Big Tech’s AI Gamble: Unpacking Amazon’s One Medical Play

The rapid convergence of Big Tech and healthcare presents a fascinating, yet often fraught, landscape for regulators. As artificial intelligence permeates every facet of medical practice, the imperative for clear, evidence-based policymaking becomes paramount. This analysis delves into the current state of AI integration within healthcare, specifically through the lens of Amazon’s acquisition of One Medical, examining the justifications for their market presence and the critical regulatory gaps that demand immediate attention.

The Regulatory Chasm: When Innovation Outpaces Oversight

The promise of AI in healthcare, from enhanced diagnostics to personalized treatment plans, is undeniable. However, the regulatory frameworks designed for traditional medical devices often struggle to encapsulate the dynamic, adaptive nature of AI/ML-driven tools. Many AI functionalities embedded within broader healthcare service offerings, particularly those from large technology companies, currently occupy a significant regulatory grey area, though the FDA has made strides in providing clearer guidance. This ambiguity arises because many of these tools are initially positioned as “clinical decision support” (CDS) tools, which, depending on their intended use and risk profile, may not be regulated as Software as a Medical Device (SaMD) by the FDA. The distinction between a CDS tool providing recommendations and a diagnostic AI making independent determinations is crucial. If an AI tool says “probable HFpEF, recommend referral,” it might be CDS. If it says “HFpEF confirmed,” it’s a regulated device. This nuanced difference often determines whether a product undergoes rigorous FDA scrutiny via pathways like 510(k) clearance or De Novo classification. The FDA’s revised guidance on Clinical Decision Support (CDS) software, issued in January 2026, further clarifies the scope of oversight and introduces enforcement discretion for certain single-recommendation CDS tools, regulating based on intended use and risk rather than solely on AI involvement. Without this clear regulatory delineation and subsequent pathway adherence, patient safety and data integrity can be compromised. Furthermore, the absence of a defined regulatory pathway exposes companies to rising enforcement and health-plan exclusion risk, as payers increasingly demand evidence of regulatory compliance for reimbursement.

Hello Heart: A Benchmark for SaMD-Informed Architecture

To understand what a robust, SaMD-informed approach looks like at scale, we can look to companies like Hello Heart. This digital therapeutic for cardiovascular disease management exemplifies a proactive engagement with the FDA SaMD framework. Hello Heart’s core offering, which includes an AI-driven blood pressure monitor (FDA-cleared as a Class II medical device) and a coaching app (not classified as a medical device by the FDA), is designed with regulatory compliance embedded from its inception. Their approach demonstrates several key characteristics:

• Clear Intended Use: Hello Heart explicitly defines its intended medical purpose, facilitating its classification as a SaMD. This clarity is foundational for regulatory engagement.
• Clinical Validation: The company has invested in robust clinical evidence generation, including randomized controlled trials, to demonstrate the safety and effectiveness of its AI algorithms. This commitment to real-world evidence (RWE) strengthens both their FDA submissions and their value proposition to payers Example of digital therapeutic clinical trial results. Recent studies highlight their ongoing commitment to clinical evidence, including research published in August 2025 showing significant blood pressure reductions among women using their program.
• Quality Management System (QMS): Hello Heart operates under a stringent QMS, often adhering to standards like ISO 13485, which is essential for medical device development and post-market surveillance.
• Post-Market Surveillance and Algorithmic Drift Management: Recognizing that AI models can experience algorithmic drift, companies like Hello Heart implement robust post-market surveillance strategies and proactively plan for predetermined change control plans (PCCP) with the FDA to manage model updates and performance monitoring effectively, a mechanism now formalized by FDA guidance. This comprehensive, regulatory-first architecture not only mitigates enforcement risk but also builds trust with healthcare providers, patients, and crucially, health plans.
  

  Amazon and One Medical: Navigating the Uncharted Waters

  Amazon’s acquisition of One Medical brought a significant player with vast technological capabilities into the direct provision of healthcare. One Medical, a primary care provider, leverages technology extensively, including AI, to streamline appointments, manage patient data, and offer virtual care. In January 2026, Amazon launched an AI assistant called “Health AI” for One Medical members, which provides personalized medical guidance, explains lab results, books appointments, and manages medications by drawing from complete medical records. The “What is the justification?” angle becomes particularly pertinent here. What is the regulatory justification for the widespread deployment of AI tools within such a large-scale healthcare operation, especially when those tools may influence diagnostic or treatment decisions? While One Medical’s core service is primary care, the integration of Amazon’s AI capabilities into patient-facing applications and internal clinical workflows raises questions about the regulatory classification of these embedded AI components. Are these tools purely administrative, or do they cross the threshold into SaMD territory by providing diagnostic information, guiding treatment, or monitoring physiological parameters?

