My Data or My Health? Examining Patients’ Response to a Healthcare Data Breach

Abstract

Data breaches pose grave dangers to users, organizations, and society. Healthcare data breaches, valued at $7.1 million per incidence, stand as the costliest. They are also more damaging than other types studied in the literature, such as retail data breaches, since the breached data are irrevocable and the users who are affected face limited alternatives and hefty switching costs. We therefore examine how individual users react to healthcare data breaches. Leveraging a major healthcare data breach as a natural shock, difference-in-differences (DiD) analysis, and newly available locational big data at an individual level, this study reveals the profound, long-lasting, and heterogeneous impact on patients of a health data breach. Specifically, we observed a significant reduction in patient visitation to the impacted hospitals, which persisted even after 10 months. Furthermore, this study highlights how social disparity limits the ability of disadvantaged patients to respond to such an intense invasion of privacy. The findings accentuate the need for more equitable policies toward healthcare cybersecurity to protect and support vulnerable populations.

Keywords: healthcare data breach, social disparity, locational big data, natural experiment.