Privacy campaigners have called for the government to explain how it will protect sensitive patient information after the government announced that Amazon Alexa will be used to provide health information from the NHS website.
The devices will analyse information from the NHS website to provide answers to voice questions about conditions and treatment, which the government hopes will reduce the pressure on the NHS and GPs.
Health secretary Matt Hancock called the partnership a “great example of how people can access reliable, world-leading NHS advice from the comfort of their home”, but provided no details on how the data would be protected or how Amazon could use it.
The American company is known to store and analyse data collected by Alexa, which has already led to a number of data breaches. These include sending 1,700 Alexa recordings to the wrong person, recording private conversations and sending them to another user, and being used by Amazon employees to eavesdrop on users.
The risks of similar incidents involving sensitive healthcare information are particularly unsettling to campaigners. Phil Booth, coordinator of medConfidential, told Techworld that the deal could also involve transferring data to the US, where there is no overarching data protection regulation equivalent to GDPR and where foreigners don’t receive the same protections as US citizens.
“In terms of sorting it out, two things would need to happen,” he said. “Number one, the US would have to bump its data protection up to the level of equivalent to GDPR. The second one is that they would have to put in legislation to respect the data of non-US citizens as if they were US citizens.”
Booth called for the NHS to publish its full agreement with Amazon and questioned why it had entered into a partnership with the company when it could allow every vendor to develop a similar service by publishing all the relevant metadata they needed.
“Why is it that they have chosen to boost Amazon and give them a potentially lucrative reputational bump, instead of simply adding metadata to the canonical medical answers that they publish on their website? That would be the sensible thing,” he said.
“If they say they’re not making exclusive deals, make it available for everyone. Just literally put the metadata on so that a search function, whether it’s voice, or Google, or what have you, can find that NHS answer and confirm it.”
Hancock argued in a statement that the deal with Amazon supports a pledge made in the government’s NHS Long Term Plan to make more healthcare services available digitally.
NHSX CEO Matthew Gould added that consumer tools developed in the private sector would help citizens access services and information directly.
“The public need to be able to get reliable information about their health easily and in ways they actually use,” he said. “By working closely with Amazon and other tech companies, big and small, we can ensure that the millions of users looking for health information every day can get simple, validated advice at the touch of a button or voice command.”
Labour deputy leader Tom Watson rebuffed these arguments in a tweet.
“The giant data monopolies want one thing: more and more data to drive their huge profits,” he said. “Entrusting Amazon’s Alexa to dispense health advice to patients simply opens the door to the holy grail – our NHS data. This is the beginning of a Mission Creep.”
Booth was sceptical about claims that the deal could lead to the privatisation of NHS patient data, but reiterated his concerns about offering Amazon a unique commercial opportunity.
“The NHS doesn’t contain within itself every single expertise that is required to deliver a national health service, so there’s nothing inherently about this that is privatisation,” he said. “It’s the perception that if all it would take is to put some metadata on the NHS UK website, why are they not doing that, rather than giving Amazon a huge reputational boost by publicly hooking up with Alexa?
“Is Alexa going to be training up by all these questions that people ask? If it is, does the NHS get a copy of the intellectual property that they have generated, or does Amazon just get to exploit it even more? That’s not people’s medical records being sent to a private company or anything, it’s just setting a situation up where the NHS is encouraging people to use a particular commercial device that will [enable] profit – and not necessarily in the simplistic ways of selling the data.”