M. Eric Johnson, PhD

 To estimate the relationship between data breaches and hospital advertising expenditures.

 Observational data on hospital expenditures were analyzed using a propensity score—matched regression. The regression was specified as a generalized linear model using a gamma distribution and log link.

 The study sample included Medicare hospitals captured by a survey of traditional media outlets. Hospitals included were nonfederal acute care inpatient hospitals from 2011 to 2014. Voicetrak provided data on hospital advertising expenditures. The Healthcare Cost Report Information System provided data on hospital characteristics and financial variables. Study groups were matched using observable characteristics, such as revenue, number of beds, discharges, ownership, and teaching status. The study excluded hospitals in Maryland and the US territories for financial reporting consistency. Data breaches included theft, loss, unauthorized access/disclosure, improper disposal, and hacking. Advertising expenditures were collected from media outlets including television, radio, newspapers and business journals, and local magazines in a city/metropolitan area.

 Breached hospitals (n = 72) were more likely to be large, teaching, and urban hospitals relative to the control group (unweighted n = 915). A data breach was associated with a 64% (95% CI, 7.2%-252%; 

 = .023) increase in annual advertising expenditures, holding observable characteristics constant.

 Breached hospitals were associated with significantly higher advertising expenditures in the 2 years after the breach. Efforts to repair the hospital’s image and minimize patient loss to competitors are potential drivers of the increased spending. Advertising costs subsequent to a breach are another cost to the healthcare system that could be avoided with better data security.

In this observational study, we investigated the relationship between data breaches and hospital advertising expenditures.

A data breach was associated with a 64% increase in annual advertising expenditures, holding observable characteristics constant.

Efforts to repair the hospital’s image and minimize patient loss to competitors are potential drivers of the increased advertising spending.

A data breach that exposes protected health information is a public relations crisis for hospitals. Healthcare data breaches include theft, loss, unauthorized access/disclosure, improper disposal, and hacking of protected health information. The Health Information Technology for Economic and Clinical Health (HITECH) Act mandates hospitals covered by the Health Insurance Portability and Accountability Act to report data breaches exposing more than 500 individuals to those affected, as well as HHS and sometimes the media, typically within 60 days of discovering a breach. The Office for Civil Rights investigates reported data breaches and enforces corrective action.

 The reported breaches have been published by HHS since October 2009 in a public database,

 and the Privacy Rights Clearinghouse (PRC) also provides information on reported health data breaches to the public.

Managed care and market-based reforms have driven hospitals to compete for patients. In a competitive market, hospitals use advertising to market services and communicate information directly to patients. It has previously been found

 that hospital advertising increased with market concentration. In recent years, spending on hospital advertising has skyrocketed. The hospital industry spent $2.3 billion on advertising in 2014—a 38% increase from 2011, according to the Kantar Media survey.

Cancer center advertising spending increased 3-fold from 2005 to 2014.

 Increased advertising reflects the efforts by cancer centers to attract patients in a competitive market, especially as the demand for cancer care increases with the aging population.

 For example, cancer center advertisements promote the benefits of cancer therapy with emotional appeals

; samples of award-winning hospital advertisements highlight positive experiences and emotions associated with care and improved quality of life.

Breached hospitals incur significant costs associated with fixing the breach and protecting the affected individuals from further harm. Investigation of a reported breach by HHS usually takes about a year to complete. The investigation concludes with a settlement, including a penalty of hundreds of thousands of dollars and/or remedial action, which typically must be implemented within 2 to 3 years. Separate from HHS investigations, some breaches result in class-action lawsuits.

 The advertising expenditures that we investigated occurred subsequent to the breach disclosure and added to the remediation costs outlined above. Based on a survey of US firms from 2005 to 2014, Romanosky

 estimated that the median cost of a data breach was $200,000, including costs from investigating the breach, notifying the affected individuals, public relations, credit monitoring, litigation, and fines.

The Ponemon Institute estimated that in 2016, the healthcare industry spent an average of $402 per stolen record for direct and indirect costs associated with a breach.

 Costs vary depending on the size and type of the breach; accordingly, it has been found that large breaches place a larger financial burden on the organization.

 found that data breaches in hospitals were associated with decreased outpatient visits and admissions in the long run. Their findings suggest that hospitals are vulnerable to patient loss after a breach.

Carefully crafted marketing campaigns can be launched by a hospital to build up its image and minimize patient loss after a breach. Several hospitals and health systems—serving Florida, Michigan, North Carolina, or Texas&mdash;that reported breaches between 2016 and 2018 made award-winning advertisements within a year of the breach. These observations motivated our investigation on how data breaches affect hospital expenditures. Together with expenditures related to disclosing and repairing the damage from a breach, such advertising is a potentially preventable burden to the healthcare system. The aim of our paper was to investigate the relationship between data breaches and hospital advertising expenditures by analyzing a national sample of nonfederal acute care inpatient hospitals from 2011 to 2014.

