Expanding risks: Medicaid expansion and data security

TL;DR

Medicaid expansion under the Affordable Care Act was linked to a significant decrease in consumer fraud and data breaches, contrary to initial concerns.

Contribution

This study provides novel empirical evidence on the data security effects of Medicaid expansion using a difference in difference approach.

Findings

Medicaid expansion led to a significant decrease in consumer fraud claims.

There was a notable reduction in data breaches and compromised records after expansion.

No significant effect on identity theft was observed.

Abstract

The Patient Protection and Affordable Care Act of 2010 led to the largest expansion of healthcare coverage since the instantiation of Medicare and Medicaid in 1965. Concerningly, prior research suggests this large influx of new patient data across the various and highly dispersed sources may create new potential for malfeasance in the form of consumer fraud and identity theft. We exploit the phased expansion of Medicaid into different states at different times to assess whether this expansion subsequently drove increased fraud and identity theft. Using a difference in difference approach, we explore these data security-related aftereffects of the law. Surprisingly, results indicate a significant decrease in claims of consumer fraud after the expansion of Medicaid, with no robust effect on identity theft. In empirical extensions, we also find a material drop in data breaches and compromised records after the expansion of Medicaid. Taken in sum, these findings suggest that the expansion of Medicaid had a consequential effect on the security of consumer data and created significant positive externalities for consumers.

Figures

Equations

Full text

The management and provision of healthcare in the United States remains one of the most divisive topics among its citizens. Emblematic of the heated debate is the continued battle over former President Obama’s signature domestic policy program, the Patient Protection and Affordable Care Act (ACA), also known as “Obamacare”, the constitutionality of which has been argued in front of the Supreme Court four separate times and which holds the distinction of being the most challenged statute in the nation’s history [1,2].

Interestingly, despite the scrutiny afforded to the healthcare-related aspects of the statute, its societal implications beyond healthcare have received circumspect empirical consideration (with some notable exceptions [3,4]). Indeed, while researchers point to increased vaccination rates, improved medical coverage among the nation’s youth, and coverage in underserved communities [5–7], little attention has been paid to its wider implications. This is striking given the aftereffects that traditionally spill from such a large injection of capital into dispersed and heterogeneous markets. In this work, we begin to close this gap by investigating an outcome that often characterizes expansive government spending: moral hazard and the fraud that accompanies it [8–11]. We do so by investigating the effect of Medicaid expansion on rates of consumer fraud and identity theft.

The theoretical relationship between Medicaid expansion, consumer fraud, and identity theft is somewhat opaque. On the one hand, the conventional view would be that fraud and identity theft will rise with the expansion. To the extent that the expansion of Medicaid brought with it tremendous increases in coverage, the creation of individual health insurance markets, and an intense digitization of records [12,13], the value of the concentrated records that could be stolen increases by construction. And when coupled with the ACA’s push to reform delivery systems through digitization (viz. through electronic health records and health information exchanges (HIEs)), the concern is evident. Because a larger number of patients are being treated within the bounds of hospitals [7], where the encounter typically generates a digital record (initially due to the HITECH Act and further propelled by the ACA), there is more and richer data to steal. When discussing the reach of the ACA and its digitization efforts, Fontenot [14] notes: “With an electronic record, the patient’s entire transition through life and treatment becomes available far beyond that patient and their encounters with the health care system” [p. 74].

On the other hand, this inference does not account for extant knowledge of digitization and the efficacy of statutes designed to limit malfeasance. Numerous scholars have noted that while digitization can result in negative externalities like insurance upcoding, it also streamlines the auditing process, making it easier to detect and correct misconduct [15–17]. Similar views have been advanced regarding fraud detection in a digitized healthcare system (i.e., analytical auditing) [14]. Moreover, to the extent that the Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandates rigorous protections of personal health data to limit leakage, data loss might also fall. Insofar as health care systems expanded to accommodate newly-covered patients, it is likely that IT security investments were made. If this were the case, the total amount of consumer fraud and identity theft might drop due to the increased data security and oversight of personal health information brought on by the expansion of Medicaid.

In this same vein, recent research shows that IT governance structures can reduce the risk of breach in the future [18,19] and statutory attempts to limit the prevalence of breaches, either through more aggressive law enforcement or through mandatory disclosure, can effectively deter cybercriminals [20–23]. Perhaps unsurprisingly, these findings are not uniform, with empirical work also showing no relationship between statutory interventions and consumer data loss [24]. Further complicating things, there can be communication issues with consumers. D’Arcy, Adjerid [25], for example, demonstrate that firms increase their risk of data breach when activists believe they are greenwashing by engaging in symbolic corporate social responsibility activities. To explore these competing perspectives, we leverage the phased implementation of Medicaid expansion after the passage of the ACA using a difference in difference approach [26,27].

