 The objectives of this study were to describe the locations in hospitals where data are breached, the types of breaches that occur most often at hospitals, and hospital characteristics, including health information technology (IT) sophistication and biometric security capabilities, that may be predicting factors of large data breaches that affect 500 or more patients.

The Office of Civil Rights breach data from healthcare providers regarding breaches that affected 500 or more individuals from 2009 to 2016 were linked with hospital characteristics from the Health Information Management Systems Society and the American Hospital Association Health IT Supplement databases.

 Descriptive statistics were used to characterize hospitals with and without breaches, data breach type, and location/mode of data breaches in hospitals. Multivariate logistic regression analysis explored hospital characteristics that were predicting factors of a data breach affecting at least 500 patients, including area characteristics, region, health system membership, size, type, biometric security use, health IT sophistication, and ownership.

Of all types of healthcare providers, hospitals accounted for approximately one-third of all data breaches and hospital breaches affected the largest number of individuals. Paper and films were the most frequent location of breached data, occurring in 65 hospitals during the study period, whereas network servers were the least common location but their breaches affected the most patients overall. Adjusted multivariate results showed significant associations among data breach occurrences and some hospital characteristics, including type and size, but not others, including health IT sophistication or biometric use for security.

Hospitals should conduct routine audits to allow them to see their vulnerabilities before a breach occurs. Additionally, information security systems should be implemented concurrently with health information technologies. Improving access control and prioritizing patient privacy will be important steps in minimizing future breaches.

Even with sophisticated health information technology (IT) systems in place, security breaches continue to affect hundreds of hospitals and compromise thousands of patients’ data; this gives cause to believe that other hospital factors, such as area characteristics, region, bed size, health system membership, hospital type, hospital governance, and market concentration, may play a vital role in breach risk.

This study's results showed that of all types of healthcare providers, hospitals accounted for approximately one-third of all data breaches and hospital breaches affected the largest number of individuals.

Paper and films were the most frequent mode or location of data breaches. However, although network servers were among the most infrequent locations of data breaches, breaches of this type impacted the most patients overall.

Adjusted multivariate results showed significant associations among data breach occurrences and some hospital characteristics, including type and size, but not others, including health IT sophistication or biometric use for security.

Instances in which private information has been breached are becoming more commonplace in the United States,

 making the security of this type of information a significant concern.

 Healthcare information is particularly vulnerable, due to the sensitivity of these data and how they can be used by criminals.

 Demographic data, Social Security numbers, and clinical information, including medical diagnoses, are housed in both paper and electronic health records (EHRs).

 For these reasons, multiple attempts have been made through federal legislation to help curtail the occurrences of healthcare privacy breaches, including the 1996 Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act of 2009, and the Omnibus Final Rule in 2013.

 Despite these initiatives, however, large data breaches are still occurring in US hospitals.

The adoption of EHRs among hospitals has increased rapidly over the past several years.

 As healthcare systems digitized to keep up, the healthcare sector was unable to adopt electronic security components at the same pace, leading to vulnerabilities in record systems.

 In some cases, technology purposed to assist healthcare delivery processes are now having costly difficulties.

 The majority of small- and medium-size health organizations do not possess the financial or personnel resources necessary for sufficient information technology (IT) and security investments.

 This, along with their highly valuable data, has left hospitals vulnerable to breaches of sensitive information.

Hospitals have begun to implement strategies to help prevent data breaches that most often occur through theft, loss, unauthorized access, or hacking.

 Strategies include the adoption of systems that include 2-factor authentication requirements to ensure that patients’ health information is only accessible to and usable by those with rights to access it.

 Two-factor authentication often incorporates a biometric component to verify the user’s identity, such as a fingerprint, voice recognition, or iris scan, along with a password, personal identification number, or physical verification object, such as a token or key.

The objectives of this study were to describe the locations in hospitals where data are breached, the types of breaches that occur most often at hospitals, and hospital characteristics, including health IT sophistication and biometric security capabilities, that may be predicting factors of large data breaches that affect 500 or more patients. In spite of these health IT strategies, it is unclear what the most common types of breaches are and where patients’ health information is most vulnerable. Under federal legislation, if a healthcare privacy breach affects 500 or more patients it must be reported to the Office of Civil Rights (OCR). Then, information regarding the breach is publicly posted on the OCR data breach portal.

 Although several studies have examined OCR data breach information,

 none have specifically focused on pediatric, academic, and nonfederal acute care hospitals, which house millions of patient records.

The OCR data breach portal provides an online database describing data breaches of protected health information (PHI) that affect 500 or more individuals.

 This portal provides users the option of examining breach information from 3 types of covered entities: health plans, healthcare clearing houses, and healthcare providers. As of July 2016, the OCR portal included 1085 healthcare providers that had PHI breaches affecting 500 or more individuals between October 2009 and July 2016. Of these, 185 were nonfederal acute care hospitals and 27 were Veterans Affairs (VA) hospitals. Nonfederal acute care hospital breach information was linked with the 2015 Health Information and Management Systems Society (HIMSS) analytic data file (HIMSS Analytics, unpublished data) and information from the 2015 American Hospital Association (AHA) Health IT Supplement Survey regarding the use of 2-factor authentication.

Hospital data breaches of PHI that affected 500 or more individuals were characterized by: 1) type of breach and 2) location or mode of breached information. Data breach types included 6 categories: 1) hacking/IT incident, 2) improper disposal, 3) loss, 4) other/unknown, 5) theft, and 6) unauthorized access/disclosure. Data breach locations or modes included 7 categories: 1) desktop computer, 2) EHR, 3) email, 4) laptop computer, 5) network server, 6) paper/films, and 7) other location. To gain a more detailed view of which provider types were most frequently breached and had the most individuals affected, the OCR data were further categorized by “name of covered entity” into 9 health provider categories: 1) colleges/universities; 2) emergency response; 3) government; 4) group/physician practices; 5) health systems; 6) hospitals; 7) nursing homes, home/hospice care, and treatment facilities; 8) pharmacies; and 9) research facilities, laboratories, and medical supply companies.

Only nonfederal acute care hospitals, which include children’s, teaching, and public or private hospitals, were included in this study. All other health provider categories were excluded.