After a breach occurs, depending on the type, it may take weeks or months until it is discovered and reported. We used HHS and PRC data on breaches, which included the name and location of the breached entity, time of breach reporting, type of breach, and number of records exposed (data from both entities are available for public download).

 It should be noted that the HHS database does not include breaches that affect fewer than 500 individuals; thus, it is not an exhaustive record of all health data breaches.

Voicetrak provided data on hospital advertising expenditures based on surveys of media vehicles. Voicetrak conducts a quarterly survey of 9300 local media vehicles in 210 media markets across the United States. Media vehicles include television, cable systems and interconnects, radio stations, newspapers and business journals, out-of-home companies, and local magazines in a city/metropolitan area. Voicetrak data are available to the public for purchase.

 Voicetrak data did not capture online advertising expenditures; thus, their estimates capture only part of the total advertising cost. Quarterly advertising expenditures were aggregated to yearly expenditures. The advertising data do not distinguish between individual hospital expenditures and system-level expenditures.

The Healthcare Cost Report Information System (HCRIS) provided data on hospital revenues, expenses, discharges, beds, ownership status, teaching status, rural status, and meaningful use status (meaningful use of electronic health records as defined in HITECH). Medicare-certified hospitals are required to submit an annual cost report to HCRIS (data are available for public download).

 HCRIS data were the primary data set into which other data sets were merged. The data sets were joined by hospital name and year. HHS and Voicetrak data provided the business name of the hospital but no standardized identifier; therefore, hospital names in these 2 data sets were manually matched to the hospital names in HCRIS.

Market competition has been linked to hospital advertising expenditures.

 To control for market competition, we added proxies for the county-level supply and demand for health services by merging the 2014 Area Health Resources Files.

 The number of short-term general hospitals in a county was used to measure the supply of hospital care in a county, which represents a metric of hospital competition. The number of Medicare enrollees in a county was used to measure the demand for health services.

To maintain consistency in the financial data, we restricted data to include only nonfederal acute care inpatient hospitals using the CMS definition of facility type.

 Hospitals in the US territories and Maryland (which has a prospective payment system waiver) were excluded for consistency. The data were further restricted to hospitals that filed with HCRIS between 360 and 370 reporting days. When a hospital submitted multiple financial reports in a given year, the most recent report was used. Finally, observations with missing values in the dependent or independent variables were dropped from analysis. The study sample consisted of 3496 hospital-year observations before propensity score matching.

The breached hospitals and control hospitals had different observable characteristics. The breached hospitals were more likely to be large, teaching, and urban hospitals. Propensity score matching was used to adjust for potential sample selection bias due to observable differences between the breached and control hospitals.

The propensity score for assignment into the breached group was predicted using a logit model. In the logit model, we first included all the control variables to the right-hand side, then narrowed down the predictors by inspecting the balance of the matched sample with standardized mean differences (SMDs). An SMD of less than 0.1 for the covariates between the 2 groups indicates a negligible difference in the mean.

 We generated the balanced sample using the following controls: operating revenue, hospital discharges, number of beds, occupancy rate, length of stay, number of general hospitals in a county, Medicare enrollment, ownership, teaching status, and year.

Hospitals were matched using the nearest neighbor matching approach allowing for ties, with replacement, with a caliper distance of 0.2 SD.

 If 1 breached hospital matched multiple control hospitals (

), resulting in a tie, the multiple matched control hospitals were weighted by 1/

. Matching was performed using the Matching package 4.9-3 in R.

 Of the 75 observations in the full sample of breached hospitals, 3 observations failed to match. Thus, the matching yielded 72 observations in the breached group and 915 unweighted observations in the control group. The matched sample was used for empirical modeling.

Hospital advertising expenditure was heavily right-skewed. Ordinary least square (OLS) regression fails to consistently model a skewed dependent variable. A generalized linear model (GLM) addresses the weaknesses of OLS and is a popular method for modeling healthcare costs.

 The dependent variable was hospital advertising expenditures, which were measured in 2 ways. First was the annual hospital advertising expenditure adjusted to 2014 dollars. The advertising expenditures captured by Voicetrak were conditional on a hospital having nonzero expenditures. Alternatively, to capture the increase in advertising expenditures subsequent to a breach, we also measured the 2-year hospital advertising expenditures by summing the current year’s and next year’s expenditures. The dependent variable was specified as a gamma distribution. The link function was set to log.

A dummy variable was set to 1 for a breached hospital; it was set to 0 for a nonbreached (control) hospital. The coefficient on the breach dummy estimated the difference in advertising expenditures between breached and control hospitals. A vector of hospital characteristics adjusted for confounders, including total revenue, total margin, operating revenue, operating margin, number of beds, length of stay, occupancy rate, total discharges, ownership, teaching status, rural status, meaningful use status, and year fixed effects. Standard errors are heteroscedasticity robust and account for within-hospital correlation. GLM was performed using Stata version 14 (StataCorp; College Station, Texas).

