JMIR Publications

ABSTRACT

Background:

Data breaches are an inevitable risk to hospitals operating with information technology. The financial costs associated with data breaches are also growing. The costs associated with a data breach may divert resources away from patient care, therefore negatively affect hospital productivity.

Objective:

After a data breach, the resulting regulatory enforcement and remediation is a shock to a hospital’s patient care delivery. Exploiting this shock, the association between hospital data breaches and productivity was estimated using a generalized difference-in-differences model with multiple pre and post periods.

Methods:

The study analyzed the California Office of Statewide Health Planning and Development hospital financial data from 2012 to 2016. The study sample was an unbalanced panel of hospitals with 2,610 unique hospital-year observations, including general acute care hospitals. California hospital data was merged with breach data published by the Department of Health and Human Services. The dependent variable was hospital productivity measured as value-added. The difference-in-differences model was estimated using a fixed-effects regression.

Results:

Hospital productivity did not significantly differ from the baseline for three years after a breach. Data breaches were not significantly associated with a reduction in hospital productivity. Before a breach, the productivity of breached hospitals maintained a parallel trend with control hospitals.

Conclusions:

Hospital productivity was resilient against the shocks from a data breach. Nonetheless, data breaches continue to threaten hospitals, therefore healthcare workers should be trained for cybersecurity to mitigate disruptions.