In Part I, we covered why HIPAA can't be counted on to protect your family's medical data. The law is narrow, the records are permanent, and the systems holding them get breached at industrial scale.

We're now going to dissect the company assembling the most complete medical data operation in history. It's not a hospital system or an insurer. It's the same company that sells you toilet paper in bulk and suggests what to watch on Tuesday nights.

Amazon is buying healthcare one piece at a time, and if you have kids, the pitch is aimed directly at you.

The Land Grab

If you haven't followed Amazon's healthcare moves, the timeline is worth taking a look at:

Amazon now owns: the diagnosis layer (primary care, labs, virtual visits), the treatment layer (pharmacy and delivery), and the intelligence layer sitting on top of both, stitched together with its own cloud and AI infrastructure. They've also folded it all into Prime. A One Medical membership runs $99 a year for Prime members — putting healthcare in front of 167 million US Prime households. Your kid's pediatric care is now a Prime perk.

This isn't a healthcare company adding technology. This is a commerce giant that bought healthcare infrastructure.

Health AI: The Agentic Assistant

The newest piece of infrastructure deserves specific attention. Health AI launched to One Medical members in January 2026 after a beta through 2025. It's built on Amazon's Bedrock — which means it's an agentic AI, designed not just to answer questions but to take actions like connect you to providers, review lab results, manage medications, and book appointments on your behalf.

Neil Lindsay, senior VP of Amazon Health Services, was disarmingly frank at launch: 'The U.S. health care experience is fragmented, with each provider seeing only parts of your health puzzle.' Health AI, he explained, 'brings together all the pieces of your personal health information.' Strip the marketing out of that and here's what it describes: Health AI ingests your One Medical visit notes, your lab results, your medication history, your Amazon Pharmacy records — and, with your permission, pulls in records from your other doctors, hospitals, and previous providers. Fragmented data, assembled by one company.

For a parent, this might sound genuinely seductive. Describe your kid's rash, get triage at 11pm, renew a prescription, book the follow-up — all without waiting on hold with a pediatrician's office. We all know healthcare logistics are miserable, and Amazon is better than most at making miserable logistics pleasant.

But the thing to keep in mind is that the aggregation is the product. Every one of those interactions builds a consolidated medical profile inside a company whose core competency is behavioral prediction. They are taking the same strategy they use to "optimize" your shopping experience and applying it to your family's health.

The Ecosystem Problem

Amazon's answer to privacy concerns is consistent and, on its face, sounds reasonable: One Medical and Amazon Pharmacy operate as a HIPAA-covered entity, protected health information stays out of advertising, and health data isn't merged with your retail shopping profile.

Three things are worth noticing about that.

First, remember what "HIPAA-covered" actually protects after reading Part I. The covered entity designation constrains how Amazon handles Protected Health Information, but HIPAA also permits de-identification — stripping identifiers so data can be used for other purposes. Former FTC Commissioner Alvaro Bedoya made this exact point when the FTC warned Amazon and One Medical after the acquisition: when a company says it abides by HIPAA, "it does not mean that they cannot use your data for other purposes. Rather, it means they must simply remove from that data certain markers that would tie that data back to you." De-identification is reversible more often than people assume.

Second, the buckets are blurrier than the marketing. Amazon's own consumer health data disclosure — filed to comply with Washington's My Health My Data Act and Nevada's equivalent — catalogs what the broader Amazon ecosystem collects as "consumer health data": health insurance information, allergy information you might share with Alexa's emergency features, data related to injuries and claims. That's health data that never touches a covered entity, governed by privacy policies rather than HIPAA. The same parent company operates both buckets.

Third, consent is doing heavy lifting. When you sign up for treatment through Amazon's health services, you authorize the participating providers, pharmacies, and labs to share your PHI with Amazon Health Services. But here's the key part: Amazon has designated itself a single covered entity combining One Medical, PillPack, and Amazon Pharmacy. The separate companies you authorized became one company. The FTC told Amazon and One Medical directly after the acquisition that their privacy commitments are promises under consumer protection law — enforceable, but written by Amazon. The takeaway: your privacy here depends on Amazon choosing to honor its own commitments. The law provides a leash, not a wall.