A descriptive scatterplot of advertising expenditures and bed size fitted with a second-degree polynomial curve (

) showed a positive correlation up to about 1000 beds. A few hospitals with more than 2000 beds spent less on advertising, and those extreme cases pulled the fitted line down as bed size increased above 1000. When stratified by breach status, breached and control hospitals followed a similar concave trend. Breached hospitals spent more than nonbreached hospitals; however, the fitted lines of the 2 groups were not significantly different for most of the range of the hospital beds.

The descriptive characteristics of the full sample of hospitals are summarized by breach status in 

. Note that each observation in the data set was a hospital-year, as a single hospital may be repeatedly observed over time. The number of hospitals in the breached group was 75, and the number of hospitals in the control group was 3421. The breached hospitals spent nearly 3 times more on advertising than the control hospitals (approximately $688,000 vs $238,000 for annual spending; $1,713,000 vs $551,000 for 2-year spending). The breached hospitals were more likely to be larger in bed size (565.60 vs 291.49), more likely to be a teaching hospital (77.4% vs 41.7%), and higher in occupancy rate (69.11% vs 57.62%). Breached hospitals were located in counties with significantly more hospitals and Medicare enrollees, suggesting that they were in more competitive areas.

, the number of propensity score—matched hospitals in the breached group was 72; the unweighted number of matched hospitals in the control group was 915. For continuous variables, means (SDs) are shown. The breached hospitals spent $817,205.11 ($1,379,037.92) on advertising expenditures in the year of the breach, which was higher than the $568,078.12 ($1,485,531.25) spent by the matched control hospitals (SMD >0.1). The breached hospitals spent $1,753,358.75 ($2,791,376.50) on advertising over 2 years, whereas the matched control hospitals spent $1,126,682.72 ($2,813,634.41) over 2 years (SMD >0.1).

Focusing on the breached hospitals, the total revenue was $1058.77 million ($853.84 million), with a total margin of 6.75% (9.03%). The operating revenue was $843.92 million ($670.12 million), with an operating margin of —14.22% (55.71%). Total discharges were 27,876.02 (17,333.74) patients. The number of beds was 592.93 (367.47), the length of stay was 4.92 (0.86) days, and the occupancy rate was 69.28% (15.79%). For categorical variables, percentages are shown followed by counts. Ownership was mostly nonprofit (69.4% [n = 50]; investor owned: 12.5% [n = 9]; public: 18.1% [n = 13]). Teaching status was dominantly teaching (76.4%; n = 55). Most hospitals were urban (91.7%; n = 66) and meaningful users of health information technology (IT) (59.7%; n = 43). The characteristics of the matched control hospitals generally had negligible differences from the breached group, with an SMD of less than 0.1 for most of the regressors.

The GLM estimates using the matched sample are shown in 

. A data breach was associated with a 64% (95% CI, 7.2%-252%; 

 = .023) increase in annual advertising expenditures compared with the matched control group, holding observable variables constant. Similarly, the 2-year advertising expenditures were 79% (95% CI, 16.4%-274%; 

 = .008) higher for the breached hospitals. Nonprofit hospitals were associated with 3.7 (95% CI, 1.8-7.6; 

 <.001) times higher advertising expenditures than public hospitals. Two-year advertising expenditures of nonprofit hospitals were 4.9 (95% CI, 2.3-10.8; 

 <.001) times higher than public hospitals. Two-year advertising expenditures of investor-owned hospitals were 2.5 (95% CI, 1.2-5.3; 

 = .019) times higher than public hospitals. Relative to nonteaching hospitals, spending was not significantly higher in either major or minor teaching hospitals. Urban hospitals were associated with 4.0 (95% CI, 2.3-6.8; 

 <.001) times higher advertising expenditures than rural hospitals. The count of Medicare enrollment in a county was positively correlated (

 <.001) with 2-year advertising expenditures. The number of short-term general hospitals in a county was positively correlated with both 1-year (8.1% increase; 

Hospital data breaches were associated with a 64% increase in annual hospital advertising expenditures relative to control hospitals, independent of observed hospital and area characteristics, such as bed size, revenue, and number of hospitals in the county. Hospital advertising expenditures were proportional to bed size and also skewed to the right due to relatively few high spenders. The relationship between advertising expenditure and bed size was positive; as seen in the Figure, the slope was positive for bed size up to 1000, then it flattened for bed size above 1500. Larger hospitals may have more market power and, therefore, may not need to spend as much on advertising compared with hospitals in competitive markets.

The descriptive characteristics of the full sample of hospitals in Table 1 showed that the breached hospitals were more likely to be larger teaching hospitals. This is consistent with previous studies that have described breached hospitals.

 The risk of a data breach increases with the size of the organization, as larger organizations tend to have more points of entry that are vulnerable to attackers (ie, more health IT infrastructure and devices that could be hacked, lost, or stolen).

 Additionally, teaching hospitals serve as an environment for education and, therefore, may have more interactions among clinicians that involve patient data in that capacity.