Study data and methods

Data and sample

To investigate the effect of Medicaid expansion on rates of consumer fraud and identity theft, we construct a unique data set from three sources. First, we gather data on the expansion of Medicaid from the Kaiser Family Foundation. These data are compiled in Appendix Exhibit A1 and indicate the year of Medicaid expansion for each state (if at all). Second, we draw data on claims of fraud and identity theft from the FTC’s Consumer Sentinel Network Reports. These data have been consistently used in empirical research to measure rates of fraud and identity theft [22,24]. We first focus on instances of fraud and identity theft, as opposed to data breaches, because there are varying requirements for breach reporting, breaches vary in the potential harm posed to the public, and many breaches go completely undetected (making classifying the attack vector impossible). For example, an employee of a health insurer could steal one or two patients’ information each week; detecting this attack and tying it back to the insurance company could be very difficult, but the fraud or identity theft that resulted would be reported. Identifying the attack vector is often difficult or impossible, reinforcing our approach focusing on instances of identity theft and fraud. However, to ensure robustness we also investigate the effect of Medicaid expansion on breached consumer data using the Privacy Rights Clearinghouse [25,28]. Data are organized at the state-year level from 2005 to 2018. Consistent with prior work, we treat the District of Columbia as an independent member of the panel. As this paper relies entirely on secondary analysis of publicly available data that is aggregated at the state level with no way to deidentify an individual, it does not qualify as human subjects research and IRB approval was not required.

Analytical approach

To identify the effect, we estimate a two-way fixed effect difference in difference estimation [27]. As the dependent variable is a non-negative integer count, we use a Poisson Psuedo Maximum Likelihood (PPML) estimator [29]. Formally, we estimate Equation 1, expressed in linear form:

$$[eqn]$$

where y_jt_ first takes on the number of identity thefts and then the reported number of cases of consumer fraud. ∂is the vector of state fixed effects (j). γ is the vector of year fixed effects (t). ε is the error term. The constant term is not estimated due to the inclusion of the two-way fixed effect structure. All states are included, whether they were ultimately treated or not, providing power to establish the parallel trend estimate (missing counterfactual) and assess pre-treatment trends [30]. Robust standard errors are clustered on the state (i.e., the unit of treatment) [31]. Results are in Table 1.

Table 1: Effect of medicaid expansion on identity theft and fraud.

Before discussing our results, several items bear note. The chief concern with any difference in difference estimation is the assessment of pre-treatment trends in the dependent variable [26,32]. The concern is that if heterogeneity exists across the treatment and control groups prior to treatment, we might inappropriately attribute post-treatment difference to the treatment instead of some pre-existing factor. In context, such a concern is not outlandish. If access to healthcare markets influences changing rates of fraud and identity theft, the expansion of Medicaid might be correlated with such factors a priori, resulting in a biased estimate, even if the expansion of Medicaid by state legislators as a direct response to general fraud is implausible. To assess this possibility, we estimate a variant of the Autor [33] leads and lags framework, which has become popular in empirical work [34–36]. In doing so, we create a series of relative time dummies that capture the temporal distance between treatment in the current period t versus treatment in state j (conditioned upon the absolute time fixed effects and the location fixed effects). By estimating the effect semi-parametrically, we can visualize the effect over time both pre- and post-treatment. To mitigate power issues in the tails, we collapse all indicators more than 5 years from treatment into a single coefficient. The period immediately prior to treatment is omitted to avoid the dummy variable trap. Results are in Table 2.

Table 2: Effect of medicaid expansion on identity theft and fraud in relative time.

Study results

In Columns 1–4 in Table 1, we observe a general decrease in rates of identity theft and fraud after Medicaid expansion, although the effects cross beyond the traditional thresholds of significance in Column 3 once controls are added. Still, most columns indicate a negative relationship. Intuitively, this suggests that Medicaid expansion decreases rates of malfeasance. Numerous mechanisms are plausible, ranging from the increased security associated with granting previously uninsured persons access to healthcare markets, to increased security through the digitization of these records (a consistent occurrence after the expansion of Medicaid), to increased oversight on the treatment of medical records which accords with federal intervention in the market. Economically, estimates indicate a drop in identity theft between ~5.2% and ~7.1%. Similarly, estimates indicate a decrease in fraud between ~9.6% and ~16.2%.

We turn next to the event study model (Table 2). As can be seen, there is a consistent negative effect of treatment on fraud in Column 2, with negative and significant estimates emerging. Further, as can be seen, there is little in the way of significant pre-treatment trends, although there is a marginally significant difference five years prior to treatment. Further, and consistent with Table 1, in Column 1 we observe no consistent pre- or post-treatment effect, suggesting a de minimis relationship between Medicaid expansion and identity theft.

