HIPAA alert! It turns out that private dental patient records were sold for $15.

Yes – fifteen dollars. A “junk collector” in Stockton, California, spent $15 to purchase hundreds of boxes that had been left behind in a storage locker.

When he opened them up, he discovered thousands of dentist records – including names, Social Security numbers and dental x-rays. He works in the medical field and was immediately concerned about patient privacy issues. “Anybody had access to all this information for $15. I bought the shed and got all this info,” he said.

So how did this happen?

The files had been stored by a now-defunct company, and the files were somehow misplaced when that company was purchased by Dental Group of Stockton. That group had no idea the files existed, and recently stopped paying the rental fee for the storage space.

The man has considered filing a complaint with the state dental board. While Dental Group of Stockton initially rejected any responsibility for the files, in a smart dental management move, they have offered to pay all costs to destroy the information.

No word yet on if they’ll refund the $15 purchase price.

Read more: Junk buyer ends up with private dental records