The contract between the UK’s National Health Service (NHS) and ecommerce large Amazon — for a well being data licensing partnership involving its Alexa voice AI — has been launched following a Freedom of Information request.
The authorities introduced the partnership this summer season. But the date on the contract, which was revealed on the gov.uk contracts finder web site months after the FOI was filed, exhibits the open-ended association to funnel nipped-and-tucked well being information from the NHS’ web site to Alexa customers in audio kind was inked again in December 2018.
The contract is between the UK authorities and Amazon US (Amazon Digital Services, Delaware) — reasonably than Amazon UK. Although the corporate confirmed to us that NHS content material will solely be served to UK Alexa customers.
Nor is it a regular NHS Choices content material syndication contract. A spokeswoman for the Department of Health and Social Care (DHSC) confirmed the authorized settlement makes use of an Amazon contract template. She instructed us the division had labored collectively with Amazon to adapt the template to suit the supposed use — i.e. entry to publicly funded healthcare data from the NHS’ web site.
The NHS does make the identical data freely accessible on its web site, in fact. As effectively as by way of API — to some 1,500 organizations. But Amazon is not only any group; It’s a strong US platform large with an enormous ecommerce enterprise.
The contract displays that energy imbalance; not being a regular NHS content material syndication settlement — however reasonably DHSC tweaking Amazon’s customary phrases.
“It was drawn up between both Amazon UK and the Department for Health and Social Care,” a division spokeswoman instructed us. “Given that Amazon is in the business of holding standard agreements with content providers they provided the template that was used as the starting point for the discussions but it was drawn up in negotiation with the Department for Health and Social Care, and obviously it was altered to apply to UK law rather than US law.”
In July, when the federal government formally introduced the Alexa-NHS partnership, its PR offered just a few pattern queries of how Amazon’s voice AI would possibly reply to what it dubbed “NHS-verified” data — reminiscent of: “Alexa, how do I treat a migraine?”; “Alexa, what are the symptoms of flu?”; “Alexa, what are the symptoms of chickenpox?”.
But in fact as anybody who’s ever googled a well being symptom may let you know, the sorts of stuff individuals are really more likely to ask Alexa — as soon as they notice they’ll deal with it as an NHS-verified info-dispensing robotic, and go down the symptom-querying rabbit gap — is more likely to vary very far past the frequent chilly.
At the official launch of what the federal government couched as a ‘collaboration’ with Amazon, it defined its determination to permit NHS content material to be freely piped via Alexa by suggesting that voice know-how has “the potential to reduce the pressure on the NHS and GPs by providing information for common illnesses”.
Its PR cited an unattributed declare that “by 2020, half of all searches are expected to be made through voice-assisted technology”.
This prediction is incessantly attributed to ComScore, a media measurement agency that was final month charged with fraud by the SEC. However it really seems to originate with laptop scientist Andrew Ng, from when he was chief scientist at Chinese tech large Baidu.
Econsultancy famous final yr that Mary Meeker included Ng’s declare on a slide in her 2016 Internet Trends report — which is probably going how the prediction acquired so broadly amplified.
But on Meeker’s slide you possibly can see that the prediction is the truth is “images or speech”, not voice alone…
So it seems the UK authorities incorrectly cited a tech large prediction to push a declare that “voice search has been increasing rapidly” — in flip its justification for funnelling NHS customers in the direction of Amazon.
“We want to empower every patient to take better control of their healthcare and technology like this is a great example of how people can access reliable, world-leading NHS advice from the comfort of their home, reducing the pressure on our hardworking GPs and pharmacists,” mentioned well being secretary Matt Hancock in a July assertion.
Since touchdown on the well being division, the app-loving former digital minister has been pushing a tech-first agenda for remodeling the NHS — promising to plug in “healthtech” apps and companies, and touting “preventative, predictive and personalised care”. He’s additionally introduced an AI lab housed inside a brand new unit that’s supposed to supervise the digitization of the NHS.
Compared with all that, plugging the NHS’ web site into Alexa in all probability looks as if a simple ‘on-message’ win. But instantly the collaboration was introduced considerations have been raised that the federal government is recklessly mixing the streams of essential (and delicate) nationwide healthcare infrastructure with the rapacious data-appetite of a international tech large, with each an promoting and ecommerce enterprise, plus main ambitions of its personal within the healthcare house.
On the latter entrance, simply yesterday information broke of Amazon’s second health-related acquisition: Health Navigator, a startup with an API platform for integrating with well being companies, reminiscent of telemedicine and medical name facilities, which provides pure language processing instruments for documenting well being complaints and care suggestions.
Last yr Amazon additionally picked up on-line pharmacy PillPack — for slightly below $1BN. While simply final month it launched a pilot of a healthcare service providing to its personal workers in and round Seattle, known as Amazon Care which seems to be supposed to be a road-test for addressing the broader U.S. market down the road. So the corporate’s industrial designs on healthcare have gotten more and more clear.