Propensity score matching adjusted for the potential sample selection bias due to observable differences between the breached and control hospitals.

 The SMDs between the breached and control groups were mostly below 0.1, indicating a reasonable balance between the groups, yet the difference in mean advertising expenditures between the breached and control hospitals remained in the matched sample.

Using the matched sample, the GLM model estimated that a breached hospital spent 64% more on annual advertising expenditures than a control hospital. Similarly, a breached hospital spent 79% more on 2-year advertising expenditures than a control hospital. The estimated relationship is multiplicative, which means that the annual advertising spending of breached hospitals was 1.64 times larger (2-year spending was 1.79 times larger) relative to control hospitals, independent of hospital characteristics such as bed size. Given the negative operating margins of the hospitals in this study (Tables 1 and 2), increased advertising spending associated with a data breach may divert resources and attention away from patient care.

Market competition is likely to confound the relationship between data breaches and advertising expenditure.

 Each additional short-term general hospital in a county was associated with an 8.1% increase in annual advertising expenditures, or a 17.3% increase in 2-year advertising expenditures (Table 3).

The data breaches studied in this paper were reported from 2011 to 2014, when ransomware attacks were rare. These types of attacks on hospitals emerged in 2016 and have become a serious threat to care delivery systems.

 They are considered to be more disruptive to hospitals than the breaches considered in this study, and, thus, ransomware may be associated with even larger advertising spending.

It should be noted that the findings of this study are limited to reported data breaches that affected more than 500 individuals. Smaller breaches involving fewer than 500 individuals are not published in the HHS database; however, there is a nontrivial number of such breaches that are reported to HHS.

 Smaller breaches are not subject to reporting and remediation actions and, therefore, are less likely to draw patient attention or motivate increased advertising.

To our knowledge, this paper is the first step in studying the relationship between data breaches and hospital expenditures with empirical data. The costs associated with breaches are not readily captured in hospital financial disclosures. Subsequent to a data breach, remediation efforts and corrective actions usually take 2 to 3 years to implement.

 The long time span over which remediation efforts are implemented adds to the challenge of attributing the costs of a breach to quarterly or annual financial data. An effective public relations response to a data breach is likely to begin soon after the breach is disclosed to the public. The timeliness of advertising expenditure data allowed us to overcome measurement challenges.

We found that breached hospitals were associated with significantly higher advertising expenditures. Repairing the affected hospital’s image and minimizing patient loss to competitors are potential drivers of the increased spending. Regardless of the motivation, breach response adds financial burden to hospitals and the healthcare system. Advertising and the efforts to fix the damages from a data breach increase healthcare costs and may divert resources and attention away from initiatives to improve care quality. Advertising costs subsequent to a breach are another cost to the healthcare system that could be avoided with better data security.

 Department of Health Management and Informatics, University of Central Florida (SJC), Orlando, FL; Owen Graduate School of Management, Vanderbilt University (MEJ), Nashville, TN.

 This work was partially supported by a collaborative award from the National Science Foundation, award CNS-1329686.

 The authors report no relationship or financial interest with any entity that would pose a conflict of interest with the subject matter of this article.

 Concept and design (SJC); acquisition of data (SJC); analysis and interpretation of data (SJC); drafting of the manuscript (SJC); critical revision of the manuscript for important intellectual content (SJC, MEJ); statistical analysis (SJC); obtaining funding (MEJ); administrative, technical, or logistic support (MEJ); and supervision (MEJ).

 Sung J. Choi, PhD, Department of Health Management and Informatics, University of Central Florida, 4364 Scorpius St, Orlando, FL 32816. Email: sung.choi@ucf.edu.

1. Breach Notification Rule. HHS website. hhs.gov/hipaa/for-professionals/breach-notification/index.html. Published July 26, 2013. Accessed September 22, 2016.

2. Breach portal: notice to the Secretary of HHS breach of unsecured protected health information. HHS website. ocrportal.hhs.gov/ocr/breach/breach_report.jsf. Accessed September 22, 2016.

3. Data breaches. Privacy Rights Clearinghouse website. privacyrights.org/data-breaches. Accessed September 1, 2017.

4. Town RJ, Currim I. Hospital advertising in California, 1991-1997. 

. 2002;39(3):298-313. doi: 10.5034/inquiryjrnl_39.3.298.

Articles

A hospital data breach was associated with a 64% increase in annual advertising expenditures.

Understanding the Relationship Between Data Breaches and Hospital Advertising Expenditures

To determine whether health information technology (IT) systems are associated with better patient safety in acute care settings.

