Amazon.com Inc.’s (AMZN) acquisition of PillPack gives it more than just an entrance into the pharmacy market, it also turns the retail giant into a holder of personal and sensitive healthcare data which means more regulation than it’s used to.
With the acquisition of PillPack, Amazon will know even more about consumers around the U.S. While all the data it culls on people is valuable to its business and to all sorts of advertisers, the e-commerce giant will have to tread carefully with healthcare data or risk the ire of regulators. According to the Wall Street Journal, the restrictions put on healthcare data and the steps companies have to go through to protect it are different than how Amazon has to handle data on, say, consumers’ shopping preferences. The last thing the e-commerce giant wants is to raise privacy concerns. (See more: Amazon Buys PillPack—Rx Chain Stocks Lose Billions.)
HIPPA Restricts The Sharing Of Patient Data
According to the Wall Street Journal, although marketers are free to share data on nonprescription purchases as well as on browsing activity, the federal government restricts the sharing of medical data under the Health Insurance Portability and Accountability Act, or HIPAA. Under that rule, companies can’t sell data on patients to a third party or market complementary services based on a patient's medical condition. HIPAA does let companies share information if the patient gives their consent. Ryan Stark, senior HIPPA and privacy attorney at Harrisburg, Pennsylvania's Page, Wolfberg & Wirth, told the Wall Street Journal that Amazon may have to keep PillPack separate from its e-commerce operation or take steps to make sure every aspect of Amazon’s business meets the privacy standards of the federal government. A spokeswoman for Amazon told the paper the company will comply with all rules and regulations including HIPAA.
Citing people familiar with the matter the Wall Street Journal noted that Amazon paid about $1 billion in cash for PillPack, beating out Walmart Inc. (WMT) in the process. With the deal, Amazon can ship medicines to customers in 49 states which means it will gather a lot of information on patients. (See more: Amazon's Latest Disruption: Prime Rx Deliveries.)
Lawmakers Getting Tougher On Data Privacy
Amazon’s deal comes as lawmakers are getting tougher on how tech companies handle the data on consumers. California just passed a new data privacy law that kicks off in 2020, giving consumers the right to know what information companies are collecting, why they are doing it and who they are sharing it with. Customers can also tell companies to get rid of information on them and to not share their data with third parties. Businesses are required to provide the same level of service even if customers opt out of sharing their data with the company.