Georgetown Law
Technology Review

After creating one of the world’s most profitable companies1Fortune Reveals America’s Top 500 Companies, CBS NEWS, https://www.cbsnews.com/news/fortune-500-revealed-2017-list-revenue-largest-corporations (last updated June 7, 2017, 10:40 AM). and moving into the online food space just last year,2E.g., Lisa Eadicicco, Why Amazon Bought Whole Foods, TIME (June 22, 2017), http://time.com/4828082/why-amazon-bought-whole-foods. Amazon CEO Jeff Bezos’s latest move is into the healthcare industry. In an announcement made at the end of January, Amazon, JPMorgan Chase, and Berkshire Hathaway announced a new agenda to create a “fully independent” healthcare company that is “free from profit-making incentives and constraints.”3Darrell Etherington, Amazon, JPMorgan and Berkshire Hathaway to Build Their Own Healthcare Company, TECHCRUNCH (Jan. 30, 2018), https://techcrunch.com/2018/01/30/amazon-jpmorgan-and-berkshire-hathaway-to-build-their-own-healthcare-company. As a starting point, these companies intend to create a healthcare company that serves their employees and their families,4See Nick Wingfield, Katie Thomas & Reed Abelson, Amazon, Berkshire Hathaway and JPMorgan Team Up to Try to Disrupt Health Care, N.Y. TIMES (Jan. 30, 2018), https://www.nytimes.com/2018/01/30/technology/amazon-berkshire-hathaway-jpmorgan-health-care.html. but Jamie Dimon, CEO of JPMorgan Chase, has already expressed hopes to cover “potentially, all Americans.”5Etherington, supra note 3.

The potential for this new venture to disrupt the market is already a topic of discussion in the healthcare industry. Although UnitedHealthcare Group, Inc. is disclaiming that Amazon will be a “competitive threat,”6Emma Court, UnitedHealth Earnings: Insulated from Obamacare, Amazon and Still Going Strong, MARKETWATCH (Oct. 17, 2017, 5:23 AM), https://www.marketwatch.com/story/unitedhealth-earnings-insulated-from-obamacare-amazon-and-still-going-strong-2017-10-13. the New York Times has surmised that Amazon, JP Morgan Chase, and Berkshire Hathaway are likely to serve as a model for other large corporations—if their venture is successful.7See Wingfield, Thomas & Abelson, supra note 4. Further, Amazon is not new to healthcare and likely has a substantial knowledge base of medical trends and data, given that the federal government starting utilizing Amazon web services in 2014 to collect medical data from insurers under the Affordable Care Act.8See Blair Hanley Frank, Feds Say Amazon’s Cloud Can Now Host Key Obamacare Data, GEEKWIRE (June 5, 2014, 10:37 AM), https://www.geekwire.com/2014/feds-say-amazons-cloud-can-now-host-important-obamacare-data; Dan Mangan, Feds Shift Obamacare Data Tech to Amazon, CNBC, https://www.cnbc.com/2014/06/04/feds-shift-obamacare-data-tech-to-amazon.html (last updated June 5, 2014, 11:09 AM). Despite this, Bezos is not blind to the “degree of difficulty” a venture of this kind will take; rather, he believes his two-part goal of  “reducing healthcare’s burden on the economy [and] improving outcomes for employees and their families [will] be worth the effort.”9Etherington, supra note 3.

This new venture and new approach to healthcare appears to be a product of a dysfunctional healthcare industry, as defined by the questionable stability of the Affordable Care Act and the ever increasing costs of healthcare nationwide.10 Court, supra note 6;See, e.g., Wingfield, Thomas & Abelson, supra note 4. But tech companies are taking advantage of these issues and finding opportunities where they already have large amounts of consumer healthcare data, an abundance of capital, and the potential for new partnerships with existing healthcare providers.11Sam Glick & Terry Stone, InfoGraphic: What the HealthCare Industry Can Expect in 2018, OLIVER WYMAN HEALTH (Feb. 2, 2018), http://health.oliverwyman.com/transform-care/2018/02/infographic_the_yea.html. Moreover, tech companies are not limiting their opportunities to break into this market as healthcare providers. For example, Google hosts one of the world’s largest databases,12Top 10 Largest Databases in the World, COMPARE BUS. PRODUCTS, https://www.comparebusinessproducts.com/fyi/10-largest-databases-in-the-world (last updated Mar. 17, 2010) (stating that Google averages ninety-one million searches per day, which has likely grown substantially since the article was written). collecting and analyzing trillions of data entries.13Id. Unsurprisingly, a large number of searches, at least five million per day,14Jennifer Lannon, Trends that Emerged from J.P. Morgan Week 2018, PM360 (Jan. 23, 2018) https://www.pm360online.com/trends-that-emerged-from-j-p-morgan-week-2018 (stating 5.5% of Google searches are health related; if there are ninety-one million Google searches per day, then more than five million health-related Google searches occur, on average, in a given day). are health-related questions. The ability to turn this data into a value-added commodity for consumers is already being demonstrated, from Google Home’s ability to provide pollen count and allergy forecasts15Id. to Google-acquired, artificial intelligence company DeepMind’s partnership with the Royal Free London National Health Service to provide “real time clinical analytics, detection, diagnosis and decision support” to doctors.16Eerke Boiten, Google Is Now Involved with Healthcare Data, Is that a Good Thing?, CONVERSATION (May 5, 2016 9:00 AM), http://theconversation.com/google-is-now-involved-with-healthcare-data-is-that-a-good-thing-58901.

The growing amount of medical data collected by technology companies also raises questions of HIPAA’s legal sufficiency to regulate the collection and use of medical information. While the new Amazon, JPMorgan Chase, Berkshire Hathaway venture falls squarely within the definition of a covered entity under17U.S. Dep’t of Health and Human Servs., Covered Entities and Business Associates, HHS.GOV, https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html (defining a covered entity as a healthcare provider, a health plan, or a healthcare clearing house) (last reviewed June 16, 2017). the HIPAA Privacy Rule,18HIPAA Privacy Rule, 45 C.F.R. § 164.506 (2013). which sets standards regarding consent and disclosure for both covered entities and business associates,19U.S. Dep’t of Health and Human Serv., Business Associates, HHS.GOV, https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html (last reviewed July 23, 2013) (defining a business associate as “a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity”) (emphasis added). many other tech companies and services will not fall within the scope of HIPAA’s protection. Rather, two major limitations of the law give rise to concerns about blindly sharing healthcare data: (1) HIPAA does not provide a private right of action for individuals affected by breaches in privacy,20E.g., Robert Denny, HIPAA Permits State Law Actions for Breach of Confidentiality, ABA (Mar. 2, 2015), https://apps.americanbar.org/litigation/litigationnews/top_stories/030215-hipaa-disclosure.html. and (2) the innovations in technology by various companies that are not covered entities and perform functions that do not support covered entities escape the governance of HIPAA’s privacy rule altogether.21See e.g., CENT. FOR DEMOCRACY AND TECH., WHY THE HIPAA PRIVACY RULES WOULD NOT ADEQUATELY PROTECT PERSONAL HEALTH RECORDS (Sept. 2008), https://www.cdt.org/files/pdfs/HIPAA-PHRs_0.pdf; Kim Stranger, Avoiding Business Associate Agreements, HEALTH LAW BLOG (Nov. 26, 2013), http://www.hhhealthlawblog.com/2013/11/avoiding-business-associate-agreements.html. Thus, although HIPAA provides some semblance of protection for healthcare data when it is held by a covered entity or business associate, the gap is widening between who has access to healthcare data and how much of that data is protected from disclosure by the emergence of tech companies in the healthcare industry.