Data breaches

To ensure the robustness of the above results it is worth considering alternate measures of data loss. As discussed previously, one popular measure in the empirical literature is to consider the prevalence of reported data breaches and the number of the records stolen [24,25,28]. While this outcome is more distal from our measures of consumer harm, evaluating the number of breaches offers a valuable check on a potential mechanism, i.e., decreased breaches overall.

To execute these tests, we draw data from the Privacy Rights Clearinghouse, a publicly available repository of historical breaches. The Privacy Rights Clearinghouse began collecting data in 2005, but nationwide data is thin prior to 2010. Table 3 reports analysis using the full sample. Exhibit A2 in the Statistical Appendix reports results restricting the sample to the years 2010 onward; results remain consistent. We then replicate Equation 1, replacing the number of fraudulent claims and identities stolen with the total number of reported breaches and the total number of breached records. In deference to the number of breaches and the number of records compromised, we log the DV and interpret the effect elastically. The estimator is OLS.

Table 3: Effect of medicaid expansion on breaches and record theft as defined by the privacy rights clearinghouse.

Results are in Table 3. As can be seen, effects are consistent. There is a significant and negative effect on both the number of breaches which have occurred and the total number of compromised records. Two critical takeaways from these estimations are evident. First, these estimations corroborate prior measures and suggests a beneficial effect of Medicaid expansion on data security beyond claims of fraud. Second, and more importantly, they offer suggestive evidence of the mechanism behind the effect, i.e., increased security. To the extent that the rate of breaches and breached records are declining in Medicaid expanding states, it appears that this expansion is slowing data loss by decreasing the number and extent of breaches.

The phased treatment (being implemented at different times in different states) raises an issue of measurement bias, because during a phased treatment implementation, the effect shifts, becoming a weighted average of early vs. late treatment, treated vs. never treated, and so forth. As a result, the individual weights of the components of the estimate may invert, yielding a biased coefficient which can even invert the sign of the coefficient, notably when the individual treatments differ in size and grow with time. To address this concern, we include a Goodman-Bacon [37] decomposition, and a Callaway and Sant’Anna [38] estimation in the Supporting Information Appendix. In the interest of space, we refer the interested reader to this Appendix for further details on the robustness checks including placebo tests and sample truncation. Results are consistent with our main findings.

Discussion

In this work, we investigate the relationship between the expansion of Medicaid provisions under the ACA and data security in the form of fraud and identity theft. The relationship between these concepts is theoretically opaque. On the one hand, the injection of hundreds of billions of dollars into the healthcare market materially raises the attractiveness of such targets to malicious actors, notably as this period saw an increased rate of personal data digitization [12]. As a result, it is plausible that thefts might rise, with the personal information of millions of Americans spilling into secondary markets for the sale of personal data like the dark web [39]. On the other hand, there are reasons to believe that cases of identity theft and fraud might fall. Numerous scholars have highlighted the increased security and monitoring which accompanies the digitization of records, and the expansions associated with ACA rollout may have stimulated investments in IT security. Coupled with the fact that patients themselves are now formally covered by insurance, there is an incentive for them to formally engage with the medical system and not misrepresent themselves to physicians.

Upon exploring these competing perspectives, results are three-fold. First, we find that the number of reported cases of fraud significantly declines after the expansion of Medicaid. Second, we find no material or robust change in the number of identities stolen. Third, in deference to traditional approaches to measuring population level data security, we also find a decline in the number of data breaches and stolen or compromised records after the expansion of Medicaid. Taken in sum, these findings suggest that the mechanism by which the effect manifests is likely increased oversight, which comes with creating formal markets for underserved communities, and results in increased data security and diminished rates of fraud.

Policy implications

While the injection of capital into markets has historically raised the specter of fraud and malfeasance, these concerns appear to be limited when appropriate technological safeguards are implemented. Put simply, risks of moral hazard and fraud have near universally accompanied large infusions of capital into markets [8–11] for obvious reasons. Not only are targets more attractive, because there are more consumers tracked by them [7], but the richness of healthcare data and the interconnected nature of the emergent exchanges has long been thought to lead to data security vulnerabilities [40,41]. Yet, this simplistic view ignores the effect of proactive steps organizations can take [42,43], and the benefits of direct guidance from federal entities when it comes to safeguarding data (i.e., HIPPA). As a result, to the extent that these organizations appear to be integrating security with organizational and institutional practices [28], they are able to better safeguard consumer data than pre-digitized organizations.

