Search

The authors develop a conceptual framework for conditions under which news of a major customer data breach at a U.S. retail firm is likely to decrease other U.S. retailers' shareholder value. Using the massive data breach at Target Corporation as their empirical context, and an event study of 168 publicly listed U.S. retailers as their methodology, the authors find considerable support for their framework. Results indicate that the Target data breach resulted in negative abnormal returns for other U.S. retailers, and that the strength of this contagion effect was moderated by factors related to retailers' (a) size and product market similarity with Target, (b) governance-related tie-strength with Target, (c) information technology-related ability to prevent a similar breach, (d) marketing ability to respond effectively in the aftermath of a similar breach, and (e) corporate social responsibility. The authors show that although a major retail data breach may result in an intra-industry spillover, managers can use factors related to information technology, marketing, and corporate social responsibility to help insulate their firms from this contagion effect. [ABSTRACT FROM AUTHOR]

Electronic health records (EHRs) have been promoted as a mechanism to overcome the fragmented healthcare system in the United States. The challenge that is being discussed is the rights of the patient to control the access to their EHRs' data and the needs of healthcare professionals to know health data to make the best treatment decisions for their patients. The Federal Trade Commission has asked those who store consumer information to comply with the Fair Information Practice Principles. In the EHR context, these principles give the rights to the patient to control who can see their health data and what components of the data are restricted from view. Control is not limited to patients, as it also includes parents of adolescent children. We suggest that the ongoing policy discussion include consideration of the precise questions patients will be asked when a need for data sharing arises. Further, patients should understand the relative risks that they face, and the degree to which their decisions will (or will not) significantly reduce the risk of a data breach. As various approaches are considered, it is important to address the relative resource requirements and the associated costs of each option. [ABSTRACT FROM AUTHOR]