Amazon recently announced that covered entities and business associates can build so-called HEPA-eligible applications to allow Amazon's Alexa voice assistant technology to transmit and receive protected health information. But what does that mean and how does it work? I'm Mary Ann Kolbasek McGee, Executive Editor at Information Security Media Group. Today, I'm speaking with John Brownstein, Chief Innovation Officer at Boston Children's Hospital.
John will be speaking to us about a new HEPA-eligible Alexa voice assistant technology application that Boston Children's Hospital has developed and how it is keeping patient information private and secure. So John, for starters, can you briefly describe what the hospital's new enhanced recovery after surgery application using Alexa voice technology is and how it works? Absolutely. And before I get into that, I want to describe the fact that the hospital has been working in voice for several years now.
Since 2016, when we saw the sort of increased adoption of smart speakers in the home and the massive sort of deployment they have very broadly, we really believe that there's massive opportunity to think about how these technologies can be used from a health care perspective. And in fact, we built the first skill for the Alexa platform that had health content. It was called Kidun D. It's still available.
It's all about providing guidance and information about acute conditions, the parents and guardians about their kids and what else. From that perspective, we've really thought about what are the broad opportunities and voice. You have this device in the home that has access to incredible amounts of information. Why not make it the hub of medical know-how?
And we've been thinking about the sort of broads of these cases. And as we have been working with Amazon and the opportunities around HEPA-compliant, the first sort of foray into that was with this post discharge scale. The idea really is simply, we have patients recovering from cardiac surgery. And as much as we can retain some level of engagement across the recovery process, the more that we can stay tuned to any deviations from planned recovery and interviewing the student.
And so the idea of the scale is to make actually something that was done via Tech Message and the web as simple as we use for consumers as possible. And voice represents a really easy platform to do things like provide content, to provide information about upcoming appointments, but even more importantly, and ability for patients to engage around the course of their recovery. So logging things like pain scores, appetite, activity levels. And so this becomes a new channel of data collection that care teams can receive.
And essentially in real time have a view on that recovery process. We're deploying it in this cohort of patients, but of course the broad application in patients discharge. And even bigger view of how virtual care is extending to reach of the hospital and improving our ability to maintain a connection with patients that's not just sort of one-off through appointment. And that's why we're really excited about this sort of first step in using technology.
So now John Amazon is calling these so-called Alexa healthcare skills, HEPA eligible. What does HEPA eligible mean? It means essentially that they are maintaining HIPPA compliance in these cases. So we've actually signed BAA's with Amazon and there are specific types of compliance that they're adhering to in the protection of patient data.
And so we can, and it enables us, whereas before we had skills that sort of existed in the bubble where patients potentially access information but had zero connectivity back to the hospital, now we can actually maintain a connection to patient-related information to push information into the patient record. So in terms of patient information that gets generated or exchanged when using this application with Children's Hospital, how is the data being secured? How are you keeping it private? So Amazon has had a long history of work in HIPPA compliance base.
And in fact, we've worked with Amazon for years with their AWS. They understand how to take data and maintain it in cloud hosted servers, in an environment that adheres to all the correct standards when you're thinking about patient information. And they've now adapted that view that they already have at infrastructure to include the Alexa environment. Now, we do a lot in terms of working with Amazon to make sure that it's the right patient, you know, connected.
So we do account linking, we use a voice pin, you know, there's certain protections that are used as a way to make sure that we're working with the right patient or the right parents of guardians of that patient. So does this information get stored or processed or transmitted via Amazon's cloud services? And is Amazon considered a HIPPA business associate in the context of this application? And what is Amazon's role in terms of protecting the security and privacy of this information?
I can't speak on behalf of Amazon. But yes, we're a business associate and we've of course gone through extensive privacy and compliance review and make sure that, you know, of course, they're in the existing standards that we as an organization would have with any sort of vendor relationship where there's this extension of the work of the hospital. So, John, you also mentioned that there's something in place so that you can verify the identity or pin. How does that work?
Well, it's very simply when you're enabling the Alexa scale, you're doing essentially a linking of your patient portal to the link Alexa account. So, we do one sort of connection that is done by the parent or guardian. But then when you enact the scale, you have to put in a voice pin, like a footage of code, you know, in order to be able to access the scale itself. So, now, what do you see as some of the main challenges in securing and keeping this data private and the conversations that involve the voice technology to keep those private?
For instance, it was recently reported that Amazon workers sometimes listen to Alexa command recordings in order to improve the performance of Alexa. How can you be sure that patients' privacy will not be somehow reached? Again, I mean, we spend a lot of time working with Amazon through working through a privacy and compliance and how they essentially work with the data that's collected, where it's stored, how it's utilized, and brought and essentially interacted with our patient portal. You know, this is very similar to a lot of different vendors that we work with, regardless if it's voice or text messaging tools, mobile apps.
I mean, there's a variety of different ways that data can be collected. And so, we have a very long-standing process at the hospital to make sure that we understand the full architecture and how essentially the data flows. And again, it hears the existing standard. When a patient or a parent gives a command, does it then get recorded into their portal?
So that, you know, if they want to go back to the doctor and say, hey, this is the information that I passed along, would it be available to them? Right now, the way that we're doing it is essentially you know, recording specific input. So what we're trying to do is collect very specific data elements about the patient sort of successful recovery. And that's really sort of what we're doing.
We're pulling in that kind of information at this stage. So John, what's next for children's when it comes to other potential HIPAA eligible Alexa applications? It's a really exciting time in this emerging technology. We're definitely taking things slow.
We want to deploy this broadly with recovery tool. And we see how the acceptance of it and how well it works. And we're going to be doing some great evaluation. We do see extension of discharge broadly without an opportunity in remote patient monitoring.
And then of course, it's a broad set of use cases and voice more generally, whether it's within the hospital, walls or outside. And so, I mean, there's a long list of very exciting opportunities that are emerging with voice. But for now, what we're trying to do is make sure that what we're deploying today with patients is working and really optimizing the patient experience at the end of the day. You know, we're not trying to deploy technology.
But the thing of it, we're really trying to make sure that what we're doing is improving experience, reducing barriers for information access and ultimately benefiting the recovery process for patients. Thanks, John. I've been speaking to John Brownstein. I'm Mary Ann Kolbasak-Migee of Information Security Media Group.
Thanks for listening.