Further, to the extent that any federal program which bluntly injects large amount of capital has been met with skepticism, and raises reasonable concerns of downstream fraud, our findings underscore the importance of coupling capital injection with appropriate controls. Contrast, for example, Medicaid expansion (where tight controls existed) with the Trump Administration’s injections of capital into the economy during the Covid-19 pandemic (e.g., the Paycheck Protection Program (PPP)). To date, the Government Accountability office [44] and NGOs [45] have associated these programs with tens of billions of dollars of fraud against U.S. taxpayers. As a result, numerous federal agencies (ranging from Treasury, to HHS, to the Department of Justice) have been compelled to initiate massive ex post efforts to recover these dollars (each of which is also expensive). And while it is beyond the scope of this work to second guess the necessity of capital injections during a global public health emergency, the absence of such controls only bolsters the importance of our findings for policy makers.

Our work also underscores the importance of technological safeguards and regulating inappropriate access. One concern following the digitization of patient records has been that the proliferation of data sharing across organizations could lead to inappropriate use. This is a consistent concern when balancing the size of digital security programs at the local vs. state and federal level. Examples are easy to come by, ranging from the inappropriate search of celebrity health records by medical practitioners [46] to the illegal search of Barack Obama’s records by Philadelphia police officers [47]. On the one hand, permitting smaller jurisdictions to manage data is intuitively appealing, because the attractiveness of the target is lower (viz., because fewer records are tracked). However, these entities may not have the resources or technical knowhow to properly safeguard data and limit access, and decentralization may require an unpalatably high ratio of IT investment to overall expenses within each jurisdiction. This once again pushes back on the longstanding assumption that a larger aggregation will lead to an increased likelihood of data loss, notably when aggregation is coupled with superior data controls. We further hope this work serves as a call for future scholarship that investigates the conditions under which greater data aggregation can materially benefit consumer security.

Limitations

These findings are not without limitation. First, due to the secondary nature of the empirical investigation, we are unable to uncover the exact mechanism by which the decline in fraud manifests. Although our evidence suggests that the number of breaches is declining, it could also be that malicious actors may not be targeting the particular hospitals or physicians’ offices which tend to treat a larger number of Medicaid patients for fear of federal enforcement. It is also possible that formal participation in insurance markets results in fewer cases of fraud on the part of patients (uninsured patients traditionally being without a general practitioner and therefore being less incentivized to engage truthfully with healthcare providers). A third possibility is that physician prevalence for upcoding under digital regimes is declining under Medicaid expansion, again suggesting an enforcement mechanism. We leave further determination of the mechanism to future scholars. A related line of inquiry relates to the both the breach vector (e.g., physical versus digital) and the type of fraud or identify theft exploiting the leaked information (e.g., credit card or loan fraud, tax or benefit fraud, health care fraud); the available data does not provide this level of granularity.

Second, we are reliant on diagnostic methods to ensure the validity of the difference in difference. While the absence of pre-treatment trends and the success of the various falsification tests suggest that the exogeneity assumptions of the DID are met (i.e., treatment can be considered exogenous once conditioned upon controls), this cannot be assured in the absence of laboratory conditions. Bearing this in mind, legislative histories are, to the best of our understanding, devoid of references to data security when state legislatures were debating the expansion of Medicaid. Third, the ACA was expanding coverage in an aggressively changing market, making it difficult to ignore the possibility of an omitted variable bias, despite the successful robustness checks. While the fixed effect structure should minimize the effect of other federal laws which were implemented nationwide (such as the HITECH Act which was implemented universally across the country and affects both the treated and untreated states in the sample), the possibility of other state level initiatives remains a possibility which would impact the causal interpretation of our results. Fourth, and importantly, we are unable to uncover the source of the associated fraud, or connect an individual breach with a subsequent reported fraud. Future work would do well to consider not only the types of individual frauds which are occurring, but the source of that malfeasance based on the type of breach which occurred (e.g., external hacks, employee data theft, etc.).

Conclusion

This work addresses the possibility that the expansion of Medicaid under the ACA had a material effect on the security of citizen’s personal data. We find no evidence of increased fraud. Instead, we observed rates of fraud declining in Medicaid expanding states, with breaches and breached records declining as well. We hope this work serves as a call to action for researchers on two fronts. First, to consider the effect of Medicaid expansion on broader social issues besides healthcare. While some scholars are beginning to take this approach [3,4,48], it remains an underserved area of research for one of the largest federal programs in U.S. history. Second, we hope this work pushes scholars to break the mold of focusing solely on data breaches in favor of investigating instances of fraud and identity theft (i.e., materialized harm to consumers). While the focus on breaches is appealing, it is potentially problematic because breach discovery is not 100%, and not all breaches result in material harm, which can result in inconsistent reporting. Pivoting away from this approach, and towards observable instances of harm, offers the opportunity for researchers to begin resolving this discrepancy between measures and constructs.

Supporting information

S1 FileS1 Appendix, S2 Exhibit A1- S8 Exhibit A7.(DOCX)