Amazon's Acquisition of One Medical: The Lack of Health Data Regulation in the Age of Big Tech

Amazon's acquisition of One Medical raises concerns about the lack of regulation surrounding health data in the age of big tech. Patient health information is highly sensitive, and while Amazon and One Medical claim to handle it in compliance with HIPAA, there are loopholes in the law that allo...

Full description

Saved in:
Bibliographic Details
Published inFederal communications law journal Vol. 76; no. 2; pp. 217 - 238
Main Author Gasca, Angela M
Format Journal Article
LanguageEnglish
Published Washington The George Washington University Law School 01.01.2024
George Washington University, National Law Center
Subjects
Acquisitions and mergers
Antitrust law
Companies
Compliance
Consumer protection
Data
Data entry
Data integrity
Data security
Electronic commerce
Evaluation
Health
Health care
Health informatics
High technology industry
Laws, regulations and rules
Medical records
Patients
Privacy, Right of
Regulation
Safety and security measures
Online AccessGet full text

Cover

More Information
Summary:Amazon's acquisition of One Medical raises concerns about the lack of regulation surrounding health data in the age of big tech. Patient health information is highly sensitive, and while Amazon and One Medical claim to handle it in compliance with HIPAA, there are loopholes in the law that allow for the disclosure of this information. Current HIPAA regulations did not anticipate the entry of powerful ecommerce companies into the healthcare space. The acquisition of One Medical by Amazon gives the tech giant access to highly sensitive health data, which can be used for revenue generation and fueling Amazon's growth. HIPAA does not adequately protect patient health information in the hands of major tech companies. The FTC Act, specifically Section 5, provides some regulation over the misuse of health data by nonclinical entities. However, there is a need for proactive measures to regulate the acquisition of sensitive health data at the pre-merger stage. The FTC, as the established US data protection authority, should exercise its enforcement powers to fill this regulatory gap. Additionally, the Hart-Scott-Rodino Act could be amended to address the collection of personal data by major tech companies.
ISSN:0163-7606
2376-4457