Amazon Rolls out HIPAA Compliant Alexa Service with Boston Children’s, Swedish, and Atrium Hospital Systems, Cigna, and Express Scripts
Amazon announced today in a blog post that is has deployed an Alexa service for healthcare providers compliant with protections outlined in the U.S. Health Insurance Portability and Accountability Act (HIPAA) of 1996. The post says that Alexa Skills Kit (ASK) can now support “select Covered Entities and their Business Associates” as defined by HIPAA. The announcement names six new healthcare Alexa skills available today that employ the new HIPAA service. Amazon’s blog post includes the following summary of the new Alexa skills:
- Express Scripts (a leading Pharmacy Services Organization): Members can check the status of a home delivery prescription and can request Alexa notifications when their prescription orders are shipped.
- Cigna Health Today (by Cigna, the global health service company): Eligible employees with one of Cigna’s large national accounts can now manage their health improvement goals and increase opportunities for earning personalized wellness incentives.
- My Children’s Enhanced Recovery After Surgery (ERAS) (by Boston Children’s Hospital, a leading children’s hospital): Parents and caregivers of children in the ERAS program at Boston Children’s Hospital can provide their care teams updates on recovery progress and receive information regarding their post-op appointments.
- Swedish Health Connect (by Providence Health, a healthcare system with 51 hospitals across 7 states and 829 clinics): Customers can find an urgent care center near them and schedule a same-day appointment.
- Atrium Health (a healthcare system with more than 40 hospitals and 900 care locations throughout North and South Carolina and Georgia): Customers in North and South Carolina can find an urgent care location near them and schedule a same-day appointment.
- Livongo (a leading consumer digital health company that creates new and different experiences for people with chronic conditions): Members can query their last blood sugar reading, blood sugar measurement trends, and receive insights and Health Nudges that are personalized to them.
The HIPAA service and ASK tools for developing healthcare-related skills is not yet generally available. However, you can register with Amazon to receive updates as the program expands. The form asks for the type of healthcare-related application that the developer plans to deploy in addition to contact details so it is not for general, but rather specific inquiries. This also suggests the HIPAA Alexa service may be limited for some time.
Protected Health Information is the Challenge for Voice Assistants
The HIPAA protections that have thus far prevented many healthcare applications from migrating to Alexa involved “protected health information” which is any health information that could be tied to an individual. This not only includes health records information but is expansive enough to cover scheduling doctor appointments. Alexa Champion and developer Mark Tucker ran directly into these constraints while building a skill for Mercy health system during his time at VoiceXP and as an independent developer with one of his clients in Arizona. Tucker commented this morning about the announcement:
“Having worked with two healthcare companies on Alexa skills, I have spent hours in discussions with Amazon about what meets HIPAA compliance and workarounds until this HIPAA-eligible environment was available. This has been a moving target as legal was involved. This new environment will mark the starting point of many, great healthcare experiences.”
In building the skill for Mercy, the VoiceXP team could not book an appointment with a medical professional directly so they enabled the user to request a text message which then would lead to a HIPAA-compliant path for the task. The skill could not even use the term “schedule” without running afoul of Alexa certification restrictions. The new solution obviously overcomes those limitations as both Swedish Health Connect and Atrium enable appointment scheduling when using the HIPAA Alexa service. Bob Stolzberg, VoiceXP founder and CEO, commented:
“As a professional skill builder for enterprises such as Mercy and Banner Health, we are excited that Amazon kept their promise to deliver a HIPAA-compliant solution. This is the official green light our customers and healthcare companies have been waiting for to deep-dive into voice technology.”
A Long Time in the Making
The new HIPAA compliant Alexa solution has been a long time in the making. A CNBC report in May 2018 revealed that Amazon had created a health and wellness team focused on enabling health care applications through Alexa. The articles stated at the time:
“The team’s main job is to make Amazon’s Alexa voice assistant more useful in the health-care field, an effort that requires working through regulations and data privacy requirements laid out by HIPAA (the Health Insurance Portability and Accountability Act), according to people familiar with the matter.”
Voicebot has learned that the HIPAA-related efforts date back to at least November 2017. A key challenge was how the company could restrict Amazon employee access to utterance and speech-to-text transcripts of what users were saying to Alexa that were covered under the PHI definition.
An Additional Process for Developers
Amazon indicated today that access to the HIPAA Alexa service will remain invitation only for some period of time. The company expects to learn from that experience and determine how to make it more broadly available in the future. That does not mean this service will ever be generally available. It is invite-only today and there is no commitment to how it will operate in the future. Also, developers that are approved for using the HIPAA Alexa service will need to go through some extra steps for certification. An Amazon spokesperson commented:
“Once the skill has been developed and tested, it must then pass Amazon Alexa certification. As you know, skill certification is a review process that covers several topics to ensure a positive experience for users, including evaluating skill functionality, confirming the skill meets certain policy guidelines, and security requirements, among other things. There are additional requirements for Healthcare skills, including that the developer must sign the Alexa Skills HIPAA BAA.”
Despite the limited rollout today, this is a significant milestone for both Alexa and voice assistants in general in regards to healthcare. HIPAA restrictions around PHI have to date significantly circumscribed what assistants can do in healthcare unless they were custom solutions. The problem with custom solutions is that they are not in use today by 66 million U.S. adults like smart speakers. A special program for Alexa around HIPAA can help to bridge that gap between broad consumer reach and healthcare related functionality.