One Medical deal gives it access to my most personal info

For the better part of a decade, One Medical has been my primary care provider. It’s convenient, with locations around the Bay Area, and I like being able to schedule a same-day physical or get a quick referral to a specialist.

One Medical knows a lot about me. In addition to many years of clinic visits and virtual chats, I use the mobile app to record my blood pressure and resting heart rate, check my lab results and renew prescriptions as needed. For that, I pay a membership fee of $199 a year.

But I never took into account the possibility that Amazon may one day own One Medical.

The same company that sends me countless boxes every week, peppers my Kindle with book recommendations and my smart TV with film suggestions, tells my kids the weather forecast when they call Alexa, and offers Prime discounts when I shop at Whole Foods is about to provide my medical services and own the portals containing my most sensitive information.

I’m not the only person who had this deeply concerning thought on Thursday after waking up to the news that Amazon had agreed to buy One Medical for about $3.9 billion. At $18 a share, Amazon is paying a 77% premium to where the primary care company was valued a day earlier.

As one member wrote on Twitter, “After a broadly positive experience with One Medical, I cancelled membership today. I do not trust Amazon to act in good faith with my health data.”

Founded in 2007 and based in San Francisco, One Medical offers clinical services in 16 U.S. markets, with three more coming soon, according to its website. At the end of last year, the company had 736,000 members.

Amazon did little to calm my fears with its acquisition announcement. The company said nothing to provide One Medical customers with any comfort, and there was no conference call discussing the acquisition, as is customary with many large transactions. Closure of the deal will require regulatory approvals.

In response to an inquiry for this story, Amazon did offer the minimum level of assurance that it will abide by government regulations, under the Health Insurance Portability and Accountability Act (HIPAA), that limit how the company can use protected health information, or PHI. That includes all personally identifiable information as well as medical history, lab test results and other health data.

“As required by law, Amazon will never share One Medical customers’ personal health information outside of One Medical for advertising or marketing purposes of other Amazon products and services without clear permission from the customer,” an Amazon spokesperson said in an email. “Should the deal close, One Medical customers’ HIPAA Protected Health Information will be handled separately from all other Amazon businesses, as required by law.”

In other words, everything One Medical knows about me is supposed to stay in that safeguarded silo. Whatever profile Amazon has built on me and my family, from our shopping habits and travel preferences to the shows we watch together on weekends, will not commingle with my health data.

Despite the laws, Amazon will have to work hard to convince consumers — and likely politicians — that its intentions are pure and its main goal is to help “dramatically improve the healthcare experience over the next several years,” as Amazon Health Services lead Neil Lindsay said in the news release announcing the deal.

After all, alongside its gargantuan retail and cloud divisions, Amazon has built a highly profitable advertising business that generated over $31 billion in revenue last year and grew 58%. Most of that money comes from brands paying big bucks to promote their products on Amazon’s properties, where competing for eyeballs is getting pricier.

Amazon controls roughly 13% of the U.S. online ad market, trailing only Google and Facebook, according to Insider Intelligence.

“I don’t think there is anything Amazon could do to make people trust the company with their healthcare information,” said Caitlin Seeley George, campaign director for Fight for the Future, an advocacy group focused on technology and digital rights.

Seeley George said in an email that the issue of health privacy is particularly important after the Supreme Court’s overturning of Roe v. Wade, which ended the constitutional right to an abortion. Certain decisions related to reproductive health that were, until very recently, protected by law can now potentially be considered illegal.

Amazon has already limited sales of emergency contraceptive pills after demand spiked following the Supreme Court’s ruling. And Google said it will work to quickly delete location history for people going to abortion sites.

“Pushing forward into healthcare raises some serious red flags, especially in the post-Roe reality where peoples’ data can be used to criminalize their reproductive healthcare decisions,” Seeley George said.

Seeley George also wonders if, outside of HIPAA regulations, Amazon could roll out a fertility-tracking or mental health app and collect information that “can be used to create assumptions about an individual that could be used against them.”

Amazon already has a health tracker called Halo that gathers information such as body fat percentage, activity levels and sleep.

Amazon bought online pharmacy PillPack in 2018 for $750 million and launched Amazon Pharmacy two years later. The company has been investing in a telehealth service called Amazon Care, which launched as a pilot for some employees in 2019 and is now available for other employers to offer as a service to their staff.

Deena Shakir, a partner at venture firm Lux Capital and investor in numerous health-tech startups, noted that for Amazon, this is “not their first rodeo in healthcare.”

“Amazon is keenly aware of how to handle HIPAA considerations and have experience across multiple products with this,” Shakir wrote in an email. This type of deal “should encourage additional partnership between larger companies and major health tech players,” she wrote.

Shakir’s firm is an investor in Carbon Health, which offers primary care and urgent care facilities in 16 states. The company serves about 1.1 million patients and, compared to One Medical, is typically targeting a less affluent demographic.

Carbon Health CEO Eren Bali agrees with Shakir that Amazon is deeply restricted in how it can use the data. Relative to other big tech companies such as Facebook and Google, he says Amazon receives a fair amount of trust from consumers.

But Bali understands why concern may exist. Medical care companies have vast amounts of personal data, including Social Security numbers, drivers license numbers and insurance cards on top of all the health information in their systems. Patients are much more willing to hand over personal information to doctors and nurses than to other types of service providers.

And while there are strict regulations for how that data can be used, consumers can reasonably ask what happens if a company like Amazon were to break the rules.

“There unfortunately aren’t strong technical solutions to enforce data access, which is a big weakness,” Bali said, in an interview. Whether patients should worry about that is a “personal decision,” he said.

Bali is generally bullish on Amazon’s jump into the space. When Amazon makes a splashy announcement indicating its arrival into an old market with big incumbents, the existing players find themselves forced into action to avoid getting wiped out, Bali said.

He cited Amazon’s purchase of PillPack as an example. While Amazon has struggled to gain traction in the pharmacy business, entering the market pushed companies such as Walgreens and Walmart to bolster their digital offerings in ways that are beneficial to consumers, Bali said. The One Medical deal could similarly spark improved products and services in the world of primary care.

“Large companies don’t usually feel threatened from small startups,” Bali said. “But they’re really threatened by Amazon.”

— CNBC’s Annie Palmer contributed to this report.

WATCH: Amazon’s deal with One Medical is part of an ‘option package’