A bundle of confidential patient records has been discovered by a dog walker.
The West Suffolk Hospital list and a doctor's letter containing patient details were found at Trumpington Meadows nature reserve near Cambridge on Sunday.
The hospital list includes 12 patients' full names, birthdates, medical history and reasons for admission.
A hospital spokesman said a formal investigation had been launched.
"We will directly contact the small number of patients affected to apologise and have informed the Information Commissioner's Office," he said.
The bundle was found alongside a GP letter and test results for an elderly patient.
The hospital "doctors' worklist" outlined patients' health problems, including conditions such as anxiety and depression.
It also revealed the bed and ward bay they were staying in, admission dates, their consultants' names, length of stays and required treatment, including operations.
The document - found 28 miles (45km) away from the hospital in Bury St Edmunds - was also marked with handwritten notes about each patient.
The folded-up papers included a copy of an email from a GP which was sent to a consultant surgeon at the hospital last month.
It was flagged as urgent and featured the elderly patient's NHS number, name, date of birth, address, phone number and reason for an impending operation.
The patient's test results were typed on the back of the letter.
The records were found lying on the ground by the dog walker, who was concerned about the data breach and passed them to the BBC.
She described the discovery of patients' personal information as "appalling".
"It's airing personal medical details and it upset me because I wouldn't want that.
"In the wrong hands all manner of things could happen with that information... everyone has to take this issue very seriously."