Last week, the Lincoln Parish Journal broke the news that Green Clinic had experienced a major cyber attack. A day later, administrators for the clinic confirmed the disruption.
The LPJ has interviewed Landon Tooke, a healthcare attorney whose practice focuses primarily on health law and cyber law, regarding the logistics of what happens when a medical facility in Louisiana experiences a cyber attack. While Tooke is not speaking specifically about Green Clinic’s particular case, the questions are broad enough to cover any medical facility that experiences this kind of digital disruption.
The following is a transcribed Q&A between LPJ Co-Owner Kyle Roberts and Tooke.
Roberts: “What is the normal protocol intended to be when a medical facility in Louisiana is hacked and digital patient records are compromised?“
Tooke: “A healthcare provider subject to HIPAA must activate its security-incident response procedures, investigate the intrusion, and mitigate harmful effects to the extent practicable. That response generally includes engaging qualified cybersecurity professionals, isolating affected systems, preserving evidence, determining whether the attackers accessed, copied, altered, or destroyed records, and working to restore safe access to patient information. Federal guidance also recommends contacting the FBI or Secret Service. Louisiana State Police’s Cyber Crime Unit provides another law-enforcement resource for cyberattacks and network intrusions. Throughout the response, the provider must address risks to the confidentiality, integrity, and availability of patient information, including risks that interfere with patient care.
“The provider must also evaluate its notification obligations under HIPAA and Louisiana law. A ransomware attack can trigger HIPAA’s breach-notification requirements even without evidence that an attacker downloaded records. Under HHS guidance, when ransomware encrypts unsecured electronic protected health information, the attacker’s possession or control of that information constitutes an impermissible disclosure. HIPAA presumes a breach unless the provider demonstrates, through the required risk assessment, a low probability that the incident compromised the information.”
Roberts: “If records are stolen digitally, who is at fault?“
Tooke: “The criminals bear responsibility for the attack and theft. Whether the healthcare provider or a technology vendor also bears legal responsibility requires a separate analysis. A successful cyberattack does not, by itself, establish negligence or a HIPAA violation. That determination depends on the applicable legal duties and the evidence, including whether the organizations implemented appropriate safeguards, addressed identified risks, maintained required backup and recovery procedures, and responded appropriately after discovering the incident.
“A healthcare provider can suffer a criminal attack and still face accountability for its own security or compliance failures. A vendor’s involvement likewise does not eliminate the provider’s obligations. When a breach occurs at or through a business associate, HIPAA requires the business associate to notify the covered provider. The provider remains ultimately responsible for ensuring that affected individuals receive the required notices, although it may delegate delivery of those notices to the business associate.”
Roberts: “If a clinic has no backups, what does that mean under Louisiana’s six-year record-retention requirement?“
“Louisiana generally requires physicians and dentists to retain medical and dental records for at least six years from the date they last treated the patient. That provision does not establish a universal retention period for every type of healthcare facility or diagnostic material. For example, Louisiana law generally requires hospitals to retain records for ten years. If an attack permanently destroys records that a physician or dentist must still retain, the loss raises a serious compliance issue. The fact that a criminal caused the loss does not, by itself, establish that the responsible professional fulfilled the retention obligation.
“HIPAA imposes a separate, express backup requirement. Its Security Rule requires covered providers and business associates to establish and implement procedures to create and maintain retrievable, exact copies of electronic protected health information. It also requires disaster-recovery procedures to restore lost data. A written backup policy alone does not satisfy the requirement to implement backup procedures. The absence of usable backups therefore raises an issue distinct from the cyberattack itself of whether the responsible organization maintained the safeguards that federal law requires.
“A provider that fails to meet HIPAA’s requirements can face federal enforcement, civil monetary penalties, and corrective-action requirements. The consequences depend on factors that include the nature and extent of the violations, the resulting harm, the provider’s level of culpability, and its corrective efforts. HIPAA’s penalty framework distinguishes reasonable cause from willful neglect and treats uncorrected willful neglect more severely than willful neglect that the organization timely corrects.
“Louisiana separately requires businesses within the scope of its data-security law to maintain reasonable safeguards and classifies violations as unfair acts or practices. Depending on the applicable law, the practice’s licensing status, and the enforcement authority’s findings, potential consequences can include monetary penalties, corrective-action requirements, and licensing sanctions. Louisiana also expressly authorizes physician discipline for failing to create or maintain medical records. Potential sanctions include fines, license restrictions, suspension, or revocation. These consequences do not follow automatically from a cyberattack. Instead, they depend on the specific violations and each party’s responsibilities and conduct.”
Roberts: “What must a clinic do for patients in this scenario, and by when?“
“The provider must address its notification obligations and the incident’s impact on patient care. Its response should include recovering records where possible, explaining material limitations that affect care, and providing clear information about the incident and available assistance. A notification deadline does not justify postponing action on an immediate patient-safety concern.