For what it's worth, Amazon says it doesn't sell health data, that customers can request deletion, and that it applies HIPAA-level safeguards even where HIPAA doesn't strictly require them. I don't doubt their current sincerity and my concern isn't the policy today, but the incentive gradient forever.

The Halo Ghost

If you want a preview of how Amazon handles intimate health data over time, there's precedent, and it cuts both ways.

In 2020, Amazon launched Halo — a health band that did things consumer devices had never done: 3D body scans via smartphone camera, and tone-of-voice analysis that continuously judged how you sounded to other people. Privacy researchers and Senator Amy Klobuchar raised formal alarms about the sheer intimacy of the data — body composition imagery, voice affect, emotional state inferred from acoustics.

Amazon killed the Halo line in 2023 and — to their credit — followed through on deleting the associated health data, completing that deletion on a published schedule. Plenty of companies promise deletion and quietly keep the backups. Amazon didn't, but that's only half the story. They built Halo in the first place, spending years collecting body scans and voice-tone analysis at population scale, because they wanted to be in that business. The exit wasn't a conscience moment — it was a failed business. The willingness was always there. The profitability wasn't.

Healthcare has a much stickier business case than wearables. Whatever Amazon learns here, they won't walk away from it like they did with Halo.

Alexa in the Exam Room

One layer sits closer to home: Alexa. Amazon has signed the agreements that allow Alexa to participate in HIPAA-covered scenarios — medication reminders, telehealth interactions, and emergency assist features. Your kitchen speaker is now legally permitted to handle protected health information in certain configurations.

Most ordinary Alexa use isn't HIPAA-covered at all. Health questions you shout at a smart speaker, symptoms you describe while making dinner — that's consumer data, governed by the same privacy notice that covers asking Alexa to reorder laundry detergent. The line between "my assistant at the doctor's office" and "the microphone on my counter" is a terms-of-service distinction, not a physical one.

I'm not saying you should throw away your Echo (though it's not a bad idea). But you need to understand that voice is now one of the inputs into a health data ecosystem, and the protections depend in which contractual arena the conversation took place.

The Neurodivergent Lens

One Medical advertises behavioral and mental health support, chronic condition management, and pediatric care. For Neurodivergent families, that's often the care they need most — and it means the most sensitive data of all flows through this ecosystem. Therapy conversations, medication trials, developmental histories, and behavioral notes.

Remember the psychiatrist from Part I who deliberately keeps certain "diagnoses" out of official records to protect patients from the system itself? Now the system being weighed is owned by a conglomerate of unprecedented scale. The calculus for what you disclose, to whom, and through whose app — it just changed. For Neurodivergent kids whose care generates long behavioral documentation trails, consolidation under a commerce umbrella deserves extra scrutiny.

What This Means for Families

Amazon isn't doing anything illegal here — and that's the point. Part I showed you the regulatory gaps. This is what exploiting the gaps legally looks like.

For a busy parent, the one-app healthcare experience is a rational choice. Some families will weigh it and use it anyway. If that's you, here's how to do it with your eyes open:

Separate the convenience from the consolidation. You can use Amazon Pharmacy for a prescription without moving your kid's primary care into the ecosystem. Every service you add is another data stream under one roof. Decide which ones are worth it.

Read what you're actually authorizing. Before signing up, look at the authorization language — which entities you're permitting to share information, and with whom. Amazon's privacy pages spell it out, but almost nobody reads them. This is one area where it's worth the time to do so.

Mind the household perimeter. Caregiver accounts, family memberships, Alexa emergency features, kids' pharmacy profiles — the whole family folds into one login perimeter. Convenient, but it also means one account compromise exposes everyone.

Watch what an AI assistant gets told. If you use Health AI or anything like it, assume the conversations are part of an (inalterable) medical record. Symptom descriptions, concerns, late-night worries about your kid's behavior — think about whether you'd want those words in a permanent file.

Ask the de-identification question. It's fair to ask any health provider: is de-identified data used for product improvement, analytics, or research? The answer shapes what "private" means for you.

The reality is that none of this will stop at Amazon. Google, Apple, and Microsoft are circling the same territory. The question here isn't whether Big Tech gets into your family's medical records — it's already happening. The question is whether the protections catch up before the data is fully consolidated, or a decade after — and the window is closing fast.