1 of 20

Amazon Astro Privacy Impact Assessment (PIA)

COMP4083

Group 5 - Gizman Ahmed, Anupama Janardhanan, Beryl Okumu, Mini Thomas, Hafsah Tungekar

Aug 10, 2022

2 of 20

B1- Summary of Astro Dog

3 of 20

B1

“Astro” is designed to move around the home and assist its owner with small tasks and can be used for home monitoring and personal assistance.
The camera, combined with AI technology and sensors, assists it in avoiding collisions with walls, objects, and people.
The purpose of using Amazon Astro is to improve the quality of life of seniors by making calls, sending messages, setting timers, alarms, or reminders, retrieving objects, delivering items such as water bottles or vitamins.
Astro provides real-time home monitoring alerts.

4 of 20

B2 – List of the Personal Health Information or Data Elements

5 of 20

B2

Personal Health Information of the Resident

Care plan for residents-

Reminders, Messages, Alarms & Timers that will be set on the assigned nurse’s Astro app and displayed on the Astro device
Health condition or diagnosis
Medications taken
Care notes
Any allergies
Information on the physical, mental, functional, cognitive and behavioral capabilities

6 of 20

B2

Other Data Elements

Name
Age
Gender
Date of birth
Contact information of the resident: phone number and email address
Contact information of the family members: phone number and email address
Visual ID- Resident's photo of face
Videos captured on Astro dog
Audios captured on Astro dog
Floor map of resident’s house outlined on Astro dog

7 of 20

B3 – Flow of Personal Health Information Diagram (BPMN)

8 of 20

9 of 20

B4 – Access to Personal Health Information

10 of 20

B4

	Physicians	Assigned Nurse	Administrative Personnel	Facility Administrator & Compliance Officer	Chief Privacy Officer’s Office (CPO Office)	Retirement Home Resident	Substitute Decision Makers (If applicable)
Consent Forms	X	X	X			X	X
Visual ID		X				X
Video Recordings		X				X
Audio Recordings		X				X
Map						X
Reminders, Messages, Alarms and Timers		X				X	X
Care Plan	X	X				X	X
Digital Clinical File	X	X				X	X
Digital Administrative File	X	X	X			X	X
Non-Compliance Report			X	X		X
Privacy Breach Report			X		X	X

11 of 20

B13- Risk Assessment

12 of 20

B 13

13 of 20

B 13

14 of 20

B14- Risk Mitigation Strategies

15 of 20

Risk category	Risk factor	Risk assessment	Risk mitigation strategy	Owner
Astro dog Software
SR # 17	Very high	Termination of employment or contract with vendors	There must be an effective and immediate termination of user access privileges.	IT Department Administration
SR # 84	High	Not reporting security breach incidents	Must have the capacity to trigger notifications and reporting protocols	IT Department

Retirement home and Amazon staff
SR # 16	Very High	Training staff and vendors in protecting patient PHI	Training staff and vendors must be bound by a licensing body or a professional code of ethics.	Administration
SR # 47	High	Unauthorized use and access to resident’s PHI	Our PHI system must have the ability to identify all users	IT Department

B 14

16 of 20

Equipment
SR # 33	High	New Astro devices without encryption technology.	All new Astro devices must have encryption installed	IT Department
SR# 18	Very High	Unauthorized staff getting into secure areas	Must have stringent security measures to protect the areas that contain PHI	Administration IT Department

Risk category	Risk factor	Risk assessment	Risk mitigation strategy	Owner

B 14

17 of 20

B 14

Risk category	Risk factor	Risk assessment	Risk mitigation strategy	Owner
Data and Data Transfer
SR # 35	High	Improper termination of Astro Plan and Disposal of Data	Must destroy, and permanently erase anonymous PHI no longer in use.	Administration IT Department
SR #71	Very high	Data breaches- PHI theft and loss	Our systems must robustly authenticate users	IT Department
SR # 34	Very High	Loss and damage of data while in transit	Ensure that PHI on the removable media is protected	Administration IT Department

18 of 20

Conclusion

Implementation of Amazon Astro in a retirement community results in the use, collection, and disclosure of many different types of PHI
The PHI flows through a complex system that involves medical and administrative staff
The highest privacy risks come from securing the device, staff training, and user authentication
These risks can be mitigated through the enforcement of physical security measures, staff training that is bound by ethics, and a robust authentication system.

19 of 20

References

Amazon. (2022a). Amazon.com: Amazon Astro, Household Robot for Home Monitoring, with Alexa, Includes 6-month Free Trial of Ring Protect Pro. https://www.amazon.com/Introducing-Amazon-Astro/dp/B078NSDFSB
Canada Health Infoway. (2004). Electronic Health Record (EHR): Privacy Security Requirements. https://www.infoway-inforoute.ca/en/component/edocman/resources/technical-documents/389-ehr-privacy-and-security-requirements

20 of 20

Thank You!