The risk of data breaches at U.S. hospitals is greater at larger facilities and hospitals that have a major teaching mission, according to a study led by a researcher at the Johns Hopkins Carey Business School.

More than 30 hospitals that were part of the study each have experienced data breaches at least twice since 2009. At one of those facilities, the data of more than 4 million individuals was compromised. The study results are published in JAMA Internal Medicine.

"Data breaches negatively impact patients and cause damage to the victim hospital," says lead author Ge Bai, an assistant professor at the Carey Business School and expert in accounting and governance issues in the health care industry. "To understand the risk of data breaches is the first step to manage it."

In Illinois, Advocate Health and Hospitals Corporation reported a total of 4,031,767 patients who were affected by two breaches.

The study defines a data breach as "an impermissible use or disclosure that compromises the security or privacy of the protected health information and is commonly caused by a malicious or criminal attack, system glitch, or human error." It could be a breach of electronic or paper records.

Bai and two co-authors examined the federal Department of Health and Human Services' statistics on data breaches reported by various health care providers from late 2009 through 2016. They found that 216 hospitals reported a total of 257 breaches during that period, and that 33 of those hospitals—15 percent—were breached at least twice.

Montefiore Medical Center and the University of Rochester Medical Center and Affiliates, both in New York, were breached four times each, while four other facilities around the United States each experienced three data breaches.

These breaches compromised the health information of millions of people. At 24 of the breached hospitals, the violations exposed the information of at least 20,000 individuals. At six hospitals, more than 60,000 individuals were affected. In Illinois, Advocate Health and Hospitals Corporation reported a total of 4,031,767 patients who were affected by two breaches.

The researchers also looked at hospitals that reported no data breaches. Comparing these findings with the information from the compromised hospitals, Bai and her colleagues noted that the breached facilities were larger, with a median number of 262 beds, compared to 134 for the non-breached. More than a third of those breached hospitals also were major teaching facilities.

http://jamanetwork.com/journals/jamainternalmedicine/article-abstract/2613721