M&A Effect on Data Breaches in Hospitals: 2010-2022

Data breaches in hospitals disrupt care, potentially leading to fatal consequences, violating privacy rights, and incurring significant costs to remedy. Mergers and acquisitions serve as an essential source of financing but also induce substantial management challenges. Using proprietary hospital merger records and archived data breach reporting from the Department of Health and Human Services from 2010 to 2022, I implement a stacked difference-in-differences estimation strategy to study whether and how hospital mergers increase the probability of a data breach. On average, the probability of a data breach in two years for pre-merger deals is approximately 3%, while for the hospitals undergoing the merging process, the data breach rate reaches 6%. The effect is robust to changes of the two-year window. The effect is also robust to the changes in sample size due to the data availability of the control variables and in how standard errors are clustered. Increased attention online one year before the merger deal is signed, identified with Google Trends score, causes a large increase in pre-signing hacks, especially in recent years through ransomware attacks. Such an effect does not extend to the post-signing period. The increase in post-signing hacks is due to the incompatibility of merging information systems. More complicated information system integration in multi-hospital systems leads to greater elevated post-signing breaches. Conversely, the complementary effect of organizational capital that improves internal risk control reduces the increase in data breaches. For example, mergers involving publicly traded hospitals can experience a decrease in data breaches during mergers. The dynamic analysis shows that the data breach situation during mergers is getting worse because of soaring cases of hacks, even though insider misconduct has become less of a problem since 2014. Recent post-signing hacks exhibit shorter attack cycles compared to conventional malware attacks. These faster cycles catch unprepared hospitals off guard before hospitals get integration in order. First draft: February 2023. I would like to express my heartfelt gratitude to my advisors, Daniel Arce, Catherine Tucker, Anne Burton, and Anton Sobolev, for their invaluable guidance, unwavering support, and exceptional expertise throughout the entire dissertation process. I am deeply thankful to the participants in the following events: the 2022 WEIS rump session organized by Tyler Moore, Laura Brandimarte, and Sadia Afroz, AEA-CSWEP online and SEA mentoring organized by Catherine Maclean, Orgül Öztürk, Melanie Guldi and Maya Rossin-Slater, the Texas Applied Microeconomics Student Workshop organized by Francisco Pardo Pajuelo, the Cybersecurity Summer Institute at Georgia Tech organized by Nadiya Kostyuk, the Emerging Scholar on Healthcare Competition organized by Ellie Prager at ASHEcon and the 2023 WEIS organized by Svetlana Abramova, Josephine Wolff and Thomas Maillart. I am in debt to my ASHEcon discussant Ryan McDevitt. Furthermore, I would like to extend my thanks to Avi Goldfarb and Catherine Tucker for their NBER Economics of Privacy Tutorial in Fall 2022. Any remaining mistakes or shortcomings in this work are solely my own responsibility.