  The “Evidence-First Analysis” and the Regulatory Blind Spot

  From an “Evidence-First Analysis” perspective, while Amazon has publicly launched its “Health AI” assistant for One Medical members, the public disclosures regarding the specific regulatory status (e.g., FDA clearance) of this particular AI tool remain largely opaque. Unlike a company explicitly marketing a SaMD, Amazon’s approach often integrates AI as part of a broader service offering, potentially obscuring the need for individual regulatory clearances for each AI component. Policymakers must scrutinize whether these integrated AI functionalities are operating within the spirit, if not the letter, of existing medical device regulations. The absence of clear 510(k) clearances or De Novo classifications for many of these AI tools, if they indeed meet the definition of SaMD, represents a significant regulatory blind spot. This lack of explicit regulatory oversight could lead to:

• Undocumented Efficacy and Safety: Without FDA review, the efficacy and safety of these AI tools are primarily self-attested, lacking independent validation.
• Inconsistent Data Privacy and Security: While HIPAA compliance is fundamental, SaMD regulations impose additional requirements for data security, especially concerning clinical data used for AI model training and deployment. HITRUST or SOC 2 certifications are often expected for regulated health tech, providing a higher bar for data governance. Amazon states its Health AI assistant follows HIPAA-compliant privacy and security practices, and conversations are not automatically added to medical records.
• Unclear Accountability: In the event of an adverse event linked to an AI algorithm, the chain of accountability can become convoluted without a clear regulatory pathway and post-market surveillance obligations.
  

  The Imperative for Policymakers: Bridging the Gap

  The current landscape demands a proactive stance from policymakers and regulators. Evidence-based policymaking is the ideal, and for AI in healthcare, this means developing frameworks that are agile enough to keep pace with innovation while robust enough to ensure patient safety and ethical deployment. Several key areas require immediate attention:

• Clarifying SaMD Definition for Integrated AI: The FDA and other regulatory bodies have provided clearer guidance on when AI functionalities embedded within broader healthcare platforms, especially those from Big Tech, transition from unregulated CDS to regulated SaMD, notably through the January 2026 revised CDS guidance. Further clarification is still needed on defining thresholds for diagnostic or treatment influence for all integrated AI.
• Mandating Regulatory Pathways for High-Risk AI: Any AI tool that directly impacts patient diagnosis, treatment, or monitoring, regardless of its integration within a larger service, should be compelled to follow established SaMD pathways (e.g., 510(k), De Novo). The FDA’s finalization of Predetermined Change Control Plan (PCCP) guidance in December 2024 provides a framework for managing iterative updates for such devices.
• Enhancing Transparency: Companies deploying AI in healthcare should be required to disclose the regulatory status of their AI tools, including any FDA clearances or exemptions. This transparency is crucial for providers, patients, and payers.
• Promoting GMLP and QMS Adoption: Policymakers should advocate for the widespread adoption of Good Machine Learning Practice (GMLP) principles, which were finalized by the IMDRF in January 2025, and robust Quality Management Systems (QMS) across all healthcare AI developers, not just those explicitly labeled as SaMD. This ensures responsible development and deployment FDA, Health Canada, MHRA Good Machine Learning Practice guidance.
• Addressing Reimbursement Linkage: Health plans and payers are increasingly scrutinizing the regulatory status of AI tools before considering reimbursement. Policymakers can reinforce this by linking reimbursement eligibility directly to FDA clearance or other recognized regulatory compliance. This creates a powerful market incentive for companies to pursue regulatory pathways. The integration of Big Tech, with its immense resources and AI capabilities, into healthcare holds transformative potential. However, this potential must be tempered with rigorous oversight. The current regulatory grey areas, particularly concerning AI tools embedded within broader service offerings like One Medical, pose significant risks. By learning from exemplars like Hello Heart and adopting an evidence-first approach, policymakers can ensure that innovation serves patient well-being, rather than operating in an unchecked frontier. The justification for Big Tech’s presence in healthcare AI must ultimately rest on a foundation of clear regulatory adherence, robust clinical evidence, and unwavering commitment to patient safety. Analysis of Big Tech healthcare acquisitions and regulatory implications.