Why Louis Mezzoni walked into Central Florida Regional Hospital in May 2006 is, frankly, none of your business.

His medical records — as are nearly all medical records in the U.S. — are private, guarded heavily by the Health Insurance Portability and Accountability Act.

When, at 77, Mezzoni died a few months after his visit to Central Florida Regional, his wife had trouble acquiring the records for billing purposes.

She was shocked when she found out they were sold last month at a Salt Lake surplus store for about $20.

"I find it inexcusable," said Susan Mezzoni, a nurse who lives in Lake Mary, Fla. "I don't like that they're out there."

Along with 27 others, Louis Mezzoni's records were unwittingly sold to a Salt Lake-area school teacher looking for a good deal on scrap paper for her fourth-grade class.

No charges are likely to follow, and officials chalked the incident up to a shipping problem. The people affected, however, want to know how it happened and, more importantly, how to make sure it doesn't happen again.

"I'm aghast," said Marcy Lippincott, a Lake Mary attorney whose father's records were among those that were lost. "I'm wondering who to sue. It's a complete invasion of privacy. It's appalling to think your records can be out there somewhere like that."

In December, the box was one of three shipped to a Las Vegas company for a Medicare audit, said Kelly Ferrell, the hospital's risk manager. Hospital officials had been tracking the box since it was reported missing in Phoenix but had not contacted the affected patients, she said.

"This stuff is very confidential," she said. "We worry about wrongful disclosure. That information is very personal."

The packages were certified and sent via UPS, Ferrell said. When one of the boxes did not arrive, a Las Vegas auditor on Feb. 4 contacted hospital officials who, in turn, contacted UPS two weeks later.

Officials said they were unsure how the box made its way to Utah, though the package containing the records also had a document indicating it was "overgoods" — a package that was sold because the shipping company could not deliver it or find its owner.

Shipping companies often sell off packages that cannot be delivered, but a UPS spokesman said his company keeps packages for at least three months before liquidating them.

"UPS has developed a very extensive and technologically advanced system for trying to identify and locate missing packages," Dan McMackin said. "And yes, we do inspect every shipment deemed to be overgoods. All sensitive shipments are treated with confidentiality and disposed of properly."