Hospitals that suffered a data breach went on to treat patients faster, and heart attack patients at those hospitals became less likely to die. A study of more than 1.2 million emergency admissions in Florida found that over time, breached hospitals cut emergency department waits by about half an hour and lowered heart attack deaths by one percentage point.
The authors link the improvement to upgrades in how those hospitals share patient information after a breach. The study, by Dapeng Chen, Shin-Yi Chou and Xiaosong (David) Peng of Lehigh University, was published online in Health Services Research on January 9, 2025 (read the paper).
Matching breached and untouched hospitals
The researchers combined breach reports filed with the US Department of Health and Human Services with patient-level records from the Florida State Inpatient Database for 2013 to 2017. They focused on Medicare-certified nonfederal hospitals with more than 100 beds.
Six hospitals that had a breach were matched with six similar hospitals that did not, using propensity score matching. The five breaches involved affected about 120,000 patients in total and included three cases of unauthorized access or disclosure, one loss and one hacking incident.
The team then compared changes before and after each breach, across 1,295,537 records of patients admitted through the emergency department.
Faster care, fewer heart attack deaths
After a breach, the time from arriving at the emergency department to being admitted fell by 0.56 hours, roughly a 10% drop. The time to undergo the main procedure after admission fell by 0.18 days, about 8%. Length of stay fell slightly, by 0.06 days, a result that was only marginally significant.
Overall in-hospital mortality did not change. But among patients with acute myocardial infarction, or heart attack, mortality fell by one percentage point from a baseline of 9.3%, a relative drop of about 10.7%. Death rates for other patient groups stayed the same.
The gains were not immediate. In the 30 days around a breach, the authors found no significant change. The drop in time to a procedure appeared within a quarter, while emergency department waits only began to shorten after about a year.
Better information sharing as the likely reason
To understand why, the researchers compared health information technology at breached and non-breached hospitals. Breached hospitals expanded their ability to pull in and query patient information from outside systems and to notify primary care physicians about emergency visits, while the control hospitals mostly stayed the same or slipped.
The authors note that earlier research shows hospitals typically raise IT spending after a breach. They argue that the improved information exchange likely explains the better timeliness and outcomes.
They are clear about the limits. They could not directly observe how hospitals responded to their breaches, the sample covers only a dozen Medicare-certified hospitals in one state, and the study does not address acute attacks such as ransomware, which can shut down hospital systems outright.
Study Details:
- Title: Impacts of Hospital Data Breach on Healthcare Quality
- Authors: Dapeng Chen, Shin-Yi Chou, Xiaosong (David) Peng
- Journal: Health Services Research
- Publication Date: January 9, 2025
- DOI: 10.1111/1475-6773.14439