Understanding the Relationship Between Data Breaches and Hospital Advertising Expenditure

Background: Breached hospitals incur significant costs associated with remediation activities, yet the costs associated with data breaches are not readily captured in hospital financial disclosures. Objective: To estimate the relationship between data breaches and hospital advertising expenditure. Study Design: Observational data on hospital expenditure was analyzed using a propensity score matched regression. The regression was specified as a generalized linear model using a gamma distribution and log link. Methods: Study sample included Medicare hospitals captured by a survey of traditional media outlets. Hospitals included were non-federal acute-care inpatient hospitals from 2011 to 2014. Voicetrak provided data on hospital advertising expenditures. Healthcare Cost Report Information System provided data on hospital characteristics and financial variables. Study groups were matched using observable characteristics, such as revenue, number of beds, discharges, ownership, and teaching status. The study excluded hospitals in the U.S. territories and Maryland for financial reporting consistency. Data breaches included theft, loss, unauthorized access/disclosure, improper disposal, and hacking. Advertising expenditure was collected from media outlets including television, radio, newspapers and business journals, and local magazines in a city/metropolitan area. Results: Breached hospitals (n=72) were more likely to be large, teaching, and urban hospitals relative to the control group (unweighted n=915). A data breach was associated with a 64% (95% CI,[0.7%,252%]; P= 0.023) increase in annual advertising expenditure, holding observable characteristics constant. Conclusion: Breached hospitals were associated with significantly higher advertising expenditure. Efforts to repair the hospital’s image and minimize patient loss to competitors are potential drivers of the increased spending. Advertising costs subsequent to a breach is another cost to the health care system that could be avoided with better data security.