They were trying to drum up money for the mortuary side.

If it sounds too good to be true, it probably is.

We're going to have to look at each one of them very carefully.

Their actions in how they secured (the records) was not reasonable and certainly their actions after they found out about the breach were not reasonable, too late, too late.

There are some serious questions here.

There are some serious questions here. It is very reasonable for you to expect that your medical records will be kept safe and secure. That doesn't appear to be what happened.