FTC Warns Amazon About Improper Health Data Sharing Following One Medical Acquisition

Following Amazon’s finalized acquisition of membership-based primary care practice One Medical, the Federal Trade Commission (FTC) sent a letter to Amazon reminding it of its obligations to protect sensitive health information.

One Medical has more than 8,000 employer clients and provides membership-based care both virtually and via 188 in-person locations. Amazon’s decision to acquire One Medical solidifies its place in the healthcare sector, which some fear could have negative implications for patient privacy.

Both One Medical and Amazon have made statements indicating that they would not share consumers’ personal health information for marketing or advertising purposes without consent, the FTC noted.

“The statements in One Medical’s privacy policies, combined with the recent public statements by both companies about privacy, constitute promises to consumers about the collection and use of their data by the post-acquisition entity,” the letter pointed out.

“Companies that fail to abide by the commitments and representations they have made to consumers can violate Section 5 of the FTC Act.”

Recent actions by the FTC, such as its $1.5 million penalty on GoodRx over an alleged violation of the Health Breach Notification Rule, highlight the Commission’s commitment to cracking down on improper health data sharing.  

“Amazon and One Medical should make clear not only how they will use protected health information as defined by HIPAA but also how the integrated entity will use any One Medical patient data for purposes beyond the provision of health care,” the FTC’s letter continued.

“As relevant here, whether the companies’ privacy representations are deceptive will turn on the perspective of a reasonable consumer rather than the perspective of a HIPAA expert.”

Following talks of Amazon’s plans to acquire One Medical in August, Senator Josh Hawley (R-MO) sent a letter to the FTC asking it to investigate the potential purchase.

The Senator argued that giving Amazon access to “enormous tranches of patient data” could be a mistake. Hawley suggested that while HIPAA and other privacy laws exist, “loopholes exist in every legal framework.”

Now that the acquisition has been finalized, the FTC has made it clear that it will not tolerate any misuse of health data.