  Using a total of 4,774 hospitals categorized as government, non-profit, and
proprietary hospitals, this study provides the first measurement-based analysis
of hospitals' websites and connects the findings with data breaches through a
correlation analysis. We study the security attributes of three categories,
collectively and in contrast, against domain name, content, and SSL
certificate-level features. We find that each type of hospital has a
distinctive characteristic of its utilization of domain name registrars,
top-level domain distribution, and domain creation distribution, as well as
content type and HTTP request features. Security-wise, and consistent with the
general population of websites, only 1\% of government hospitals utilized
DNSSEC, in contrast to 6\% of the proprietary hospitals. Alarmingly, we found
that 25\% of the hospitals used plain HTTP, in contrast to 20\% in the general
web population. Alarmingly too, we found that 8\%-84\% of the hospitals,
depending on their type, had some malicious contents, which are mostly
attributed to the lack of maintenance.
  We conclude with a correlation analysis against 414 confirmed and manually
vetted hospitals' data breaches. Among other interesting findings, our study
highlights that the security attributes highlighted in our analysis of hospital
websites are forming a very strong indicator of their likelihood of being
breached. Our analyses are the first step towards understanding patient online
privacy, highlighting the lack of basic security in many hospitals' websites
and opening various potential research directions.
