Central Florida Regional Hospital shipped a few boxes of medical records via UPS. The records were supposed to end up in Las Vegas for a Medicare audit, and most of the records made it safe and sound. But one box went missing.

When the shipment showed up a little lighter than it was supposed to be, Las Vegas auditors notified the hospital. And of course, the hospital must’ve jumped into action and notified its patients of the info leak, right? Nope. The hospital waited until three weeks after it learned of the mistake to get in touch with UPS.

UPS didn’t have the box. The company followed standard protocol when a package isn’t delivered after three months: It was sold.

The box, containing medical records for 28 patients, ended up in Utah at a surplus store. It was sold as scrap paper to a fourth grade teacher for about $20.

The records contained patients’ medical histories, phone numbers, addresses, Social Security numbers and insurance info. The hospital’s looking into ways to make sure something like this doesn’t happen again.

Interestingly enough, the father of a Florida attorney had records among those that were sold. The attorney’s still trying to figure out who to sue.