Variables to characterize hospitals included area characteristics, region, bed size, health system membership, hospital type, health IT sophistication, hospital governance, and market concentration at the hospital referral region (HRR) level. A binomial variable for area characteristics was created that assessed whether the hospital was located in a rural or urban area; hospitals were considered to be urban if they were located in a metropolitan core—based statistical area. Regions (Northeast, Midwest, South, and West) were categorized based upon the US Census Bureau classification system. Hospitals were categorized into small (<100 staffed beds), medium (100 to 399 staffed beds), and large (≥400 staffed beds). Hospital types included academic, general medical and surgical, pediatric, critical access, and other specialty. A second binomial variable was created to measure health IT sophistication, and high levels were defined as having a HIMSS Electronic Medical Record Adoption Model (EMRAM) score of 6 or 7. The EMRAM score ranges from Stage 0, which is paper-chart–based, to Stage 7, which is defined by a complete EHR system.

 A third binomial variable characterizing biometric security use was created by combining the hospitals that used biometric technology for security on the HIMSS analytics survey and/or the hospitals that answered that they supported an infrastructure for 2-factor authentication, including biometrics, in the AHA Health IT Supplement Survey. Hospital governance characteristics included hospital status, such as not-for-profit, investor-owned (for-profit), and government (nonfederal). In addition, a hospital was considered to be a member of a hospital system if it belonged to an integrated healthcare delivery system. Market concentration was measured by the Herfindahl-Hirschman Index,

 constructed on bed shares within systems at the HRR level.

Descriptive analyses to characterize provider facility, data breach type, and location/mode in hospitals were performed. Number of patients affected by data breaches was log transformed and a factorial 2-way analysis of variance (ANOVA) was conducted to examine the differences between data location/mode and type of breach and the number of patients affected by data breaches. Univariate analyses were conducted on hospital and area characteristics. To explore factors associated with hospitals having a data breach affecting 500 or more individuals, multivariate logistic regression analyses were performed using SAS Enterprise Guide (SAS Institute Inc; Cary, North Carolina). Significance was determined at the 

In total, 215 breaches, each affecting 500 or more individuals, occurred at 185 nonfederal acute care hospitals that reported to the OCR during the study period. Thirty hospitals had multiple breaches during that time. Twenty-four hospitals had 2 breaches, 5 hospitals had 3 breaches, and 1 hospital had 4 breaches (

Significant differences were found between hospitals that had at least 1 breach and hospitals that did not have a breach affecting 500 or more individuals during the study period (

). Bivariate descriptive statistics comparing hospitals with and without data breaches showed unadjusted differences in terms of hospital type, size, and ownership. Specifically, teaching hospitals (18% with a data breach vs 3% without a breach) and pediatric hospitals (6% with a breach vs 2% without) had higher percentages of data breaches. Larger hospitals also had a higher percentage of data breaches (26% with a data breach vs 10% without). In addition, a lower percentage of investor-owned (for-profit) hospitals (15% with a data breach vs 22% without) and other specialty hospitals (6% with a data breach vs 12% without) had at least 1 data breach. In bivariate descriptive analyses, health IT sophistication, biometric security use, health system membership, hospital region, and area characteristics were not significantly different in terms of data breach percentages.

The location of breached data and the number of individuals affected varied greatly among hospitals (

). Data breaches of paper/films occurred most frequently (65 hospitals). Data located in “other locations” (eg, breaches not from paper/films, laptop computers, email, desktop computers, EHRs, or network servers, which were reported in 56 hospitals) and in laptops (in 51 hospitals) were the second and third most prevalent, respectively. The numbers of unsecured PHI breaches from email (in 34 hospitals) and desktop computers (in 33 hospitals) were approximately equal during the study period. EHR data were breached in 19 hospitals. Although network server breaches occurred most infrequently (in 10 hospitals), these breaches compromised the highest number of individuals (4,613,858 affected).

Types of data breaches and the number of individuals affected by those types of breaches varied significantly among hospitals (

). Thefts occurred most frequently (in 112 hospitals), followed by unauthorized access/disclosure (in 54 hospitals), whereas hacking/IT incidents from 27 hospitals affected the most individuals (4,685,426).

Two-way ANOVA indicated no statistically significant differences in the number of patients affected between data location/mode (

= .443). There were, however, statistically significant differences between frequency of data breaches occurring from network servers and EHRs (

= .018) and between network servers and paper films (

Adjusted results showed similar associations among biometric use for security and hospital characteristics, including type and size. Pediatric hospitals (odds ratio [OR], 5.1; 95% CI, 2.5-10.2) and teaching hospitals (OR, 5.0; 95% CI, 2.9-8.4) were associated with an increased risk of data breaches compared with other types of hospitals. In addition, small (OR, 0.3; 95% CI, 0.2-0.6) and medium (OR, 0.6; 95% CI, 0.3-0.9) hospitals by bed size were associated with a decreased risk for data breaches compared with larger hospitals. Hospital setting, health system membership, health IT sophistication, federal status, market concentration, and ownership status were not predicting factors of a data breach affecting 500 or more patients (

Approximately one-third of all healthcare data breaches occurred in hospitals, and the most individual patients were impacted when hospitals were breached compared with other types of healthcare providers, such as doctors, nurses, and social workers. Therefore, despite the the high level of hospital adoption of EHRs and the federal incentives to do so,

 the most common type of data breach in hospitals occurred with paper records and films. These paper and film breaches occurred mostly due to theft, improper disposal, and unauthorized access. However, the overall number of patients affected by these breaches was relatively small. Conversely, network servers were found to be the least frequent location of data breaches, but these breaches impacted the most patients overall. In addition, this study found that there were large numbers of thefts of laptops, which can easily be physically removed and stolen regardless of EHR or biometric security system implementation. Adjusted results showed significant associations among data breach occurrences and hospital characteristics, including type and size. Pediatric hospitals and teaching hospitals were found to be at increased risk for breaches. The presence of capability and infrastructure support for biometrics and high health IT sophistication were not significantly associated with data breach risk.

Medical identity theft has long-lasting repercussions that can affect an individual’s health and financial well-being; it cannot be remedied by closing an account, as one would do with a financial breach of a credit card number, for instance. Hospitals are vulnerable to data breaches, but investment in data security is lacking.

