quickly alerted about it.
“We will be reviewing our procedures to ensure that information about patients is stored safely at all times and these breaches are avoided in future.”
A spokesperson for the Information Commissioners Office said: “People’s medical data is highly sensitive information, not only do people expect it to be handled carefully and securely, organisations also have a responsibility under the law.
"When a data incident occurs, we would expect an organisation to consider whether it is appropriate to contact the people affected, and to consider whether there are steps that can be taken to protect them from any potential adverse effects.
“Southern Health NHS Foundation Trust has made us aware of an incident and we will assess the information provided.”
A spokesperson for the Department for Health said: “The Department has been informed of the incident. The Trust is undertaking an investigation and will keep the Department updated.”
A spokesperson for the Patient and Client Council said; “Our role in the PCC is to be an independent, informed and influential voice that makes a positive difference and advocates for people across Northern Ireland in Health and Social Care. We assist over 1,500 individuals a year who have concerns, queries or need advice and information on their health and social care.
“Naturally we are concerned by that this data breach and are pleased to see that the Southern Trust have reported the incident to the Information Commissioners Office and are taking appropriate action.
“Should anyone have a concern or query in relation to their health and social care or the confidentiality of their records they can contact us through our Freephone 0800 917 0222 or email [email protected]”