In a cross-sectional retrospective study, data on hospital patient safety performance for October 2008 to June 2010 were combined with 2007 information technology systems data. The sample included 3002 US non-federal acute care hospitals. Electronic health record (EHR) system was coded as a composite dichotomous variable based on the presence of 10 major clinical and administrative applications that (if in use) could potentially meet stage 1 “meaningful use” objectives. The surgical IT system was measured as a dichotomous variable if a hospital used at least 1 of the perioperative, preoperative, or postoperative information systems. Hospital patient safety performance was measured by risk-standardized estimated rates per 1000 admissions. Statistical analyses were conducted using an estimated dependent variable methodology with gamma-log link—based weighted generalized linear models, adjusting for hospital characteristics, historical composite process quality, and propensity for EHR adoption.

We found that the use of surgical IT systems was associated with 7% to 26% lower rates for 7 of 8 patient safety indicators (incidence rate ratio [IRR] range from 0.74 to 0.93; all 

values <.01). Further, stage 1 meaningful use-capable EHR systems were associated with 7% to 11% lower rates on 3 of 8 measures (IRR range from 0.89 to 0.93; all 

Our results suggest that the use of IT is associated with modestly lower rates of adverse events in hospitals. However, the cross-sectional design limits our ability to make causal conclusions.

Am J Manag Care. 2014;20(11 Spec No. 17):eSP39-eSP47

A retrospective cross-sectional analysis of a large national sample of nonfederal acute care hospitals suggests that the use of health information technology (IT)—specifically surgical IT systems, and electronic health record (EHR) systems capable of meeting Stage 1 meaningful use requirements&mdash;is associated with moderate, but statistically significant, reductions in adverse patient safety outcomes.

		Hospitals using surgical IT had lower relative rates on 7 of 8 patient safety indicators while those using Stage 1 EHRs had lower rates on 3 measures.

		Health IT including surgical systems and Stage 1-capable EHRs could likely benefit hospitals seeking to improve patient safety.

Patient safety remains a major challenge in the US healthcare system, recently drawing renewed attention as a national priority.

About one-third of hospitalized patients experience adverse events,

and these rates are alarmingly higher at high-quality hospitals.

 The HHS recently announced a $1-billion national initiative, Partnership for Patients, aimed at reducing preventable complications and hospital-acquired conditions by 40%, which could result in about 1.8 million fewer injuries and more than 60,000 saved lives over 3 years.

Recognizing the potential role that health information technology (IT) could play in improving patient safety and quality of care,

 the Obama administration committed $27 billion to promote the implementation and meaningful use (MU) of electronic health records (EHRs).

The widespread and effective use of health IT is expected to help foster an environment of safe, patient-centered care through improved clinical performance; access to timely, relevant clinical information; and better communication between and among caregivers and patients.

Especially in the context of surgical care, the EHR and functional systems like surgical IT (eg, perioperative systems, preoperative systems, and postoperative systems) can improve patient safety through multiple mechanisms such as providing timely and comprehensive health information that may prevent errors or allow for rapid corrections.

For example, recent studies have shown the beneficial impact of health IT on safety outcomes, including timely discontinuation of postoperative antibacterials

; improved adherence to evidencebased guidelines

; enhanced work flow and management of surgical team members

; effective communication to all providers during transitions and across specific phases of care delivery

; and facilitating retrospective analysis of 3 adverse events to guide future improvement efforts.

Despite such growing evidence of health IT benefits,

 recent systematic reviews raised concern over the paucity of generalizable evidence of health IT for patient safety and quality outcomes.

In this cross-sectional retrospective study, we investigate the relationship between hospital IT systems and performance on a subset of Agency for Health Research and Quality (AHRQ) patient safety indicators (PSIs) that include various adverse events such as serious, but potentially preventable, complications related to inpatient medical or surgical care, and deaths for select treatments or conditions. Using a large national sample of nonfederal acute care hospitals, we observed that health IT is associated with modestly lower rates of adverse events. While to the best of our knowledge, this is one of the first studies to demonstrate evidence of a positive relationship between health IT and hospitals’ patient safety measures using national data, the cross-sectional design of this observational study does not allow us to draw causal conclusions about the relationship.

We combined data from 3 sources. Hospital performance data came from the October 2011 release of CMS Hospital Compare on 8 AHRQ indicators related to patient safety and inpatient quality outcomes. These data include facility-level risk-standardized rate estimates, adjusting for patient characteristics, for each measure along with 95% confidence intervals and the number of patients hospitalized (ie, “population” at risk) for each hospital during the sampling period of October 2008 to June 2010.

Hospital IT systems data came from the 2008 release of the Health Information and Management Systems Society (HIMSS) Analytics Database, which includes hospital characteristics and the operational status of health IT achieved by the end of 2007. HIMSS is the most comprehensive database of hospital IT adoption decisions,

 and has been used extensively in health IT research.

 The HIMSS data are taken from 2007, while CMS hospital safety performance data are taken from the subsequent period (2008-2010) to avoid an overlap of the quality measurement period with the initial deployment of new technology.

 Lastly, data on hospitals’ organizational characteristics, used as control variables in our analyses, were obtained from the 2009 CMS Acute Inpatient Prospective Payment System Impact file and HIMSS. Our final sample included 3002 nonfederal acute care US hospitals.