 Although hospital investments in technology have been implemented to meet Meaningful Use and other federal requirements, protecting digitized patient data has not been a central focus. The findings of this study point to a need to integrate security measures in areas where patient information is kept to reduce the theft risk for both paper files and computers with PHI.

As shown by the findings of this study and others, computers have served as a source of data breaches because generic usernames and passwords make them easily accessible.

 Hospital unit computers are easy targets because they contain patient and staff information, such as referral letters, nursing reports, patient charts, audits, handovers, and staff sick leave lists, directly on the desktop. Biometric technology is a valuable means of reducing username and password reliance by utilizing fingerprint, gesture, eye, facial, and voice recognition modalities. This is further strengthened via 2-factor authentication protocols, which often combine a username and password with a physical biometric scan to grant access.

Given that the most common location of breaches in a hospital is currently paper files/films, the addition of biometric technology is not likely to impact this number. However, as the diffusion of EHR technology continues in the United States and cyber threats become more prevalent, these hard-copy breaches will presumably continue to be minimized as long as necessary security policies are upheld and security audits are practiced.

Previous studies have reviewed the characteristics of privacy breaches, but little research has been done since the revision of HIPAA in 2013.

 This policy revision represented a significant change in the definition of what constitutes a breach and how covered entities and their business associates operationalize the regulations.

As hospitals are now faced with additional evolving threats to PHI, the impact of these breaches is a significant concern.

 An emerging threat includes crypto-ransomware attacks on hospitals. Instead of stealing and selling patient data, hackers are now locking down entire systems and threatening to damage or disable computers unless hospitals pay a ransom. Users have the option to attempt to restore their system data from backups, lose the data, or pay the requested ransom.

 Healthcare policy under HIPAA has tried to adapt quickly to these new threats; however, OCR addressed the issue of ransomware attacks only relatively recently, through guidance delivered in July 2016.

As annual hospital budgets are planned, including a line item for information security will be important for many reasons, including reputation.

 A recent review found that, on average, healthcare organizations are spending 95% of their IT budgets on attempts to comply with federal initiatives, such as health IT implementation and adoption, and only 5% on security.

 Hospitals would be judicious to include a compliance plan with consistent audits to verify who is accessing patient information. In addition, it is critical that hospital administrators support overall plans and penalties for those staff members who deliberately and maliciously access patient data outside of their job requirements. Access control to protected patient data in larger facilities is difficult to manage and adds to the vulnerability of patient information.

 To protect patient information and to keep in line with the Minimum Necessary Rule under HIPAA, which states that PHI should not be used or disclosed unless necessary,

 it is important to maintain and enforce a policy of access to the minimum necessary information for job performance. Finally, the Health Care Industry Cybersecurity Task Force, established in the Cybersecurity Act of 2015, has put forth guidance for hospitals to improve cybersecurity.

 They recommend that insurance companies provide incentives specifically for small- and medium-size healthcare providers to transfer patient records to more secure environments. In addition, hospitals may consider cyber-insurance policies, which require security audits as a condition of coverage, to help protect their facilities from breaches and ransomware attacks.

Although many aspects surrounding healthcare privacy and data breaches were included in this study, not all could be accounted for. One limitation was that the OCR only had data available on breaches that affect 500 or more patients per case. Information on breaches and the at-fault facilities for all breaches affecting 499 patients or less was not accessible. In addition, the policy language around what is considered reportable in privacy breaches is vague, so these occurrences may have been under- or over-reported depending on the individual facility. The OCR data did not give specific dates and months of data breaches, only the year, and the 2016 data were not all available when we conducted the analysis. In addition, the survey questions used to measure biometric security systems only measured capability and infrastructure support and did not reflect use. Furthermore, all data used for this analysis were self-reported. Not all hospitals in the OCR database could be matched to the HIMSS and AHA analytics data files due to the possibility of facility closure, unverified city of breach, or inadequate information. In total, 15 hospitals were unable to be matched. VA hospitals were also unable to be matched because HIMSS does not monitor VA information. This study focused on hospitals due to the number of individuals affected by breaches in these types of facilities. However, other types of facilities, including physician practices, health plans, and clearinghouses, do have breaches and should be an area of focus for future research. Finally, it is important to note that most states have passed additional legislation that is more or less strict than the current federal iteration, which may or may not impact breach reporting.

Although there are more group/physician practices within the United States than hospitals, the overall number of individual patients treated, and who thus have data created and stored within the record system, is greater within hospitals. Routine audits required by cyber-insurance coverage may help healthcare facilities recognize, and repair, their vulnerabilities before a breach occurs. Accordingly, information security systems should be concurrently implemented alongside health information technologies. Improving access control and prioritizing patient privacy

will be important steps in minimizing future breaches.

College of Health and Public Affairs, University of Central Florida (MHG, AW, AN, KCW), Orlando, FL; United States Air Force (AR), Joint Base Charleston, SC.

 The authors report no relationship or financial interest with any entity that would pose a conflict of interest with the subject matter of this article.

 Concept and design (MHG, AN, AR, AW, KCW); acquisition of data (AR, MHG); analysis and interpretation of data (MHG, AN, AR, KCW); drafting of the manuscript (MHG, AR, AW); critical revision of the manuscript for important intellectual content (MHG, AN, AR, AW, KCW); statistical analysis (MHG, AR); administrative, technical, or logistic support (KCW); and supervision (AR, MHG).

 Meghan Hufstader Gabriel, PhD, University of Central Florida, 4364 Scorpius St, HPAII, Rm 213, Orlando, FL 32816. Email: meghan.gabriel@ucf.edu.

Articles

POLICY

Despite the high level of hospital adoption of electronic health records and the federal incentives to do so, the most common type of data breach in hospitals occurred with paper records and films.

Data Breach Locations, Types, and Associated Characteristics Among US Hospitals

Collaborative care is an effective approach for treating posttraumatic stress disorder (PTSD) and depression within the US Military Health System (MHS), but its cost-effectiveness remains unstudied. Our objective was to evaluate the costs and cost-effectiveness of centrally assisted collaborative telecare (CACT) versus optimized usual care (OUC) for PTSD and depression in the MHS.