Returning to the UK, in response to early essential suggestions on the Alexa-NHS association, the IT supply arm of the service, NHS Digital, revealed a weblog publish going into extra element concerning the association — following what it couched as “interesting discussion about the challenges for the NHS of working with large commercial organisations like Amazon”.
A core essential “discussion” level is the query of what Amazon will do with individuals’s medical voice question information, given the partnership is clearly encouraging individuals to get used to asking Alexa for well being recommendation.
“We have stuck to the fundamental principle of not agreeing a way of working with Amazon that we would not be willing to consider with any single partner – large or small. We have been careful about data, commercialisation, privacy and liability, and we have spent months working with knowledgeable colleagues to get it right,” NHS Digital claimed in July.
In one other part of the weblog publish, responding to questions on what Amazon will do with the information and “what about privacy”, it additional asserted there could be no well being profiling of consumers — writing:
We have labored with the Amazon crew to make sure that we might be completely assured that Amazon is just not sharing any of this data with third events. Amazon has been very clear that it’s not promoting merchandise or making product suggestions based mostly on this well being data, neither is it constructing a well being profile on clients. All data is handled with excessive confidentiality. Amazon prohibit entry via multi-factor authentication, companies are all encrypted, and common audits run on their management atmosphere to guard it.
Yet it seems the contract DHSC signed with Amazon is only a content material licensing settlement. There aren’t any phrases contained in it regarding what can or can’t be completed with the medical voice question information Alexa is gathering with the assistance of “NHS-verified” data.
Per the contract phrases, Amazon is required to attribute content material to the NHS when Alexa responds to a question with data from the service’s web site. (Though the corporate says Alexa additionally makes use of medical content material from the Mayo Clinic and Wikipedia.) So, from the person’s perspective, they may at instances really feel like they’re speaking to an NHS-branded service (i.e. after they hear Alexa serving them data attributed to the NHS’ web site.).
But with none legally binding confidentiality clauses round what might be completed with their medical voice queries it’s not clear how NHS Digital can confidently assert that Amazon isn’t creating well being profiles. The state of affairs appears to sum to, er, belief Amazon. (NHS Digital wouldn’t remark; saying it’s solely liable for supply not coverage setting, and referring us to the DHSC.)
Asked what it does with medical voice question information generated on account of the NHS collaboration an Amazon spokesperson instructed us: “We do not build customer health profiles based on interactions with nhs.uk content or use such requests for marketing purposes.”
But the spokesperson couldn’t level to any legally binding contract clauses within the licensing settlement that prohibit what Amazon can do with individuals’s medical queries.
We additionally requested the corporate to verify whether or not medical voice queries that return NHS content material are being processed within the US. Amazon’s spokeswoman responded with no direct reply — saying solely that queries are processed within the “cloud”. (“When you speak to Alexa, a recording of what you asked Alexa is sent to Amazon’s Cloud where we process your request and other information to respond to you.”)
“This collaboration only provides content already available on the NHS.UK website, and absolutely no personal data is being shared by NHS to Amazon or vice versa,” Amazon additionally instructed us, eliding the important thing level that it’s not NHS information being shared with Amazon however NHS customers, reassured by the presence of a trusted public model, being inspired to feed Alexa delicate private information by asking about their illnesses and well being considerations.
Bizarrely, the Department of Health and Social Care went additional. Its spokeswoman claimed in an e-mail that “there will be no data shared, collected or processed by Amazon and this is just an alternative way of providing readily available information from NHS.UK.”
When we spoke to DHSC on the telephone previous to this, to boost the difficulty of medical voice question information generated by way of the partnership and fed to Amazon — additionally asking the place within the contract are clauses to guard individuals’s information — the spokeswoman mentioned she must get again to us. All of which suggests the federal government has a really imprecise concept (to place it generously) of how cloud-powered voice AIs perform.
Presumably nobody at DHSC bothered to learn the data on Amazon’s personal Alexa privateness web page — though the division spokeswomen was at the very least conscious this web page existed (as a result of she knew Amazon had pointed us to what she known as its “privacy notice”, which she mentioned “sets out how customers are in control of their data and utterances”).
If you do learn the web page you’ll discover Amazon provides some broad-brush clarification there which tells you that after an Alexa gadget has been woken by its wake phrase, the AI will “begin recording and sending your request to Amazon’s secure cloud”.
Ergo information is collected and processed. And certainly saved on Amazon’s servers. So, sure, information is ‘shared’. Not ‘NHS data’, however UK residents’ private information.