In hospital settings, several types of IT systems are deployed to manage and facilitate care delivery to surgical patients. In this study, we focus on 3 applications: perioperative, preoperative, and postoperative information systems. Perioperative systems provide clinical documentation and management of relevant real-time surgery procedures, and include functionalities such as clinical order management, decision support, anesthesia documentation, integration to anesthesia systems, smart cabinets, imaging systems, and potentially smart surgical instruments for image-guided surgery. It may also provide support for management of relevant operating room supplies and medications during surgery. Preoperative systems provide clinical documentation and management of relevant presurgery information and patient preparation for surgery. It also provides for the management of relevant presurgery room preparation, operating room supplies and medications, and staff. Postoperative systems provide clinical documentation and management of relevant follow-up procedures as well as transfers to step-down or intensive care units.

In this study, we constructed a linear composite of these 3 technologies as a dichotomous variable to indicate if a hospital had at least 1 of these 3 types of surgical IT systems in use as of 2007. While these 3 technologies may potentially influence patient care outcomes through different modalities, our focus is on the associative relationship between any such aggregate level IT capability supporting surgical care with the select set of AHRQ indicators.

Within the ambit of the federal incentive program, providers are expected to demonstrate the MU of EHR systems based on specific criteria set forth at various stages, with the first stage defined by the 2011 standards. Accomplishing these objectives requires the use of several EHR functionalities—for example, clinical decision support should provide for basic drug-drug, drug-allergy, and drug-formulary checks.

Based on the functionalities required to demonstrate Stage 1 MU, 10 major clinical and administrative systems are needed.

 These systems include admission/discharge/transfer systems; auxiliary information systems (laboratory, pharmacy, and radiology); e-prescribing; clinical data repository; clinical decision support; nursing documentation; electronic medication administration record; and computerized physician order entry systems. Hospitals were categorized as having an EHR system capable of 2011 MU functionality if they had all of the above applications in use by 2007, otherwise as not (serving as the reference group). While complete satisfaction of the 2011 MU objectives requires demonstrating routine clinical and administrative activities using the EHR system, here we measure only whether a hospital had the necessary functional capabilities to carry out those activities.

Measurement of Hospital Patient Safety Performance

Hospital patient safety performance was measured by 8 adverse event indicators developed by AHRQ. These indicators refer to serious but potentially preventable complications from inpatient medical or surgical care; and deaths from select treatment or conditions. These include death among surgical patients with serious, treatable complications; collapsed lung that results from medical treatment (iatrogenic pneumothorax); breathing failure after surgery (postoperative respiratory failure); blood clots in the lung or a large vein after surgery (postoperative pulmonary embolism or deep venous thrombosis); wounds that split open after surgery (postoperative wound dehiscence); accidental cuts and tears (accidental puncture or laceration); death after a surgery to repair a weakness in the abdominal aorta (abdominal aortic aneurysm mortality rate); and death among patients with hip fractures (hip fracture mortality rate).

Hospital Compare reports risk-standardized rates per 1000 patients at risk for each hospital facility based on Medicare Fee-for-Service claims data. Hospital Compare reports these rates based on prediction models implemented in AHRQ-PSI software and risk-adjusted for patient characteristics (age, gender), severity of illness, and 25 comorbidities as covariates (with associated 95% confidence intervals). The details of the risk-adjustment algorithm are described elsewhere.

To ensure adequate reliability in this study, only those hospitals for which PSI rate estimates were based on at least 30 patients at risk were included in our analyses.

Care outcomes are affected by organizational structures, processes of care, and patient characteristics.

 Since the use of IT systems may also be correlated with hospital characteristics leading to selection bias, we estimated propensity scores for having an EHR system in use, employing data from the previous year (2007 HIMSS release), and then constructed dummy variables representing quintiles of EHR system propensity. Likewise, performance on patient safety measures may be influenced by overall hospital quality such that hospitals performing highly on process quality measures are expected to have fewer adverse events.

 To account for such confounding effects, we constructed dummy variables representing quintiles of facility-specific historical performance (2005-2007) on composite process quality scores for acute myocardial infarction, heart failure, pneumonia, and surgical care infection prevention.

We also used a comprehensive set of control variables to account for potential confounding effects: teaching status (academic and minor teaching hospitals); profit status; membership in a multihospital integrated delivery system; magnet status for nursing excellence; presence of cardiac intensive care unit; participation in stroke registry and nursing registry; having a Patient Safety Officer; staffed bed size; rural location; and whether the hospital qualified for Medicare disproportionate share payments.

 All hospital characteristic variables were operationalized as dichotomous variables, except staffed bed size which was categorized into 5 groups (6-99 beds, 100-199 beds, 200-299 beds, 300-399 beds, and 400+ beds).

We used an estimated dependent variable (EDV) modeling approach.