“For a reportable breach of unsecured protected health information, HIPAA generally requires the provider to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Discovery includes not only actual knowledge but also the point at which reasonable diligence would have revealed the breach. Sixty days represents the outside limit, not an automatic waiting period. Sometimes a qualifying law enforcement request can require a reporting delay under certain HIPAA procedures.
“To the extent possible, the notice must (1) explain what happened, including the breach and discovery dates if known, (2) identify the types of information involved, (3) describe protective steps individuals can take, (4) explain the provider’s investigation, mitigation, and prevention efforts, and (5) provide contact information for additional questions.
“HIPAA also requires the provider to notify HHS of a breach affecting 500 or more individuals without unreasonable delay and no later than 60 calendar days after discovery. For breaches affecting fewer than 500 individuals, the provider may report annually but must do so no later than 60 days after the end of the calendar year in which it discovered the breach. If a breach affects more than 500 residents of a state or jurisdiction, the provider must also notify prominent media outlets serving that area within the applicable notification period.
“Louisiana requires a separate analysis because its data-breach law and HIPAA do not cover identical categories of information or use identical notification standards. If Louisiana law requires notice, the provider generally must notify affected residents in the most expedient time possible, without unreasonable delay, and no later than 60 days after discovery, subject to the statute’s exceptions and delay procedures. If the provider relies on a statutory basis to delay notice, it must give the Attorney General written reasons within that 60-day period. When Louisiana law requires notice to residents, La. Admin. Code 16:III.701 also requires written notice to the Attorney General’s Consumer Protection Section. The Attorney General must receive that notice within ten days after the provider distributes the resident notices.”
Roberts: “What should patients do if they believe their records were lost, and what recourse do they have?“
“The first distinction is between records that a provider cannot currently access and records that the provider can no longer recover. A ransomware attack does not necessarily mean that the provider has permanently lost every affected record. The investigation and recovery process should clarify the extent of the disruption and the provider’s ability to restore information.
“The provider’s formal notices and public updates serve as important sources of information about the incident, its effect on patients, and any assistance the provider offers. From a patient-care standpoint, the central concern is whether missing information interferes with ongoing treatment. Information that other treating providers maintain may help fill gaps, although duplicating the missing record is unlikely.
“A separate concern involves the misuse of stolen information. Unfamiliar medical bills, insurance claims, or entries in a medical history can indicate medical identity theft. Depending on the information the attackers obtained, protective measures may include credit freezes, fraud alerts, and identity-theft reporting through IdentityTheft.gov. Credit monitoring alone does not address every risk associated with medical identity theft.
“As for recourse, patients can submit complaints about potential HIPAA violations to the HHS Office for Civil Rights. The filing deadline generally runs 180 days from when the complainant knew or should have known of the alleged act or omission, although HHS may waive the deadline for good cause. The Louisiana Attorney General’s Consumer Protection Section also receives concerns involving the state’s data-breach notification requirements.
“HIPAA does not itself give patients a private right to sue for damages. State law may support other claims, but those claims depend on the applicable legal duties, the evidence, causation, and legally recoverable harm. Louisiana law specifically permits recovery of actual damages resulting from a failure to provide timely notice of a qualifying breach. It does not create an automatic right to compensation whenever a cyberattack occurs.
“Ultimately, neither a breach nor the loss of records alone resolves civil liability. A damages claim requires analysis of the particular cause of action and its elements. Regulatory authorities, however, can enforce compliance requirements without a patient first establishing an individual damages claim.”
Roberts: “Why do cybercriminals target healthcare organizations, and what makes patient records so valuable?“
Tooke: “Healthcare organizations hold a concentrated collection of sensitive information. A patient record can combine identifying information, insurance details, and clinical history in one place. Criminals can exploit that information for identity theft, fraud, or extortion. The combination makes healthcare information particularly attractive because its value extends beyond a single account number or financial transaction.
“Ransomware creates another source of leverage. Healthcare providers depend on timely access to reliable information to treat patients and maintain operations. Attackers can exploit that dependence by disrupting access to records while also threatening to release stolen information. Federal agencies have warned for years that criminals specifically target the healthcare sector for ransomware, data theft, and service disruption.
“The scale of the problem underscores that warning. HHS’s 2024 report to Congress identified 663 breaches affecting 500 or more individuals that occurred during that year. Hacking and IT incidents accounted for 81% of those reported breaches. The 2024 Change Healthcare ransomware attack affected approximately 192.7 million individuals, according to the company’s July 2025 update to HHS. Nearly a decade earlier, the Anthem breach exposed identifying and insurance-related information involving almost 79 million people. These incidents demonstrate the extraordinary scale of the threat to healthcare information.
“For healthcare organizations, cyberattacks are a longstanding, well-documented risk, not an unforeseeable development. Providers should account for that risk in their security planning, backup procedures, and recovery capabilities. That does not mean every successful attack proves negligence or a legal violation. It means the relevant inquiry extends beyond how the criminals entered the system to whether the organization took appropriate steps to protect information and prepare for a known threat.”