Amazon’s European Privacy Notice in the meantime, units out a laundry checklist of functions for person information — from enhancing its companies, to producing suggestions and personalization, to promoting. While on its Alexa Terms of Use web page it writes: “To provide the Alexa service, personalize it, and improve our services, Amazon processes and retains your Alexa Interactions, such as your voice inputs, music playlists and your Alexa to-do and shopping lists, in the cloud.” [emphasis ours]
The DHSC sees the matter very otherwise, although.
With no contractual binds overlaying health-related queries UK customers of Alexa are being inspired to whisper into Amazon’s robotic ears — information that’s naturally linked to Alexa and Amazon account IDs — the federal government is accepting the tech large’s customary information processing phrases for a industrial, shopper product which is deeply built-in into its more and more sprawling enterprise empire.
Terms reminiscent of indefinite retention of audio recordings. Unless customers pro-actively request that they’re deleted. And even then Amazon admitted this summer season it doesn’t at all times delete the textual content transcripts of recordings. So even in case you preserve deleting all of your audio snippets, traces of medical queries might effectively stay on Amazon’s servers.
On this, Amazon’s spokeswoman instructed us that voice recordings and associated transcripts are deleted when Alexa clients choose to delete their recordings — pointing to the Alexa and Alexa Device FAQ the place the corporate writes: “We will delete the voice recordings and the text transcripts of your request that you selected from Amazon’s Cloud”. Although in the identical FAQ Amazon additionally notes: “We may still retain other records of your Alexa interactions, including records of actions Alexa took in response to your request.” So it appears like some metadata round medical queries might stay, even post-deletion.
Earlier this yr it additionally emerged the corporate employs contractors all over the world to pay attention in to Alexa recordings as a part of inside efforts to enhance the efficiency of the AI.
Various tech giants lately admitted to the presence of such ‘speech grading’ applications, as they’re typically known as — although none had been up entrance and clear concerning the truth their shiny AIs wanted a military of exterior human eavesdroppers to drag off a present of fake intelligence.
It’s been journalists highlighting the privateness dangers for customers of AI assistants; and media publicity resulting in public strain on tech giants to power adjustments to hid inside processes which have, by default, handled individuals’s data as an owned commodity that exists to serve and reserve their very own company pursuits.
Data safety? Only in case you interpret the time period as that means your private information is theirs to seize and that they’ll aggressively defend the IP they generate from it.
So, in different phrases, precise people — each employed by Amazon immediately and never — could also be listening to the medical stuff you’re telling Alexa. Unless the person finds and prompts a lately added ‘no human review’ possibility buried within the Alexa app settings.
Many of those ‘speech grading’ preparations stay beneath regulatory scrutiny in Europe. Amazon’s lead information safety regulator in Europe confirmed in August it’s in discussions with it over considerations associated to its guide evaluations of Alexa recordings. So UK residents — whose taxes fund the NHS — is likely to be forgiven for anticipating extra care from their very own authorities round such a ‘collaboration’.
Rather than a wholesale swallowing of tech large T&Cs in change at no cost entry to the NHS model and “NHS-verified” data which helps Amazon burnish Alexa’s utility and credibility, permitting it to assemble helpful insights for its industrial healthcare ambitions.
To date there was no recognition from DHSC the federal government has an obligation of care in the direction of NHS customers as regards potential dangers its content material partnership would possibly generate as Alexa harvests their voice queries by way of a industrial conduit that solely affords customers very partial controls over what occurs to their private information.
Nor is DHSC contemplating the worth being generously gifted by the state to Amazon — in change for a imprecise supposition that just a few residents would possibly go to the physician a bit much less if a robotic tells them what flu signs appear to be.
“The NHS logo is supposed to mean something,” says Sam Smith, coordinator at affected person information privateness advocacy group, MedConfidential — one of many organizations that makes use of the NHS’ free APIs for well being content material (however which he factors out didn’t write its personal contract for the federal government to signal).
“When DHSC signed Amazon’s template contract to put the NHS logo on anything Amazon chooses to do, it left patients to fend for themselves against the business model of Amazon in America.”
In a associated improvement this week, Europe’s information safety supervisor has warned of significant information safety considerations associated to straightforward contracts EU establishments have inked with one other tech large, Microsoft, to make use of its software program and companies.
The watchdog lately created a strategic discussion board that’s supposed to convey collectively the area’s public administrations to work on drawing up customary contracts with fairer phrases for the general public sector — to shrink the chance of establishments feeling outgunned and pressured into accepting T&Cs written by the identical few highly effective tech suppliers.
Such an effort is sorely wanted — although it comes too late to hand-hold the UK authorities into placing extra patient-sensitive phrases with Amazon US.
This article was up to date with a correction to a reference to the Alexa privateness coverage. We initially referenced content material from the privateness coverage of one other Amazon-owned Internet advertising firm that’s additionally known as Alexa. This is the truth is a special service to Amazon’s Alexa voice assistant. We additionally up to date the report to incorporate extra responses from Amazon