A randomized trial compared CACT with OUC. Routine primary care screening identified active-duty service members with PTSD or depression. Eligible participants (N = 666) were randomized to CACT or OUC and assessed at 3, 6, and 12 months. OUC patients could receive care management and increased behavioral health support. CACT patients could receive these services plus stepped psychosocial treatment and routine centralized team monitoring.

Quality-adjusted life-years (QALYs) were derived from the 12-Item Short Form Health Survey. Claims and case management data were used to estimate costs. Cost-effectiveness analyses were conducted from a societal perspective.

Data from 629 patients (320 CACT and 309 OUC) with sufficient follow-up were analyzed. CACT patients gained 0.02 QALYs (95% CI, —0.001 to 0.03) relative to OUC patients. Twelve-month costs, including productivity, were $987 (95% CI, –$3056 to $5030) higher for CACT versus OUC. CACT was estimated to cost $49,346 per QALY gained compared with OUC over 12 months. There is a 58% probability that CACT is cost-effective at a $100,000/QALY threshold.

Despite its higher costs, CACT appears to be a cost-effective strategy relative to OUC for managing PTSD and depression in the MHS.

Centrally assisted collaborative telecare is a cost-effective strategy relative to usual care for treating posttraumatic stress disorder and depression in the Military Health System (MHS).

These findings are consistent with those of previous studies that have investigated the use of similar models of care in a range of healthcare settings and populations, but this is the first study to demonstrate value in a military healthcare setting.

Results indicate that investments in behavioral health integration and infrastructure in primary care may provide good value for healthcare systems similar to the MHS, which is a large integrated healthcare system serving approximately 9.5 million eligible beneficiaries.

Posttraumatic stress disorder (PTSD), anxiety, and depression are common conditions in the US military. Prevalence estimates of postdeployment PTSD and depression range from 13% to 18%, and 28% of service members report severe symptoms of PTSD, anxiety, or depression.

 These problems cause suffering and impairment and contribute to military attrition, absenteeism, misconduct, and sick-call visits.

 Despite this, less than half of the serving military personnel affected receive military mental health services, which are often not timely or adequate.

 The military has attempted to better integrate mental health services into primary care, and the first Army integration approach began in 2007.

 Access to and quality of mental health services for military personnel has remained a recurring public policy concern, however.

 To address this, the Institute of Medicine has called for health system—level interventions to increase access to and continuity of mental health services in military and veteran populations.

Collaborative care is an empirically supported method of extending and improving the reach, quality, and outcomes of care for common health conditions.

 In more than 80 randomized trials, collaborative care models have demonstrated improved outcomes among patients with depression and anxiety,

 depression and other chronic health conditions (eg, diabetes, asthma),

 As of January 1, 2017, the Medicare fee schedule now reimburses for the delivery of collaborative care.

Recently, the first randomized controlled trial (RCT) of centrally assisted collaborative telecare (CACT) for PTSD and depression within the Military Health System (MHS) was completed.

 The STepped Enhancement of PTSD Services Using Primary Care (STEPS-UP) trial compared CACT with the Army’s preexisting program integrating behavioral health in primary care. CACT was effective in reducing the severity of PTSD and depressive symptoms in active military personnel using primary care, adding to the evidence supporting the use of collaborative care treatment models for mental illness in a range of settings and populations.

 However, no prior research has shown whether a collaborative care approach to treating PTSD and depression is cost-effective in the MHS, an important question given that the military spends more than $50 billion annually on healthcare for its nearly 10 million beneficiaries.

 The objective of this study was to evaluate the cost-effectiveness of treating patients with PTSD and depression using CACT compared with optimized usual care (OUC) in the MHS.

The RCT study design has been published elsewhere in detail.

 Briefly, between February 2012 and September 2013, routine clinical screening in 18 Army primary care clinics at 6 military installations identified active-duty service members with 1) PTSD, depression, or both, and 2) access to Internet and email. Patients were excluded if they had current alcohol dependence, active suicidal ideation in the prior 2 months, planned geographic relocation within 6 months, or current duties in the participating clinic.

Eligible participants (N = 666) were randomized to OUC (n = 334) or CACT (n = 332) to treat their symptoms for up to 12 months after enrollment. OUC patients received the standard integrated mental health approach for Army primary care clinics, which included increased access to mental health specialists and follow-up monitoring from a nurse care manager who tracked patients’ progress and provided status updates to primary care clinicians.

 CACT patients received the standard OUC services plus 1) stepped psychosocial treatment and 2) routine monitoring by a central mental health team with a centralized patient symptom registry. Nurse care managers who worked with CACT patients also received additional training in behavioral activation, problem solving, and motivational interviewing to provide additional support to patients.

 The study was approved by all affiliated institutional research review boards.

We used data from patient surveys administered at baseline and 3-, 6-, and 12-month follow-ups to assess the primary outcomes of depression and PTSD, as well as health-related quality of life (QOL) and other secondary health outcomes. We assessed the severity of PTSD and depression symptoms using the PTSD Diagnostic Scale

 (PDS) and the Hopkins Symptom Checklist depression items (HSCL-20).

 We assessed QOL using the 12-Item Short Form Health Survey (SF-12).

 We derived quality-adjusted life-years (QALYs) from the Short-Form Six-Dimension utility index (SF-6D).

 Depression-free days (DFDs) were derived from the scored HSCL-20,

 and PTSD-free days (PFDs) were derived from the PDS.

Both arms of the study followed protocols that instructed the use of weekly caseload review calls between nurse coordinators and staff psychiatrists to review participating patients’ progress, as well as regular case management calls between the nurse coordinator and the patient and other phone, email, or text message contacts as needed. An electronic case management system was used to track all contacts and caseload review calls. Nurse coordinators in each intervention arm also underwent training and education sessions.

To estimate the cost of each of these intervention components, we multiplied the estimated hourly wage of each participating staff member (nurse coordinator and/or staff psychiatrist) by the number and average duration of each contact or training session, estimated from case management system data and interviews with nurse coordinators at each site. The CACT arm also included a centralized management team that coordinated intervention activities throughout the 12-month study period, composed of a half-time administrative assistant, a full-time psychologist, and a half-time nurse coordinator. We estimated the cost of these services using the salary of each staff member. All wage estimates were based on the General Schedule pay scale.

