AI Tools Are Creating New HIPAA Risk — Most Organizations Haven't Assessed It
AI ambient scribes and generative AI chatbots adopted faster than almost any clinical or business software category on record, and the compliance infrastructure around them didn't keep pace. Being HIPAA compliant does not mean you're covered: California's wiretap and medical confidentiality statutes, and HIPAA's own Business Associate and risk-analysis requirements, create exposure that a standard HIPAA program was never built to catch. Three California health systems are already defending class actions over exactly this gap.
98%
of organizations have unverified or unsanctioned AI tools running somewhere in their environment
Varonis, 2025 State of Data Security Report
63%
have no AI governance policy at all — no rules on which tools, what data, or how they're vetted
IBM / Ponemon, 2025 Cost of a Data Breach Report
81%
of physicians now use AI in their practice, up from 38% in 2023
AMA, 2026 Physician Survey on Augmented Intelligence
3
California health systems (Sharp, Sutter, MemorialCare) hit with AI-scribe consent class actions since Nov. 2025
Saucedo v. Sharp HealthCare; Washington v. Sutter Health
AI Ambient Scribes: Where HIPAA Compliance Alone Isn't Enough
The AMA's 2026 Physician Survey found 81% of physicians now use AI in their practice, up from 38% in 2023, and UCSF has reported roughly 70% of its physicians using AI scribes daily. That adoption curve is exactly what's behind a wave of 2025-2026 California class actions alleging something simpler than a data breach: hospitals let an AI tool record patient visits without asking. Patient Jose Saucedo's November 2025 suit against Sharp HealthCare alleges his visit audio was captured and transmitted to an AI scribe vendor without informed consent — and that his own patient portal falsely documented that he'd "consented." Washington v. Sutter Health, filed in federal court in April 2026, accuses Sutter Health and MemorialCare of the identical pattern with the same vendor.
The legal mechanism doing the damage is California's wiretap statute, not HIPAA. Penal Code Section 632 requires the consent of every party to a confidential communication before it can be recorded, and Section 637.2 gives anyone recorded without consent a private right of action for $5,000 per violation or three times actual damages — whichever is greater — with no need to prove actual harm. The Confidentiality of Medical Information Act stacks directly on top, adding $1,000 per violation in nominal damages plus attorney's fees. HIPAA's Privacy Rule doesn't require special consent to document a visit, so a clean HIPAA posture answers a completely different question than the one California's wiretap law asks.
- An AI scribe vendor is a HIPAA Business Associate — a signed, AI-specific BAA needs to exist before the first transcription, covering voice capture, NLP processing, retention, and a ban on training the vendor's models on your patients' audio.
- The Security Rule's foundational requirement (45 CFR 164.308(a)(1)) is a risk analysis covering every system that touches ePHI — an AI scribe's device-to-cloud-to-EHR data flow usually went live after the last Security Risk Assessment and was never added to it.
- Consent has to be built into the visit itself: encounter-specific verbal consent, a pre-visit written notice, a visible or audible recording indicator, and a written authorization on file — not a signature buried in an intake packet.
Shadow AI: The Governance Gap Nobody's Auditing
Every California organization we work with in 2026 already has a shadow AI problem, whether anyone on staff has named it yet or not. Varonis' 2025 State of Data Security Report found 98% of organizations have unverified or unsanctioned applications running somewhere in their environment, and unsanctioned AI tools are the fastest-growing category inside that number — staff pasting client lists into free AI writing tools, running documents through AI summarizers nobody in IT approved or even knows exist. IBM's 2025 Cost of a Data Breach Report found 63% of organizations have no AI governance policy at all, and where that absence turned into an incident, shadow AI added an average of $670,000 to the cost of a breach and exposed customer PII in 65% of cases versus a 53% baseline.
The healthcare-specific numbers are sharper still. Netskope research found 88% of healthcare organizations have already integrated cloud-based generative AI into daily operations, and 71% of healthcare workers are still using personal AI accounts for work tasks — with 81% of all data policy violations identified across healthcare organizations involving regulated healthcare data specifically. HHS guidance is direct on this point: protected health information entered into a public AI tool without a signed BAA is a HIPAA violation, regardless of whether an employee judged the data to be "de-identified" first.
