A medical appointment gives it access to my most personal information

For the better part of a decade, One Medical has been my primary care provider. It’s convenient, with locations around the Bay Area, and I like being able to schedule a same-day physical or get a quick referral to a specialist.

One Medical knows a lot about me. In addition to years of clinic visits and virtual chats, I use the mobile app to record my blood pressure and resting heart rate, check lab results and renew prescriptions as needed. For that I pay a membership fee of $1[ads1]99 a year.

But I never considered the possibility that Amazon might one day own One Medical.

The same company that sends me countless boxes every week, peppers my Kindle with book recommendations and smart TVs with movie suggestions, tells my kids the weather when they call Alexa, and offers Prime discounts when I shop at Whole Foods is about to give my medical services and owns the portals that contain my most sensitive information.

I’m not the only person who had this deeply troubling thought on Thursday after waking up to the news that Amazon had agreed to buy One Medical for about $3.9 billion. At $18 a share, Amazon is paying a 77% premium to where the primary care company was valued a day earlier.

As one member wrote on Twitter, “After a mostly positive experience with One Medical, I canceled my membership today. I do not trust Amazon to act in good faith with my health data.”

Founded in 2007 and based in San Francisco, One Medical offers clinical services in 16 U.S. markets, with three more coming soon, according to its website. At the end of last year, the company had 736,000 members.

Amazon did little to calm my fears with its acquisition announcement. The company said nothing to give One Medical customers any comfort, and there was no conference call to discuss the acquisition, as is common with many large transactions. Termination of the agreement will require authority approval.

In response to a request for this story, Amazon provided the minimum level of assurance that it will comply with government regulations, under the Health Insurance Portability and Accountability Act (HIPAA), which limits how the company can use protected health information, or PHI. This includes all personally identifiable information as well as medical history, laboratory test results and other health data.

“As required by law, Amazon will never share One Medical customers’ personal health information outside of One Medical for advertising or marketing purposes for other Amazon products and services without express permission from the customer,” an Amazon spokesperson said in an email. “Should the agreement be terminated, One Medical customers’ HIPAA-protected health information will be handled separately from all other Amazon businesses, as required by law.”

In other words, everything One Medical knows about me will remain in the secured silo. Whatever profile Amazon has built on me and my family, from our shopping habits and travel preferences to the shows we watch together on the weekends, won’t meddle with my health data.

Despite the laws, Amazon will have to work hard to convince consumers – and likely politicians – that its intentions are pure, and the main goal is to help “dramatically improve the healthcare experience over the next few years,” as Amazon Health Services leads Neil Lindsay said in the press release announcing the deal.

After all, along with its giant retail and cloud divisions, Amazon has built a highly profitable advertising business that generated over $31 billion in revenue last year and grew 58%. Most of that money comes from brands paying big bucks to promote their products on Amazon’s properties, where it becomes more expensive to compete for eyeballs.

Amazon controls about 13% of the US online ad market, trailing only Google and Facebook, according to Insider Intelligence.

“I don’t think there’s anything Amazon can do to get people to trust the company with their health information,” said Caitlin Seeley George, campaign director for Fight for the Future, an advocacy group focused on technology and digital rights.

Seeley George said in an email that the issue of health privacy is especially important after the Supreme Court overturned Roe v. Wade, which ended the constitutional right to abortion. Certain decisions related to reproductive health that until recently were protected by law can now potentially be considered illegal.

Amazon has already restricted the sale of emergency contraceptive pills after demand increased following the Supreme Court ruling. And Google said it will work quickly to delete the location history of people who go to abortion sites.

“Pushing further into health care raises some serious red flags, especially in the post-Roe reality where people’s data can be used to criminalize their reproductive health care,” said Seeley George.

Seeley George also wonders whether Amazon, outside of HIPAA regulations, could roll out a fertility tracking or mental health app and collect information that “could be used to make assumptions about a person that could be used against them.”

Amazon already has a health tracker called Halo that collects information such as body fat percentage, activity level and sleep.

Techno-optimists are likely to scoff at such cynicism. The status quo in healthcare is miserable. Systems are old and don’t talk to each other, billing is notoriously opaque and complicated, and medical care is ridiculously expensive.

Amazon has been pushing into the healthcare space for years, acknowledging the system’s many flaws and inefficiencies and trying to offer better care to its massive employee base, which jumped to 1.6 million last year from 1.3 million in 2020.

Amazon bought online pharmacy PillPack in 2018 for $750 million and launched Amazon Pharmacy two years later. The company has invested in a telehealth service called Amazon Care, which launched as a pilot for some employees in 2019 and is now available for other employers to offer as a service to their employees.

Deena Shakir, a partner at venture firm Lux Capital and an investor in a number of health-tech startups, noted that for Amazon, this is “not their first rodeo in healthcare.”

“Amazon is very aware of how to handle HIPAA considerations and has experience across multiple products with this,” Shakir wrote in an email. These types of deals “should encourage further partnerships between larger companies and major health technology players,” she wrote.

Shakir’s firm is an investor in Carbon Health, which provides primary care and acute care services in 16 states. The company serves about 1.1 million patients and, compared to One Medical, typically targets a less affluent demographic.

Carbon Health CEO Eren Bali agrees with Shakir that Amazon is deeply limited in how it can use the data. Compared to other large technology companies such as Facebook and Google, he says that Amazon gains a good deal of trust from consumers.

But Bali understands why concern might exist. Medical companies have huge amounts of personal data, including social security numbers, driver’s license numbers and insurance cards on top of all the health information in their systems. Patients are much more willing to hand over personal data to doctors and nurses than to other types of service providers.

And while there are strict rules about how this data can be used, consumers can reasonably ask what happens if a company like Amazon breaks the rules.

“Unfortunately, there are not strong technical solutions to enforce data access, which is a major weakness,” Bali said in an interview. Whether patients should worry about that is a “personal decision,” he said.

Bali is generally positive about Amazon’s leap into space. When Amazon makes a splashy announcement indicating it’s entering an old market with big incumbents, incumbents are forced to act to avoid being wiped out, Bali said.

He cited Amazon’s purchase of PillPack as an example. While Amazon has struggled to gain traction in the pharmacy business, companies like Walgreens and Walmart are pushing into the market to bolster their digital offerings in ways that benefit consumers, Bali said. The One Medical agreement can similarly trigger improved products and services in the world of primary care.

“Big companies usually don’t feel threatened by small startups,” Bali said. “But they are really threatened by Amazon.”

— CNBC’s Annie Palmer contributed to this report.

SEE: Amazon’s deal with One Medical is part of an ‘option package’