We used claims data to assess the other (nonintervention) healthcare resources utilized within and outside of the MHS through the 12-month study period. These data contain information on medications, inpatient stays, emergency department visits, outpatient tests and procedures, outpatient visits, and telephone contacts. Utilization was recorded within the MHS and outside the MHS when reimbursed by TRICARE. For services provided within the MHS, costs were estimated from the given estimated full service cost, which includes resources used and estimated overhead; for services and medications provided outside of the MHS, costs were estimated from the total amount reimbursed by TRICARE. We excluded any services, such as certain telephone contacts, that were recorded in claims data but already accounted for in our analysis as an intervention component. Healthcare costs borne by the patient, including co-pays for services, were not included.

We used survey data from 3-, 6-, and 12-month follow-ups to estimate productivity costs over the course of the 12-month study. At each survey time point, we asked participants if they had missed an entire workday or part of a workday “due to a mental or physical health problem” in the previous 28 days. We extrapolated the stated number of lost workdays to cover the full period since the previous survey and estimated productivity costs by multiplying the estimated number of lost workdays by a daily personnel cost. We estimated personnel costs from the salaries reported at the study baseline plus fringe benefits.

We included patients who received the intervention and had at least 1 follow-up interval of both survey data and cost data in the primary economic evaluation analytic population. We excluded patients who did not receive any intervention or received the intervention but did not have both cost and survey data. For patients included in the analysis, we imputed missing 12-month cumulative QALY, utilization, and cost data using the fully conditional specification approach.

 Imputation models included available measures of cost and utilization; demographic and social characteristics, including age, race, gender, salary, marital status, and education; and clinical characteristics, including SF-12 scores and depression and/or PTSD status. Imputations were performed within each treatment arm. Five imputations were created, and results from each imputation were pooled using the rules outlined by Rubin.

 Specifically, we defined point estimates as the average of those from the 5 imputed datasets. The variance of the estimate was derived from both the within-imputation and between-imputation variances, where the former is the average of the variances of point estimates from the 5 imputed datasets.

Categorical data are reported as frequencies and were compared using χ

 or Fisher’s exact test statistics. Continuous demographic variables are reported as means and SDs and were compared with 

 test statistics. Continuous cost and utilization data are reported as means; the statistical significance of the difference in means between the 2 groups was evaluated using a 95% CI. Cost categories also report median values. All analyses were performed in SAS 9.4 (SAS Institute, Inc; Cary, North Carolina).

We examined the cost-effectiveness of CACT versus OUC over the 12-month study period. In our base case analysis, we included all intervention costs, other healthcare costs paid for by the MHS or TRICARE within and outside of the MHS, and productivity costs. The primary outcome assessed was the incremental cost-effectiveness ratio (ICER) in dollars per QALY gained, which was the difference in mean total costs between the 2 treatment arms over the 12-month study period divided by the difference in mean QALYs. We converted all costs to 2014 US dollars for analysis.

We ran 6 sensitivity analyses to examine the impact of assumptions used in our base case analysis. We generated cost-effectiveness acceptability curves to show the probability that either CACT or OUC would be considered the preferred intervention at a range of cost-effectiveness thresholds (

Among the 666 patients enrolled in the study, 629 patients were assigned to an intervention arm (320 CACT and 309 OUC) and had at least 1 follow-up interval each of cost data and health outcome data. A total of 553 patients answered the survey at all 4 time points. Full 12-month cost and health outcome data were available for 459 patients, and multiple imputation was used to generate full QALY and cost data for the remaining 170 patients (27% of full analytic sample). Patients were well matched between study arms, with no statistically significant differences among them. The majority of patients in each arm were male (~80%) and married (63%), and mean ages were 31 and 32 years in the CACT and OUC arms, respectively (

As reported in Engel et al, the primary PTSD and depression outcomes examined as part of the overall RCT showed small to moderate, but statistically significant, improvements over 12 months in the CACT group compared with the OUC group.

 These improvements were measured by the PDS (—2.53 lower scores for CACT vs OUC; 95% CI,–4.47 to –0.59) and HSCL-20 scores (–0.26; 95% CI, –0.41 to –0.11).

 Significant improvements were also observed in the CACT group versus OUC for the 12-month secondary RCT outcomes of physical symptom severity and mental health—related QOL, but not for other secondary health outcomes of suicidality, pain intensity and interference, alcohol misuse, and physical QOL.

We found that over the 12-month follow-up, QALYs, as derived from the SF-6D, were 0.60 for CACT versus 0.59 for OUC, with a nonsignificant 0.02 QALY (95% CI, —0.001 to 0.03) gain for CACT relative to OUC. DFDs and PFDs also did not differ significantly between groups (

Compared with patients randomized to OUC, patients in the CACT arm of the study received significantly more intervention resources, including care management contacts (7.25 vs 3.74) and other “as needed” contacts (3.97 vs 1.06) during the study period (

<.05 for difference in both) (Table 2). Patients in CACT were also reviewed more frequently in caseload review calls (9.9 times over the 12-month study period vs 1.5 times for OUC patients; 

<.05), and CACT nurse coordinators received more training and education (Table 2). These resources, plus 12 months of central assistance, resulted in $1754 higher intervention costs for patients in the CACT arm compared with the OUC arm over the 12-month study period ($2743 vs $989; 

The utilization of other healthcare resources did not differ significantly between study arms, with the exception of nonintervention-related telephone contacts, which were significantly more common in the CACT intervention arm (6.0 vs 4.3 in the OUC arm) (Table 2). However, patients in the CACT arm had 3.0 fewer lost workdays (95% CI, —13.1 to 7.0) compared with patients in OUC, equating to a $1255 (95% CI, –$3961 to $1451) productivity gain for CACT versus OUC. Adding up intervention costs, other healthcare costs, and productivity costs across both CACT and OUC, total 12-month costs were $987 (95% CI, –$3056 to $5030) higher in CACT compared with OUC over the study period ($23,125 vs $22,138) (

In the primary cost-effectiveness analysis, CACT was estimated to cost $49,346 per QALY gained compared with OUC (

). At a US willingness to pay (WTP) cost-effectiveness threshold of $100,000/QALY, there is a 58% probability that CACT is the preferred intervention (Figure). This likelihood increases at higher WTP thresholds (74% at $200,000/QALY) and decreases at lower WTP thresholds (46% at $50,000/QALY).

