Two more California health systems have been accused of violating patient privacy and disclosure laws by allegedly using an AI scribe tool to record patient-clinician conversations during medical visits without consent.

In a lawsuit filed April 8 in federal court in Northern California, patients seeking class action status allege that clinicians at Sutter Health and MemorialCare “intercepted, recorded, and processed” audio during their visits without informed consent.

Court records indicate the AI tool used was Abridge, an ambient documentation platform that generates clinical notes from audio recordings. Abridge is not named as a defendant in the lawsuit. According to its website, Abridge adheres to industry-standard privacy and security practices and also recommends that clinicians follow their organization’s disclosure and consent policies.

MemorialCare, Abridge, and attorneys representing the plaintiffs did not respond to requests for comment by publication time.

The complaint comes months after a similar lawsuit was filed against San Diego-based Sharp HealthCare involving the same technology. That case remains open. 

As health systems and insurers adopt AI-driven tools to improve efficiency and reduce administrative burden, legislators and courts must determine how those technologies align with patients’ rights and existing privacy laws. For example, California has been an early adopter of laws restricting AI systems from posing as licensed medical providers.

Sutter Health said it is aware of the case and is reviewing the matter. 

“We take patient privacy seriously and are committed to protecting the security of our patients’ information,” the health system said in a statement, adding that technology used in its clinical settings is implemented in accordance with applicable laws and regulations.

Consent, Privacy Law Violations Alleged

Ambient AI tools use a microphone-enabled device, such as the provider’s smartphone or tablet, to capture visit interactions and generate editable clinical notes that may improve physician productivity and earnings.

The complaint states that the recordings contained “highly sensitive and individually identifiable” medical information, including symptoms, diagnoses, medications, and treatment recommendations.

Court records allege the health systems “failed to implement a standardized or system-wide procedure to obtain valid all-party consent” and then transmitted the recordings to Abridge’s servers, violating multiple state and federal laws, including the California Invasion of Privacy Act, the Electronic Communications Privacy Act, and the Confidentiality of Medical Information Act.

Deirdre Mulligan, JD, professor at the University of California, Berkeley School of Information, who researches responsible AI and technology governance, told Medscape Medical News that health systems are still figuring out how to integrate these tools into clinical workflows while meeting existing consent and disclosure requirements.

“If appropriately evaluated, tested, and monitored, and if privacy issues are addressed, these tools can provide more space for interactions between patients and clinicians,” she said. “But to get that process right, organizations must really understand the data flows and have contractual provisions in place to handle patient data and disclosures, especially when the technology is offered by third parties.”

Abridge, founded in 2018 by Shiv Rao, MD, a cardiologist at the University of Pittsburgh Medical Center, Pittsburgh, is one of several companies offering ambient AI documentation tools. The company’s platform has been deployed across more than 150 health systems nationwide, including the Department of Veterans Affairs and major academic medical centers.

Support materials for the platform instruct clinicians to introduce the tool to patients, obtain consent, and follow applicable laws, including the Health Insurance Portability and Accountability Act, as well as their organization’s disclosure policies. A sample script provided on the company’s website reads: “I will be using a tool that records our conversation to help me write my clinical note so I can pay more attention to our conversation and less time on the computer. Is that okay with you?”

Abridge’s clinician terms of use agreement also states that users — not Abridge — are “solely responsible” for obtaining patient consent to collect, store, and process their data. 

AI Consent Lawsuits: An Emerging Trend?

Mulligan said it’s not surprising that the lawsuit involving Sutter Health and MemorialCare, and the earlier case against Sharp HealthCare, were filed in California, given the state’s history of strong consumer privacy laws. She added that she expects more standardized best practices to emerge as health systems gain experience using these tools.

She noted that the audio recordings central to both lawsuits might raise specific concerns because they collect patients’ biometric data. “A full audio recording is very different from a physician’s notes,” she said. “Some patients may want to turn it off, and they should have the ability to say no.”

Abridge announced the partnership with Sutter Health in March 2024. A similar partnership with MemorialCare was announced in April 2024.

The plaintiffs’ attorneys seek to certify a nationwide class of patients who received care from Sutter Health or MemorialCare providers and had their conversations recorded or processed using the platform without consent.

The proposed nationwide class would cover patients seen in the 2 years preceding the complaint filing. The lawsuit also seeks to establish a California-specific subclass for patients who were recorded without consent in the past year.

Steph Weber is an award-winning freelance journalist specializing in healthcare and law.