Our dependent variables were risk-standardized rates of adverse events obtained from patient-level data using the AHRQ-PSI algorithm, and were reported in Hospital Compare as rate estimates along with 95% CI (ie, Lower Confidence Level = estimated rate — 1.96*SE, and Upper Confidence Level = estimated rate + 1.96*SE; where SE is standard error of estimate). More specifically, we employed a weighted least-square method within the EDV approach for estimating the relationship between hospital-level PSI rates and IT measures, where the inverse of SE estimates were obtained from algebraic manipulation of upper and lower limits of the CI as facility-specific weights in each regression. Furthermore, since PSI measures are rate variables, each PSI was modeled as a nonlinear regression model with a log link function and gamma distribution using the glm command in STATA 12.0. This is consistent with the notion that safety-related adverse events, if measured as count variables with access to patient-level data, should be modeled using a negative binomial regression

 in which the Poisson parameter (ie, mean rate for individual patients) across each facility is considered gamma distributed.

For each PSI, we performed 3 separate regression models: with EHR and surgical IT system as separate primary predictors (Model 1 and Model 2), and then with both as primary predictors (Model 3). In addition to controlling for hospital characteristics identified above, in each regression we clustered errors at hospital referral region

 (as defined in Dartmouth Atlas) level to account for potential confounding effects of factors at the local market level. We report results of the marginal effects of EHR and surgical IT systems in terms of the relative risk-standardized rates for each PSI.

. In the study sample, about 21% of hospitals had EHR systems capable of meeting the Stage 1 MU objectives, and 77% had at least 1 surgical IT system in operational status by 2007. The mean staffed bed size of hospitals was 205 (SD = 173), with one-third of hospitals having fewer than 100 staffed beds. Descriptive statistics for the 8 hospital patient safety indicators (PSIs), measured as the risk-standardized expected rates per 1000 patient admissions, are reported in 

. The number of hospitals for which reliable PSI rate estimates were reported varied substantially (600 to 3000). For the majority of PSIs, the mean risk standardized rates varied between 2 and 10 per 1000 patient admissions. However, for iatrogenic pneumothorax, it was 0.4 per 1000 patient admissions (SD = 0.15) and for death from serious treatable complications after surgery the mean rate was 116 per 1000 patient admissions (SD = 19.6).

Effects of Surgical IT Systems and EHR Capability

The marginal effects of EHR and surgical IT systems on patient safety performance are reported as exponentiated coefficients representing adjusted incidence rate ratios in 

 (controlling for hospital characteristics and other confounding factors) for 3 separate regressions: EHR and surgical IT systems considered individually as Model 1 and 2 respectively, and both systems considered jointly in Model 3 (please see eAppendix for detailed results of regression). In addition, we also provide graphical representation, in the 

, of effect sizes with point estimates (ie, exponentiated coefficients) and their associated 95% CI on Model 3 regressions. For brevity, we discuss the results based on the joint model (Model 3).

As shown in Table 3, the marginal effects of surgical IT systems (including 1 or more of preoperative, perioperative or postoperative systems) were significant across all patient safety indicators except 1—abdominal aortic aneurysm repair mortality. We found that risk-standardized incidence rates at hospitals with surgical IT systems, compared with hospitals without such systems, were lower by 7% to 26% for 7 of 8 patient safety measures (deaths from serious treatable complications: incidence rate ratio [IRR] 0.81, robust standard error [RSE] 0.046; iatrogenic pneumothorax: IRR 0.78, RSE 0.039; postoperative respiratory failure: 0.74, RSE 0.054; postoperative pulmonary embolism: IRR 0.79, RSE 0.48; postoperative wound dehiscence: IRR 0.90, RSE 0.042; accidental puncture or laceration: IRR 0.86, RSE 0.043; and hip fracture mortality: IRR 0.93, RSE 0.036). These effect sizes were consistent even when considering the individual model, albeit the relative risk of adverse events were lower by 9% to 28% for hospitals with surgical IT systems compared with hospitals without such systems (see Model 2 in Table 3).

The risk-standardized incidence rates at hospitals with an EHR system capable of meeting Stage 1 MU objectives, compared with hospitals in the referent group having a lesser or no EHR system, are likely to be lower by 7% to 11% for 3 of the 8 patient safety indicators (postoperative respiratory failure: IRR 0.89, RSE 0.04; postoperative wound dehiscence: IRR 0.93, RSE 0.025; and hip fracture mortality: IRR 0.93, RSE 0.024). These effect sizes were consistent even when considering the individual model, although EHR systems were associated with 5 of 8 patient safety indicators and the relative risks were lower by 9% to 14% (see Model 1 in Table 3).

In this retrospective cross-sectional study of a large national sample of acute care hospitals, we investigated the relationship between the use of IT systems and hospital performance on patient safety measures related to inpatient medical or surgical care. We found that compared with those without such systems, hospitals with surgical IT systems had modestly lower incidence rates on all but 1 of the 8 patient safety measures examined. In addition, those with EHR systems capable of meeting Stage 1 MU objectives had lower incidence rates on 3 of 8 patient safety measures. Our findings suggest that surgical IT systems play a positive, albeit clinically modest, role in patient safety for patients who undergo in-hospital surgery.

