Alexa implements specific administrative, technical, and physical safeguards for protected healthcare information processed by a HIPAA-eligible skill. For example, when your customers use your skill the words they say will not appear in their voice history. In addition, your customers will have the same transparency and control over their privacy that they experience with all Alexa skills and Echo devices.
We have a standard Business Associate Agreement between you and Amazon that you agree to for each HIPAA-eligible skill.
You can can tell us about that skill on our contact form. You cannot submit a skill that has already been published. Note, if you want a skill that you have already published to be HIPAA-eligible, you must create a new skill but may use the same source code. The proposed skill must still be accepted into the program and the new skill must meet all requirements for skills that are HIPAA-eligible. Once you say that the skill will handle protected health information and agree to the Business Associate Agreement, your skill will be subject to all requirements for skills that are HIPAA-eligible and it cannot be undone.
Skill developers can build skills for Covered Entities and Business Associates. We require that the Amazon developer account is owned by the entity that will publish the skill but do not restrict account administrators from granting additional users, including skill developers, access to assist with development.
The U.S. Department of Health and Human Services HIPAA for Professionals website is a good resource to learn more about the U.S. Health Insurance Portability and Accountability Act (HIPAA). In particular, you may be interested in the summary of the Privacy Rule which defines Protected Health Information (PHI) and Covered Entity and Business Associate.