Vox: Amazon is using my grocery purchases to sell me prescription drugs

As far as I know, Amazon can. HIPAA, the federal law that protects health privacy, is narrower than most people think. It only applies to health care providers, insurers, and companies that manage medical records. HIPAA requires those entities to protect your data as it moves between them, but it wouldn’t apply to your Amazon purchases, according to Suzanne Bernstein, a legal fellow at the Electronic Privacy Information Center (EPIC). 

“That background is especially important, as Amazon and other companies continue to collect, process, and use tremendous amounts of consumer health data that falls outside of HIPAA scope,” Bernstein said. “And it’s not the fault of American consumers for not necessarily knowing all that.” 

In the absence of any federal protections, some states have passed their own data privacy laws. While California is perhaps most famous for giving its citizens more control over their data, Washington state changed the conversation around health data privacy when it enacted its My Health My Data Act last year. This law defines consumer health data much more broadly, Bernstein explained, so that any information about a consumer’s past, present, or future health conditions is covered. That might mean that Washington residents have the right to some privacy when their Amazon purchases indicate a health condition. It’s so far unclear how the law might apply to Amazon, which is based in Washington. 

Read more here.