Excluding productivity costs increased the cost of CACT relative to OUC, resulting in a ratio of $112,081/QALY (Table 4). Similarly, halving the number of patients followed by centralized management increased the ratio to $110,089/QALY. Other sensitivity analyses resulted in more favorable ICERs for CACT relative to OUC (Table 4).

The MHS is a sizable federal health system with a budget nearly as large as that of the Veterans Health Administration. The MHS invests heavily in behavioral health integration and infrastructure in primary care,

 ensuring that this study is timely. We have estimated that CACT costs $49,346/QALY gained and has a 58% probability of being cost-effective at a $100,000/QALY WTP threshold compared with OUC. These results were based on 12-month improvements in the PTSD and depression outcomes observed as part of the overall RCT for CACT versus OUC and a 0.02 (95% CI, —0.001 to 0.03) gain in QALYs. CACT had significantly higher intervention costs ($1754) over the 12-month  period of intervention and follow-up. Total 12-month costs were $987 (95% CI, –$3056  to $5030) higher in the CACT versus the OUC arm of the study when intervention costs, other healthcare costs, and productivity costs were considered. Cost-effectiveness estimates appear robust to assumptions regarding the imputation of missing data, high-cost outliers, and OUC intervention costs.

These results are sensitive to the size of the patient caseload handled by the central assistance team used to support CACT. In contrast to patient-level treatments (eg, the cost-effectiveness analysis [CEA] of a medication or psychotherapy), CACT is a systems-level intervention requiring a multidisciplinary team with centralized administrative and clinical support. Significant research suggests that depression and anxiety outcomes improve when a primary care—based collaborative care systems approach is utilized to maximize adherence to existing clinical practice guidelines by using a care manager, valid and feasible measures of clinical status, and improved access to mental health specialist consultation.

 The STEPS-UP trial results have now shown that when a central assistance capability is used to improve clinics’ capacity to implement, monitor, and sustain collaborative care,

 patient outcomes improve. However, to utilize collaborative care resources most efficiently, a critical mass of patients is required to make the intervention economically feasible. Using a hypothetical scenario, we show that if the patient population in our study were reduced by half, the per patient cost of CACT relative to OUC would increase substantially due to the additional per-patient costs of centralized care, and the ICER of CACT versus OUC would increase from $49,346 to $110,089/QALY. Thus, a system planning to implement CACT would need to carefully project the size of the patient population and plan central resources accordingly.

In addition, the results were sensitive to our decision to include the monetary value of lost workdays due to health problems as a cost input, as recommended by the Second Panel on Cost-Effectiveness in Health and Medicine.

 We found that the higher costs in the CACT arm due to the higher costs of the intervention were diminished somewhat once the smaller number of days of missed work was taken into account. Excluding these productivity costs increased the ICER to $112,081/QALY, showing the importance of including all relevant costs in a CEA from a societal perspective.

The evidence for collaborative care is robust. Collaborative care has been demonstrated to be effective in more than 80 RCTs in various settings, which now include the MHS.

 Health economics studies have also consistently reported the model to be either cost saving or cost-effective. Although no previous studies have investigated collaborative care for mental illness in the MHS, several have investigated the use of similar models of care in a variety of civilian and Veterans Affairs healthcare settings and populations. These studies produced a range of estimates, which are generally consistent with our results. A systematic review

 of 11 cost-effectiveness studies accompanying RCTs of enhanced primary care for depression found that interventions based upon collaborative care/case management resulted in improved outcomes at a greater cost, but they were generally considered to be cost-effective (range, $15,463 to $36,467/QALY). Another study

 that reviewed existing cost-effectiveness studies of primary care depression treatments also found that collaborative care interventions are generally considered to be cost-effective (range, cost-saving to $105,819/QALY gained). Varying results are due to different forms of collaborative care interventions, different comparators, and different study populations.

The claims data we used included all services provided within the MHS and those reimbursed by TRICARE outside of the MHS. We were not able to track other services paid for by non-TRICARE third-party payers or by the patient. Previous study findings indicate that more than one-fifth of depression treatment expenses are paid for out-of-pocket in the civilian population,

 but no estimates are available regarding the expected extent of these expenditures in the military population. In addition, some study participants left the military and became ineligible for services before the end of the 12-month study.

 However, loss of MHS services did not differ significantly between the 2 treatment arms,

 and we used multiple imputation to include all patients who had minimal cost and health outcome follow-up data.

We were limited to a 12-month follow-up period and were not able to track cost or health outcomes beyond this time. Previous study results have suggested that higher up-front intervention costs associated with collaborative care may produce longer-term savings

 and that health effects may continue to be realized beyond the 12-month mark,

 indicating that our relatively short follow-up time period may have produced conservative cost-effectiveness estimates. Our RCT results found that the relative effectiveness of CACT improved over the 12-month period of follow-up.

MANAGERIAL

Centrally assisted collaborative telecare is a cost-effective strategy relative to usual care for treating posttraumatic stress disorder and depression in the Military Health System.

Cost-Effectiveness of Collaborative Care for Depression and PTSD in Military Personnel

The rising prices of specialty drugs have prompted a debate about how medications are priced. With the average price of cancer drugs doubling in the last decade, the unsustainability of drug prices is especially concerning in oncology and hematology. The objective of this study was to compare the prices of monoclonal antibodies (mAbs) approved in the last 20 years by the FDA across disease states.

We identified all indications approved by the FDA for mAbs from 1997 to 2016 and calculated the annual price of 1-year treatment for each mAb—indication combination as the product of the US average wholesale price per milligram and the recommended dose.

We compared the annual price of treatment with each mAb across disease states using generalized linear models with gamma distribution and log link, controlling for route of administration, chemical structure, source, and time since FDA approval.

