In April 2026, three California patients filed a proposed class action lawsuit against Sutter Health, Memorial Health Services, and MemorialCare Medical Foundation. In Washington et al. v. Sutter Health et al., the patients allege that an ambient AI documentation tool captured patient-clinician conversations, transmitted the audio to external systems for processing, and generated draft clinical notes, all without meaningful, informed consent. The complaint says the health systems should have received informed consent before they ever began recording.

In just a few years, AI clinical scribes have moved rapidly from limited pilots to broader deployment across health systems. The proposed advantage is that clinicians can spend less time documenting during and after visits and more time engaging directly with patients. But the pace of adoption is faster than the pace of governance, and the case shows that the lag in clear, outlined policy creates privacy concerns and potential legal issues.

 

What an AI clinical scribe does

An AI clinical scribe, also known as an ambient scribe or digital scribe, is trained to listen to a clinical encounter, transcribe that encounter, and compose a structured note for a clinician to review and sign.

A systematic review examining AI scribes links documentation burden to clinician burnout, noting that “the overwhelming burden of clinical documentation is a major contributor to this problem.” The appeal lies in the connection between the administrative documentation burden, a known driver of clinician burnout, and ambient scribes based on large language models, which are increasingly positioned as tools to automate note generation and reduce this burden.

 

Why HIPAA compliance is not a single box to check

A vendor’s claim that a tool is HIPAA compliant is not sufficient on its own. Compliance depends on the parties’ roles, the applicable contracts, the tool’s configuration and safeguards, and how protected health information (PHI) actually moves through the system. A useful frame here comes from guidance on reviewing healthcare AI vendors. A proper security review should include the standard due diligence you would require of any HIPAA vendor, a signed business associate agreement (BAA), access controls, and encryption, as well as AI-specific questions that a generic vendor questionnaire tends to miss.

As a JAMA Network study on informed consent for ambient AI documentation states, “Consent should also include information on vendor partnerships and the specific responsibilities of the clinician and health systems vs those of the vendor.”

A healthcare AI security review should combine standard HIPAA vendor due diligence with AI-specific governance checks, including model governance, data provenance, and data lineage. A signed BAA covers the vendor's obligations as a business associate, but it does not by itself confirm that the covered entity has a documented consent process, has folded the tool into its security risk analysis, or knows whether the vendor uses transcripts to further train its models.

It is also worth separating two things that get treated as synonyms in healthcare IT conversations, namely, secure transmission and a secure workflow. Encrypting the connection between a scribe's microphone and its servers addresses one technical safeguard. Encryption is one control within the workflow; it does not secure the entire data lifecycle or ensure that notes are routed, reviewed, retained, and disclosed appropriately.

 

The evaluation checklist

For covered entities, IT leaders in health systems, and developers using ambient documentation tools, the following items serve as a working checklist for organizations looking to use AI scribes.

  1. Ensure the BAA handles the particular data flow. The AI documentation function should be specifically named in a signed BAA.
  2. Document how notice and consent are obtained before the tool is activated, whether patients can decline, how refusals are recorded, and whether applicable state law requires all-party consent or another form of authorization.
  3. Ask about the retention policy. The retention period for raw audio and transcripts should be documented, minimized where appropriate, and aligned with the BAA, service agreement, applicable law, and the organization’s approved retention schedule.
  4. Determine whether the vendor uses PHI, transcripts, notes, or de-identified data for model training or product improvement. Confirm what the BAA and service agreement permit, which de-identification method is used, and whether secondary use is contractually restricted.
  5. Add the tool and its data flows to the organization’s HIPAA risk analysis. The Security Rule requires an accurate and thorough assessment of risks and vulnerabilities affecting all electronic PHI (ePHI), including ePHI handled through newly introduced technologies and vendors.
  6. As a clinical-safety and documentation-governance control, require an authorized clinician to review and correct each draft before it is signed or incorporated into the final medical record.
  7. Identify downstream model providers, cloud hosts, and transcription subcontractors that handle PHI. Confirm that the primary business associate has entered into compliant written agreements with those subcontractors and that the customer receives sufficient visibility into the downstream data flow.
  8. Review the contract’s security-incident and breach-notification provisions. Under HIPAA, a business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovering a breach of unsecured PHI, although contracts and state laws may impose shorter deadlines.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

When does an AI vendor become a business associate?

An AI vendor generally becomes a business associate when it creates, receives, maintains, or transmits PHI on behalf of a covered entity or another business associate.

 

Does a healthcare organization need a BAA for every AI tool it uses?

Not necessarily, only selling or supplying software does not make a vendor a business associate when the vendor does not access or maintain PHI.

 

Does a ‘zero-retention’ policy mean the AI vendor is not a business associate?

Even temporary receipt or processing of PHI can create a business associate relationship. The organization should verify what “zero retention” actually covers, including prompts, audio, transcripts etc.