WHAT SHOULDN'T have happened is the laptop be stolen without a CMOS password being set to allow the machine to boot, and an encrypted filesystem for the sensitive data.
And, he should have had a "mother, may I?" letter on file. CYA.
/johnny
CMOS password would not matter. It's on a disk, and any disk can be read if a person wants. Even after the data has been deleted, the disk can still be read. A data disk just marks the information as deleted, but it is still there. Anyone with some lightly advanced computer skills could read a disk, protected or otherwise.
The other thing is that if the person was doing after hours work, he/she would have only taken a part of the database, not the whole thing.
Not any more. There are many SW products out now to keep data accessed controlled. It's no surprise that the VA is behind the curve though.