This study, to the best of our knowledge, is the first to examine the associative relationship between hospital performance on AHRQ patient safety indicators and health IT systems using a large national sample. Our results are consistent with recent studies that find an association between EHR and patient safety indicators using regional or facility-specific data. For example, Menachemi and his colleagues39 found that Florida hospitals using a comprehensive set of clinical information technologies had better patient safety performance. Several other studies have demonstrated facility-specific benefits of surgical IT systems in improving process compliance and cost-effectiveness, and in reducing adverse events.

Furthermore, our study adds to prior research that used a national sample of hospitals, such as that of Parente and McCullough,

who found that EHR systems were associated with reduced infections attributable to medical care, but had no effect on postoperative hemorrhage and deep venous thrombosis. Likewise, Jha and colleagues found that use of computerized physician order entry (CPOE) systems were associated with lower mortality rates for acute myocardial infarction, but not for congestive heart failure or pneumonia.

In contrast, Jones and his colleagues found that higher usage of CPOE (more than half of all orders electronically) was associated with some reduced mortality rates.

Our study should be interpreted in the context of the following limitations. Most importantly, the relationships of EHR and surgical IT systems with hospital patient safety performance were examined using a cross-sectional design limiting our ability to make causal claims about the relationships. We used IT system usage in 2007, and studied the association with patient safety indicators from 2008 to 2010, and incorporated propensity scores for EHR adoption, as well as levels of historical process quality to attempt to reduce selection bias effects in which higher-quality hospitals are more likely to both use IT and have lower rates of adverse events. Future research using a longitudinal study design may help clarify whether adoption of specific features of EHR and surgical IT systems are associated with patient safety improvement over time. A second limitation is that EHR systems were defined in terms of a composite index of IT systems with functionality to meet the MU criteria, rather than the actual measures of MU defined under the Health Information Technology for Economic and Clinical Health Act (which requires demonstrating activities via technology use). Recent comparative analyses raised concern about the use of HIMSS and other data sources for consistency of either CPOE or a single-implementation enterprise EHR adoption.

 However, our study defines EHR system based on a composite of several clinical information systems, and thus more closely maps to needed functional require ments of Stage 1 MU. Finally, we did not study other potential benefits of EHR or surgical IT systems, but focused specifically on well-established patient safety measures. Other outcomes, such as healthcare-associated infection rates, may be more responsive to the use of EHR and surgical IT systems.

In summary, we found that hospital use of IT systems—specifically surgical IT systems and, to a lesser extent, EHR systems capable of meeting the 2011 MU objectives&mdash;was associated with modestly lower rates of select patient safety adverse events.

University of Texas Health Science Center at Houston, School of Public Health (AA), Houston, TX; Vanderbilt University, Owen Graduate School of Management (MEJ), Nashville, TN; Dartmouth College, Geisel School of Medicine (DLA), Hanover, NH.

This study was partially funded by the National Science Foundation (NSF-CNS-0910842). The NSF had no role in the collection of data, its analysis and interpretation, and/or in the right to approve or disapprove publication of the finished manuscript. The data on hospital health information technologies were licensed from HIMSS Analytics. HIMSS had no role in the study design, management, analysis, interpretation, or approval.

Drs Appari, Johnson, and Anthony report no relationship or financial interest with any entity that would pose a conflict of interest with the subject matter of this article.

Concept and design (AA, MEJ, DLA); acquisition of data (AA, MEJ, DLA); analysis and interpretation of data (AA, MEJ, DLA); drafting of the manuscript (AA, MEJ, DLA); critical revision of the manuscript for important intellectual content (AA, MEJ, DLA); statistical analysis (AA); provision of the study materials or patients (AA, MEJ); obtaining funding (MEJ, DLA); administrative, technical, or logistic support (AA, MEJ); and supervision (MEJ).

 Ajit Appari, PhD, University of Texas Health Science Center at Houston, School of Public Health, 1200 Pressler St, RAS W-310, Houston, TX 77030. E-mail: 

1. Institute of Medicine. Health IT and Patient Safety: Building Safer Systems for Better Care. Washington, DC: The National Academies Press; 2012.

2. Classen DC, Resar R, Griffin F, et al. ‘Global trigger tool’ shows that adverse events in hospitals may be ten times greater than previously measured. 

3. Landrigan CP, Parry GJ, Bones CB, Hackbarth AD, Goldmann DA, Sharek PJ. Temporal trends in rates of patient harm resulting from medical care. 

Use of health information technology in acute care settings is associated with modestly lower rates of adverse patient safety outcomes for inpatient and surgical care.

M. Eric Johnson, PhD

Articles

Understanding the Relationship Between Data Breaches and Hospital Advertising Expenditures

Information Technology and Hospital Patient Safety: A Cross-Sectional Study of US Acute Care Hospitals