Currently Viewing:
The American Journal of Managed Care January 2019
The Gamification of Healthcare: Emergence of the Digital Practitioner?
Eli G. Phillips Jr, PharmD, JD; Chadi Nabhan, MD, MBA; and Bruce A. Feinberg, DO
From the Editorial Board: Rajesh Balkrishnan, PhD
Rajesh Balkrishnan, PhD
The Health Information Technology Special Issue: New Real-World Evidence and Practical Lessons
Mary E. Reed, DrPH
Inpatient Electronic Health Record Maintenance From 2010 to 2015
Vincent X. Liu, MD, MS; Nimah Haq, MPH; Ignatius C. Chan, MD; and Brian Hoberman, MD, MBA
Impact of Primary and Specialty Care Integration via Asynchronous Communication
Eric D. Newman, MD; Paul F. Simonelli, MD, PhD; Shelly M. Vezendy, BS; Chelsea M. Cedeno, BS; and Daniel D. Maeng, PhD
Mind the Gap: The Potential of Alternative Health Information Exchange
Jordan Everson, PhD; and Dori A. Cross, PhD
Patient and Clinician Experiences With Telehealth for Patient Follow-up Care
Karen Donelan, ScD, EdM; Esteban A. Barreto, MA; Sarah Sossong, MPH; Carie Michael, SM; Juan J. Estrada, MSc, MBA; Adam B. Cohen, MD; Janet Wozniak, MD; and Lee H. Schwamm, MD
Currently Reading
Understanding the Relationship Between Data Breaches and Hospital Advertising Expenditures
Sung J. Choi, PhD; and M. Eric Johnson, PhD
Alternative Payment Models and Hospital Engagement in Health Information Exchange
Sunny C. Lin, MS; John M. Hollingsworth, MD, MS; and Julia Adler-Milstein, PhD
Drivers of Health Information Exchange Use During Postacute Care Transitions
Dori A. Cross, PhD; Jeffrey S. McCullough, PhD; and Julia Adler-Milstein, PhD

Understanding the Relationship Between Data Breaches and Hospital Advertising Expenditures

Sung J. Choi, PhD; and M. Eric Johnson, PhD
A hospital data breach was associated with a 64% increase in annual advertising expenditures.

Source of Data

After a breach occurs, depending on the type, it may take weeks or months until it is discovered and reported. We used HHS and PRC data on breaches, which included the name and location of the breached entity, time of breach reporting, type of breach, and number of records exposed (data from both entities are available for public download).2,3 It should be noted that the HHS database does not include breaches that affect fewer than 500 individuals; thus, it is not an exhaustive record of all health data breaches.

Voicetrak provided data on hospital advertising expenditures based on surveys of media vehicles. Voicetrak conducts a quarterly survey of 9300 local media vehicles in 210 media markets across the United States. Media vehicles include television, cable systems and interconnects, radio stations, newspapers and business journals, out-of-home companies, and local magazines in a city/metropolitan area. Voicetrak data are available to the public for purchase.16 Voicetrak data did not capture online advertising expenditures; thus, their estimates capture only part of the total advertising cost. Quarterly advertising expenditures were aggregated to yearly expenditures. The advertising data do not distinguish between individual hospital expenditures and system-level expenditures.

The Healthcare Cost Report Information System (HCRIS) provided data on hospital revenues, expenses, discharges, beds, ownership status, teaching status, rural status, and meaningful use status (meaningful use of electronic health records as defined in HITECH). Medicare-certified hospitals are required to submit an annual cost report to HCRIS (data are available for public download).17 HCRIS data were the primary data set into which other data sets were merged. The data sets were joined by hospital name and year. HHS and Voicetrak data provided the business name of the hospital but no standardized identifier; therefore, hospital names in these 2 data sets were manually matched to the hospital names in HCRIS.

Market competition has been linked to hospital advertising expenditures.4 To control for market competition, we added proxies for the county-level supply and demand for health services by merging the 2014 Area Health Resources Files.18,19 The number of short-term general hospitals in a county was used to measure the supply of hospital care in a county, which represents a metric of hospital competition. The number of Medicare enrollees in a county was used to measure the demand for health services.

To maintain consistency in the financial data, we restricted data to include only nonfederal acute care inpatient hospitals using the CMS definition of facility type.17 Hospitals in the US territories and Maryland (which has a prospective payment system waiver) were excluded for consistency. The data were further restricted to hospitals that filed with HCRIS between 360 and 370 reporting days. When a hospital submitted multiple financial reports in a given year, the most recent report was used. Finally, observations with missing values in the dependent or independent variables were dropped from analysis. The study sample consisted of 3496 hospital-year observations before propensity score matching.


The breached hospitals and control hospitals had different observable characteristics. The breached hospitals were more likely to be large, teaching, and urban hospitals. Propensity score matching was used to adjust for potential sample selection bias due to observable differences between the breached and control hospitals.20-23

The propensity score for assignment into the breached group was predicted using a logit model. In the logit model, we first included all the control variables to the right-hand side, then narrowed down the predictors by inspecting the balance of the matched sample with standardized mean differences (SMDs). An SMD of less than 0.1 for the covariates between the 2 groups indicates a negligible difference in the mean.24 We generated the balanced sample using the following controls: operating revenue, hospital discharges, number of beds, occupancy rate, length of stay, number of general hospitals in a county, Medicare enrollment, ownership, teaching status, and year.

Hospitals were matched using the nearest neighbor matching approach allowing for ties, with replacement, with a caliper distance of 0.2 SD.25 If 1 breached hospital matched multiple control hospitals (n), resulting in a tie, the multiple matched control hospitals were weighted by 1/n. Matching was performed using the Matching package 4.9-3 in R.25 Of the 75 observations in the full sample of breached hospitals, 3 observations failed to match. Thus, the matching yielded 72 observations in the breached group and 915 unweighted observations in the control group. The matched sample was used for empirical modeling.

Hospital advertising expenditure was heavily right-skewed. Ordinary least square (OLS) regression fails to consistently model a skewed dependent variable. A generalized linear model (GLM) addresses the weaknesses of OLS and is a popular method for modeling healthcare costs.26 The dependent variable was hospital advertising expenditures, which were measured in 2 ways. First was the annual hospital advertising expenditure adjusted to 2014 dollars. The advertising expenditures captured by Voicetrak were conditional on a hospital having nonzero expenditures. Alternatively, to capture the increase in advertising expenditures subsequent to a breach, we also measured the 2-year hospital advertising expenditures by summing the current year’s and next year’s expenditures. The dependent variable was specified as a gamma distribution. The link function was set to log.

A dummy variable was set to 1 for a breached hospital; it was set to 0 for a nonbreached (control) hospital. The coefficient on the breach dummy estimated the difference in advertising expenditures between breached and control hospitals. A vector of hospital characteristics adjusted for confounders, including total revenue, total margin, operating revenue, operating margin, number of beds, length of stay, occupancy rate, total discharges, ownership, teaching status, rural status, meaningful use status, and year fixed effects. Standard errors are heteroscedasticity robust and account for within-hospital correlation. GLM was performed using Stata version 14 (StataCorp; College Station, Texas).

Copyright AJMC 2006-2020 Clinical Care Targeted Communications Group, LLC. All Rights Reserved.
Welcome the the new and improved, the premier managed market network. Tell us about yourself so that we can serve you better.
Sign Up