Amazon Clinic under fire for data privacy concerns

Amazon Clinic is coming under scrutiny for how it handles data privacy for its remote care patients. According to a letter from Senators Elizabeth Warren (D-MA) and Peter Welch (D-VT), obtained by Politico in June, lawmakers are raising the question of whether Amazon’s user agreement violates HIPAA by granting the company “complete” access to health information – and the right to re-disclose that information at will. 

 “According to recent reporting by the Washington Post, customers seeking to enroll in Amazon Clinic, which advertises low-cost health care provided online, are first required to sign an ‘authorization’ form that gives Amazon ‘complete’ access to customers’ health information,” the Senators wrote to Amazon CEO Andy Jassy.  

“The form indicates that this information ‘may be re-disclosed,’ after which it will ‘no longer be protected by HIPAA,’ the federal law that requires providers to take steps to protect patient health data. The form does not provide specific details on how patient data will be shared or used going forward.” 

The clause in the authorization form contradicts other statements from Amazon Clinic that the company does not “use customer data for purposes that customers haven’t consented to,” the lawmakers contend.   

The lack of clear information about what Amazon might do with patient data is concerning from a privacy and consumer rights perspective, they added, citing the recent $1.5 million fine levied on GoodRx by the FTC for similarly murky practices. 

In that case, GoodRx agreed to pay a civil penalty fine for sharing users’ health information with third parties for advertising purposes. The information included data about prescriptions and health conditions. 

The FTC alleges that GoodRx shared this information without users’ consent, thereby violating the Health Breach Notification Rule. Amazon Clinic may be hoping to avoid similar accusations by tucking the ask into its user agreement, thereby technically securing consent from prospective patients. However, making access to the service contingent on accepting potential re-disclosure of data may run afoul of other key regulations. 

“Customers who decline to consent to the ‘HIPAA authorization’ are prevented from completing their patient registration with Amazon Clinic and are re-directed to a third-party provider information page,” the letter states. “Notably, the HIPAA Privacy Rule prohibits conditioning care on an authorization to disclose patient information.” 

The Senators have asked Amazon to answer a series of questions to clarify the situation, including whether or not patient data will be included in any analytics or algorithms, used for marketing purposes, or used to develop new products. 

Warren and Welch would also like to know if data is being sold to third parties – including local, state, or federal law enforcement agencies – and what restrictions, if any, are placed on third-party data use.    

Amazon is also being asked to provide certain documents, such as a sample contract between Amazon and any third-party providers that deliver health care services to Amazon Clinic enrollees, as well as itemized lists of all data elements being collected from patients and shared with third-party entities.  

“Amazon Clinic customers deserve to fully understand why Amazon is collecting their health care data and what the company is doing with it,” the lawmakers concluded.  

Jennifer Bresnick is a journalist and freelance content creator with a decade of experience in the health IT industry.  Her work has focused on leveraging innovative technology tools to create value, improve health equity, and achieve the promises of the learning health system.  She can be reached at jennifer@inklesscreative.com.