The average annual price of a mAb was $96,731, exceeding $100,000 for 34 mAb—indication combinations. Oncology and hematology mAbs represented 40% of the mAb–indication combinations approved, yet they accounted for more than 85% of those priced $100,000 or higher. After adjusting for factors that can affect production costs, the annual price of oncology or hematology mAbs was $149,622 higher than those used in cardiovascular or metabolic disorders; $98,981 higher than in immunology; $128,856 higher than in infectious diseases or allergy; and $106,830 higher than in ophthalmology (all 

The annual price of mAb therapies is about $100,000 higher in oncology and hematology than in other disease states.

The average price of a cancer drug has doubled in the last decade, and targeted therapies represent an important driver of that increase.

We identified all monoclonal antibody (mAb) therapies approved by the FDA in the last 20 years and compared their annual price across disease states.

Oncology and hematology mAbs represented 40% of the mAb—indication combinations approved, yet they accounted for more than 85% of those priced $100,000 or higher. With a median annual price of $142,833, the annual price of mAbs used in oncology or hematology was about $100,000 higher than those used in other disease states.

The unsustainable rising prices of specialty drugs have prompted a debate about how medications are priced. Manufacturers contend that high prices are essential to recoup research and development costs; however, a growing societal chorus believes that manufacturers are maximizing profits at the expense of patients and the healthcare system. Concerns about drug pricing policies are amplified in oncology and hematology,

 where vulnerable patients and their families often have unrealistic expectations about the value of treatment.

 Of note, the mean price of a cancer drug has doubled in the last decade, and targeted therapies represent an important driver of this increase.

 In this study, we compared the annual price of monoclonal antibody (mAb) therapies approved in the last 20 years by the FDA across disease states. Specifically, we evaluated whether the prices were higher for mAbs used in cancer than for those used in other disease states. We limited our analysis to mAbs to minimize the potential impact of varying production costs among different types of molecules.

We identified all indications approved by the FDA for mAbs from 1997 to 2016 using the FDA website.

 After excluding radioactive mAb&shy;—indication combinations (n = 1), antidotes (n = 1), and those approved for diagnostic purposes (n = 3), withdrawn from the market by 2016 (n = 2), or not available to the public for other reasons (n = 2), our sample included 107 unique mAb–indication combinations (

]). From the FDA-approved label of each mAb, we extracted the recommended dose for each indication, chemical structure (whole mAb, antigen-binding fragment antibody, or other), source (human, humanized, chimeric, or murine), and route of administration (subcutaneous, intravenous, intramuscular, or intraocular). We categorized indications into 5 disease states: oncology or hematology, cardiology or endocrinology, immunology, infectious diseases or allergy, and ophthalmology. We further classified oncology and hematology indications into 7 categories: bone cancer; breast cancer; gastrointestinal cancer; lung, head, or neck cancer; melanoma; hematologic malignancies and hematologic disorders; and other types of cancer, which included glioblastoma, metastatic renal cell carcinoma, urothelial carcinoma, and neuroblastoma (details in 

We extracted the US average wholesale price per milligram as of January 2017 from UpToDate

 and calculated the annual price of treatment for a standard patient—a 70-kg/1.80-m adult, a 40-kg patient in the case of mAb—indication combinations approved for juvenile conditions (ie, with childhood onset), or a 4.5-kg infant for mAb–indication combinations used in pediatrics (ie, for diseases that occur in the first weeks of life)&mdash;for each mAb–indication combination as the product of the recommended dose for 1 year of treatment and the price per milligram. We used lower-bound values for the weight of a standard patient because dosing is based on weight only for some mAbs, so using a higher value would increase the probability of type I error when comparing prices of mAbs that require dose adjustment with those that do not.

We constructed generalized linear models with gamma distribution and log link to evaluate how the annual price of treatment differed across disease states. We controlled for route of administration, chemical structure, time since FDA approval, and source, all of which can

 We followed the same methodology to examine how pricing of oncology and hematology mAb—indication combinations differed by type of cancer or hematologic disorder. All analyses were conducted at the mAb–indication combination level, meaning that for mAbs approved for more than 1 indication, each indication counted as a separate observation (details in 

Our sample included 107 mAb—indication combinations, with a mean (median) annual price of $96,731 ($58,968). The annual price of treatment exceeded $100,000 for 34 (32%) mAb–indication combinations and was highest for 2 indications of eculizumab ($800,280 for atypical hemolytic uremic syndrome and $592,654 for paroxysmal nocturnal hemoglobinuria) and lowest for denosumab, which is indicated for fracture prevention ($2465) (eAppendix Table 1). The annual price of treatment was highest for mAbs used in oncology or hematology (median, $142,833; interquartile range [IQR], $73,920-$164,291], followed by immunology (median, $53,969; IQR, $28,056-$68,770) (Figure and 

). Of 43 oncology and hematology mAb—indication combinations, 29 (67%) were priced higher than $100,000 per year of treatment. Although oncology and hematology mAb–indication combinations represented only 40% of all mAb–indication combinations approved in the last 20 years (43 of 107), they accounted for more than 85% of those priced $100,000 or higher (29 of 34). Within oncology and hematology indications, the annual price of treatment was highest for mAbs indicated for types of cancer delineated as “other,” which included glioblastoma, metastatic renal cell carcinoma, urothelial carcinoma, and neuroblastoma (median, $167,152; IQR, $158,456-$230,225), followed by lung, head, or neck cancer (median, $163,746; IQR, $162,086-$181,417).

After adjusting for route of administration, source, chemical structure, and time since FDA approval, the annual price of oncology or hematology mAbs was $149,622 higher than those used in cardiovascular or metabolic disorders; $98,981 higher than in immunology; $128,856 higher than in infectious diseases or allergy; and $106,830 higher than in ophthalmology (all 

<.001) (Table). Other than disease state, the chemical structure of a mAb was the only factor significantly associated with pricing. In subgroup analysis, we found no significant differences in prices of mAbs by type of cancer or hematologic disorder, which was probably due to the small sample size of each group, as well as the large price variability of hematology mAbs.

