The AI Listening to Your Consults Is Now a Class Action Risk

An ambient scribe is the easiest sell in medicine. It listens to the consultation, writes the note, and hands the physician back fifteen minutes of their evening. Nobody who has used one wants to go back.

Which is why what happened this year is worth understanding before your practice buys one.

Three health systems, one allegation

In 2026, proposed class actions were filed against Sutter Health and Memorial Healthcare Services over the use of an AI documentation platform, and against Sharp HealthCare over ambient clinical documentation. The core allegation in each is the same sentence: patient conversations were recorded and transmitted to a third party for processing, and patients were never told.

Read what is not being alleged. Nobody claims the data leaked. Nobody claims a breach. The complaint is that the recording happened at all without consent, and that a vendor received the contents of a confidential medical conversation.

Why these are wiretap claims

The suits plead the California Invasion of Privacy Act, the Confidentiality of Medical Information Act, the federal Wiretap Act and unfair competition. HIPAA is in the background as a standard of care rather than as the cause of action, for a structural reason that every owner should know.

HIPAA has no private right of action. A patient cannot sue you under it. Enforcement runs through the federal regulator, which means a complaint, an investigation, a corrective action plan and possibly a settlement.

Wiretap statutes are the opposite. They carry statutory damages per violation and they let the patient sue directly. Multiply a per-violation figure by every recorded consultation in a four-year class period and the arithmetic stops being about compliance and becomes about solvency.

All-party consent changes the script

Roughly a dozen states require every party to a confidential conversation to consent before it is recorded. California is one, and California is where the plaintiffs' bar is most active on this. A one-party state is easier, but a practice that advertises across state lines, takes calls from out-of-state patients, or runs virtual consultations does not get to pick which rule applies.

Practical consequence: a disclosure buried in the intake packet the patient signed in the waiting room is thin evidence that the patient consented to this recording, in this room, on this day. The consent has to attach to the conversation.

Consent belongs in the record

This is the part that separates a practice with a problem from a practice with a defense, and it has nothing to do with which vendor you chose.

If somebody asks you in 2029 to prove that a patient agreed to be recorded in March 2026, what do you produce? A policy document proves what you intended. A signature on an intake form proves the patient received a packet. What you need is a stored, timestamped record that consent was given for this encounter, who gave it, what they were told, and whether it was later withdrawn.

Withdrawal is the piece almost nobody builds. A patient who consented to photographs and recordings two years ago and then calls to withdraw has created an obligation that has to propagate to every place that material was used, including before and after galleries and advertisements. If consent lives as a scanned PDF in a folder, that obligation cannot be executed, only promised.

The disclosure your front desk can read out loud

Short, specific, and spoken rather than printed. Something close to this, adapted by your counsel:

"Before we start, Dr. Reyes uses a tool that listens to our conversation and writes the clinical note from it, so she can spend this time with you instead of a keyboard. The audio goes to the company that provides that tool and nowhere else. Is that all right with you? You can say no and nothing changes about your visit."

Twenty seconds. It also converts the single most expensive allegation in those complaints, that the patient was never told, into a documented conversation.

How we handle recordings

We record and transcribe calls, so this is our exposure too, and the position we hold is the one we would want a vendor to hold toward us. Transcription stays off on a clinical line until consent handling is configured. The consent object is part of the data model rather than an attachment, which is what makes withdrawal something the system can execute. And the recordings belong to the practice, which matters more than it sounds and is the subject of another post in this set.

On the website side of the same problem, which is consent for tracking rather than for recording, Consential handles the capture and the record of what a visitor agreed to and when, including withdrawal.

What to do if you already use one

Do not panic and do not stop using it. Find out three things this week: what the vendor's agreement with you actually covers, whether your practice obtains and stores per-encounter consent, and which states your recorded patients were sitting in. Those three answers tell you whether you have a documentation gap you can close in a fortnight or a conversation you need your counsel in.