A real shadow AI audit doesn't start with a policy questionnaire — it starts with an actual inventory: DNS and proxy logs, SaaS expense reports and card statements for subscriptions nobody requisitioned through IT, and browser extension telemetry cross-referenced against known AI platforms. From there we map exactly which tools are receiving PHI, PII, or proprietary data, and through which workflows, and hand you a prioritized remediation plan instead of a vague risk score.
Frequently Asked Questions
No. HIPAA's Privacy Rule treats clinical documentation as a permitted use and doesn't require special patient consent to create a note — but that's an entirely separate question from whether you're allowed to record the conversation in the first place. California's Penal Code Section 632 requires the consent of every party before a confidential communication can be recorded, and it applies regardless of your HIPAA compliance status. An AI scribe that captures a visit without proper consent creates CIPA, CMIA, and federal Wiretap Act exposure on top of whatever HIPAA obligations already apply — exposure a clean HIPAA audit won't catch.
A patient filed a proposed class action against Sharp HealthCare in San Diego Superior Court in November 2025, alleging his July 2025 visit was recorded through an AI scribe (Abridge) without consent — and that his own patient portal falsely stated he'd been "advised" and had "consented." Five months later, Washington v. Sutter Health (N.D. Cal., filed April 2026) accused Sutter Health and MemorialCare of the same pattern with the same vendor. Both suits plead California's wiretap law (CIPA), the Confidentiality of Medical Information Act (CMIA), and the federal Wiretap Act — not HIPAA. Three health systems, one shared vendor, the same claim pattern, inside about five months.
Shadow AI is any AI tool employees are using that IT never approved, procured, or logged — a free chatbot used to draft a note, a personal AI account used to summarize a chart. Netskope's research found 88% of healthcare organizations have already integrated generative AI into daily operations, and 71% of healthcare workers are still using personal AI accounts for work tasks. HHS guidance is unambiguous: protected health information entered into a public AI tool without a signed Business Associate Agreement is a HIPAA violation, full stop — regardless of whether an employee considered the data "de-identified" first.
Yes. A vendor that receives, transcribes, and processes patient audio on your behalf — raw audio, transcript, and the drafted note — is squarely a Business Associate under HIPAA. That means a signed BAA needs to exist before the first transcription, not get retrofitted after go-live, and it needs AI-specific language covering voice capture, transcription, NLP processing, data retention, and an explicit prohibition on using your patients' audio to train or fine-tune the vendor's models. OCR collected $9.9 million across 22 HIPAA settlements in 2024 alone, and missing or inadequate BAAs remain a recurring cited finding.
Yes, and arguably more than it applies to a hospital system. CIPA and CMIA penalties don't scale down by practice size — a five-provider clinic recording a full day of unconsented visits accumulates the same $5,000-per-violation exposure as a hospital, without a hospital's legal budget to absorb a class action. Self-serve AI scribe tools built for solo practitioners and small groups (Suki, Nabla, DeepScribe, Freed) start at $99-$149 a month with no IT department required to turn them on — which is exactly how they end up live in a practice with no BAA, no consent workflow, and no updated Security Risk Assessment.
It starts with an actual inventory, not a policy questionnaire: DNS and proxy logs, SaaS expense reports and card statements for AI subscriptions nobody requisitioned through IT, and browser extension telemetry cross-referenced against known consumer and enterprise AI platforms. From there we map data flows — which tools are receiving PHI, PII, financial data, or proprietary information, and through which workflows — and produce a documented inventory, a gap analysis against whatever framework you already answer to (HIPAA, SOC 2, CMMC, NIST CSF), and a prioritized remediation plan: a written AI usage policy, DLP rules tuned for browser-based AI tools specifically, and a vetted, contractually-covered enterprise AI platform to replace the unsanctioned ones your team already found on its own.
Four things, in order: add the AI scribe's full data flow (device microphone → vendor cloud → EHR write-back) to your Security Risk Assessment's technology and vendor inventory; confirm a signed, AI-specific Business Associate Agreement is on file with the vendor; and build a consent workflow that includes encounter-specific verbal consent at the start of each visit, a pre-visit written notice describing what's recorded and where it goes, and a visible or audible indicator that recording is active. A Security Risk Assessment finished before your practice turned on an AI scribe isn't current documentation — it's a description of a network that no longer exists.