Our analysis is the first to compare the price of mAbs approved by the FDA in the last 20 years across disease states. Our results document the high prices of this type of medication; with an average price of $96,731, the annual price of treatment exceeded $100,000 for 32% of 107 mAb—indication combinations approved by the FDA between 1997 and 2016. Oncology and hematology mAbs represented 40% of the combinations approved, yet they accounted for more than 85% of those priced $100,000 or higher. After adjusting for factors that can affect production costs, we found that mAb therapies approved for the treatment of cancer and hematologic disorders are around $100,000 per year of treatment more expensive than mAbs used in other disease states.

Higher prices for mAbs used in oncology and hematology may be explained by multiple factors. First, in order to recover development costs, manufacturers set higher prices for drugs used for a short period of time or for drugs indicated in rare conditions. This likely explains why the 2 most expensive mAb—indication combinations were those with eculizumab, originally approved for paroxysmal nocturnal hemoglobinuria, which affects only 5000 patients in the United States.

 In addition, duration of treatment is usually shorter in cancer, where drugs are commonly used for weeks or months, than in other disease states where drugs may be used for years. Second, the therapeutic arsenal available for the treatment of some types of cancer and hematologic disorders is narrower than in other disease states, which makes patients and providers less responsive to the prices of these medications. Third, payers have limited levers to restrict access to, and hence lower prices for, cancer drugs.

 This is because Medicare Part D plans are required to include all cancer drugs in their formularies and some states also mandate the coverage of cancer drugs by private insurers.

This study was designed to describe patterns in pricing and did not aim to assess the process manufacturers apply when determining the asking price for their medications. Moreover, our study did not attempt to assess the value of the agents studied in terms of cost-effectiveness or clinical outcomes. In addition, our study did not evaluate the pricing of targeted therapies other than mAbs, and we used average wholesale prices, which do not account for manufacturers’ rebates. Nevertheless, this does not invalidate our results because the objective of our study was not to estimate net drug prices after discounts but to compare prices across disease states, and rebates should not differ across disease states.

Despite these limitations, our study has important implications. At a time when healthcare resources are constrained and threaten state and federal budgets, the rapidly rising costs of prescription drugs, specialty drugs in particular, will continue to garner media and policy attention.

 In the absence of some type of value framework where prices are justified by the value they bring to specific patients or the population, attention to drug pricing is likely to grow. There may be a unique opportunity for clinical experts and manufacturers to collaborate and redefine how the value of pharmaceuticals is measured and fundamentally shift the way manufacturers are reimbursed for high-cost medications like mAbs.

 Department of Pharmacy and Therapeutics, School of Pharmacy, University of Pittsburgh (IH, SWB, ASP, CGW, ARH, SS), Pittsburgh, PA; Insurance Division, University of Pittsburgh Medical Center (WHS), Pittsburgh, PA.

 University of Pittsburgh internal funds.

 Mr Bott owns stock in Merck, Incyte, and Johnson & Johnson. Mr Wolf is employed as an intern by Bristol-Myers Squibb. Dr Shrank is employed in the Insurance Division, University of Pittsburgh Medical Center, and has received consulting fees from Johnson & Johnson. The remaining authors report no relationship or financial interest with any entity that would pose a conflict of interest with the subject matter of this article.

 Concept and design (IH, SWB, ASP, CGW, ARH, SS, WHS); acquisition of data (SWB, ASP, CGW, ARH, SS, WHS); analysis and interpretation of data (IH, SWB, ASP, ARH, WHS); drafting of the manuscript (IH, SWB, CGW, ARH, SS, WHS); critical revision of the manuscript for important intellectual content (ARH, WHS); statistical analysis (IH); obtaining funding (IH); and supervision (IH, WHS).

 Inmaculada Hernandez, PharmD, PhD, Department of Pharmacy and Therapeutics, School of Pharmacy, University of Pittsburgh, 3501 Terrace St, Pittsburgh, PA 15261. Email: inh3@pitt.edu.

1. Kantarjian HM, Fojo T, Mathisen M, Zwelling LA. Cancer drugs in the United States: 

. 2015;33(30):3523. doi: 10.1200/JCO.2015.64.8527]. 

2013;31(28):3600-3604. doi: 10.1200/JCO.2013.49.1845.

2. Kantarjian H, Steensma D, Rius Sanjuan J, Elshaug A, Light D. High cancer drug prices in the United States: reasons and proposed solutions. 

2014;10(4):e208-e211. doi: 10.1200/JOP.2013.001351.

3. Light DW, Kantarjian H. Market spiral pricing of cancer drugs. 

2013;119(22):3900-3902. doi: 10.1002/cncr.28321.

4. Chhatwal J, Mathisen M, Kantarjian H. Are high drug prices for hematologic malignancies justified? a critical analysis. 

2015;121(19):3372-3379. doi: 10.1002/cncr.29512.

5. Boniva [prescribing information]. South San Francisco, CA: Genentech, Inc; 2013. accessdata.fda.gov/drugsatfda_docs/label/2013/021455s014s015lbl.pdf. Updated April 2013. Accessed March 9, 2014.

6. Bach PB. Limits on Medicare’s ability to control rising spending on cancer drugs [erratum in 

. 2009;360(9):944. doi: 10.1056/NEJMx090006]. 

2009;360(6):626-633. doi: 10.1056/NEJMhpr0807774.

7. Vivot A, Jacot J, Zeitoun JD, Ravaud P, Crequit P, Porcher R. Clinical benefit, price and approval characteristics of FDA-approved new drugs for treating advanced solid cancer, 2000-2015. 

The annual price of monoclonal antibody therapies used in oncology and hematology is about $100,000 higher than those used in other disease states.

February 2018

Data Breach Locations, Types, and Associated Characteristics Among US Hospitals

Cost-Effectiveness of Collaborative Care for Depression and PTSD in Military Personnel

Pricing of Monoclonal Antibody Therapies: Higher If Used for Cancer?

ACA Marketplace Premiums and Competition Among Hospitals and Physician Practices

Community Navigators Reduce Hospital Utilization in Super-Utilizers

Leveraging Benefit Design for Better Diabetes Self-Management and A1C Control

Development of a Tailored Survey to Evaluate a Patient-Centered Initiative

Claims-Based Risk Model for First Severe COPD Exacerbation

Impact of Telephonic Comprehensive Medication Reviews on Patient Outcomes

Variation in Markups on Outpatient Oncology Services in the United States