Ambient AI is artificial intelligence that operates quietly in the background, using sensors, microphones, or cameras to observe an environment and act without being prompted. Nothing is typed, clicked, or launched because the system is already listening.

In healthcare, the dominant application is the ambient scribe, which listens to a clinical encounter and drafts the note. Adoption has moved quickly, the efficiency evidence is more mixed than the marketing suggests, and the legal exposure exists somewhere most compliance programs have not looked.

Read more: What AI in healthcare actually looks like in 2026

 

How it works in a clinical setting

A clinician starts a visit, and the tool captures the conversation between them and the patient. Speech recognition separates the speakers, a language model drafts a structured note, and the clinician reviews and edits before it enters the record.

A clinical trial registration for Atrium Health's DAX Copilot pilot describes the process in those terms, with the tool listening to the conversation and providing transcriptions for the clinician to review, edit, and include in the final EHR note. Abridge, Nuance DAX Copilot, Ambience, Suki, and Nabla are the names appearing most often in published evaluations.

 

What the research actually found

Results vary considerably by site, vendor, and specialty, which is not how the category is usually described.

The American Hospital Association reported on a JAMA study across five academic medical centers finding ambient scribes reduced total EHR time by 13.4 minutes and documentation time by 16.0 minutes. Mass General Brigham recorded a 21.2% reduction in burnout prevalence after 84 days. Cleveland Clinic measured 14 minutes a day saved, and Cooper University Healthcare found 4.15 minutes saved per patient using Dragon Copilot.

Researchers from Atrium and Wake Forest University School of Medicine published findings in NEJM AI concluding that DAX Copilot did not deliver meaningful improvements in metrics across the clinician population, and Healthcare IT News reported their assessment that widespread implementation in its current form is "unlikely to generate appreciable gains for healthcare systems looking to increase productivity."

A randomized controlled trial comparing DAX and Nabla against a control group published in PMC found a modest documentation time reduction for Nabla users and potential improvement in burnout and cognitive load for both tools, with the authors noting those secondary findings need confirmation in larger multicenter trials.

A pooled analysis of 14 studies found a moderate reduction in documentation workload and burnout while cautioning that current systems still produce "high omission rates and intermittent factual inaccuracies" capable of affecting clinical decisions. A matched pre-post study of 6,026 outpatient notes at Mass General Brigham found the linguistic effects of ambient documentation to be both vendor-dependent and section-specific, meaning the notes read differently depending on which tool wrote them.

 

What the tool captures beyond the note

An ambient scribe generates considerably more protected health information than the document that lands in the chart. A single encounter produces a live audio stream of the conversation, an interim transcript, a machine-drafted note, and metadata identifying the clinician, the patient, and the visit.

Each of those is PHI. Each has to be covered by a business associate agreement, secured in transit and at rest, and accounted for in a risk analysis. Most organizations inventory the note and overlook the three artifacts preceding it.

Retention is unsettled. HIPAA sets no minimum or maximum period for audio or interim transcripts, and only the final approved note falls under Medicare's five-year record retention requirement. An organization that has not specified a retention period in its vendor agreement has, in practice, agreed to whatever the vendor chooses.

 

The consent problem a BAA does not solve

Under HIPAA, using an ambient scribe for clinical documentation falls within permitted treatment activity, and no separate patient authorization is required, state law is where this breaks.

The American Bar Association's Health Law Section set out the tension directly, noting that unlike traditional documentation software, ambient scribes passively record sessions, which creates friction with existing privacy laws and consent frameworks. Lawsuits in California and Illinois allege health systems used ambient scribing without obtaining informed consent, potentially violating state wiretapping statutes and confidentiality protections when audio is transmitted to third-party vendors for processing.

California and roughly a dozen other states require all parties to a conversation to consent before recording begins. A multi-state health system running one ambient workflow can therefore be compliant in one jurisdiction and in breach in another, using identical configuration.

 

The cases now in court

Jose Saucedo filed a proposed class action against Sharp HealthCare in San Diego Superior Court in November 2025, alleging Sharp used Abridge's ambient tool to record clinical encounters without patient consent. The complaint cites California's Invasion of Privacy Act and its Confidentiality of Medical Information Act, arguing that capturing physician-patient conversations and transmitting audio to a vendor's cloud servers violated both.

Further suits followed in April 2026 against Sutter Health and MemorialCare on similar grounds, adding claims under the federal Wiretap Act.

The ABA analysis identified three compliance vulnerabilities running through these cases. Patients may not be informed that recording is occurring. Recordings and transcripts may be transmitted to and stored by vendors. AI-generated records may state that consent was obtained when it was not. That third point deserves attention from anyone relying on the note as evidence of the consent process.

 

Where the obligation is

Vendor agreements in this category generally place consent, notification, and compliance duties on the healthcare organization while preserving the vendor's rights to access, process, and retain audio.

Four things need resolving before deployment. The BAA should specify retention periods for audio and transcripts, whether data may be used for model training, where it is stored, and the vendor's breach notification obligations. Patient notice belongs in the Notice of Privacy Practices and the intake workflow rather than being left to individual clinicians to explain. Consent needs to be captured before recording begins rather than after. Risk analysis has to cover the audio and transcript layers, not only the finished note.

 

How this connects to the wider shadow AI problem

Paubox's Shadow AI research found 95% of healthcare organizations suspect staff already use generative AI for work-related email or content, while only 42% have signed a business associate agreement covering an AI tool used in email and 21% believe no BAA is required at all.

Ambient AI is the sanctioned version of the same exposure. It is procured, contracted, and visible, which makes it easier to govern than a clinician pasting a summary into a consumer chatbot. The gaps that appear are contractual and procedural rather than technical, and they are the gaps an OCR investigation or a plaintiff's attorney will find first.

 

What ambient AI looks like next

Documentation is the entry point rather than the destination. Ambient systems are being extended toward order entry, coding and billing suggestions, clinical decision support delivered during the encounter, and monitoring in inpatient rooms using cameras as well as microphones.

Each extension widens what gets captured and what the system is trusted to act on without a prompt. The documentation use case at least keeps a clinician reviewing the output before it enters the record, which is a check that disappears as ambient systems move toward acting rather than drafting. The Joint Commission and the Coalition for Health AI guidance published in September 2025 asks organizations to validate how a tool performs against the population actually using it, which is a standard worth applying before the next capability arrives rather than after.

 

FAQs

Does HIPAA require patient consent for an ambient AI scribe?

No. Clinical documentation falls within permitted treatment activity, so no separate HIPAA authorization is needed. State wiretapping and recording laws impose separate requirements that HIPAA does not override.

 

Is a business associate agreement enough?

It covers the vendor's handling of PHI under federal rules. It does not address state all-party consent statutes, which are the basis of the current litigation against several California health systems.

 

How long should ambient audio be retained?

HIPAA sets no period for audio or interim transcripts, and only the final note falls under Medicare's five-year requirement. The retention period should be specified in the vendor agreement rather than left to the vendor's default.

 

Does ambient AI reduce clinician burnout?

Evidence is mixed. Several health systems measured meaningful reductions in documentation time and burnout, while an Atrium Health study published in NEJM AI found no meaningful improvement across the clinician population as a whole.

 

What should be in place before deploying one?

A BAA specifying retention, training use, storage location, and breach obligations, patient notice built into intake and the Notice of Privacy Practices, consent captured before recording starts, and a risk analysis covering audio and transcripts alongside the note.