Dr bob's computerized records have been compromised by a virus, resulting in damages to patients. Which of the following is most true?

Question

a) Dr bob will not be liable.
b) dr bob will be liable.
c) dr bob won't be liable if the virus was introduced by someone outside office
d) dr bob may be liable if he is not using good antivirus software

I have about 3 questions regarding security on computers. I'm sure these questions are trying to catch me out/or confuse me and make me think twice. I think the answer is d)