AI Ambient Scribes and California Wiretap Law: Why Your HIPAA Risk Assessment Needs an Update
AI ambient scribes went from novelty to near-standard-of-care faster than almost any clinical software category on record, and the compliance infrastructure around them didn't keep pace. The AMA's 2026 Physician Survey on Augmented Intelligence found 81% of physicians now use AI in their practice, up from 38% in 2023, and the AMA's own analysis of that data found that when overlapping tool categories are combined, reported use of ambient-listening scribe tools specifically could exceed 50%. Doximity's 2026 State of AI in Medicine Report puts voice-based documentation and ambient-listening adoption at 29% of physicians surveyed in January 2026, up from 20% just nine months earlier. UCSF has reported that roughly 70% of its physicians were using AI scribes daily by 2026. That's the backdrop for a wave of 2025-2026 California class actions that allege something simpler than a data breach: hospitals let an AI tool record patient visits without asking.
The most detailed complaint so far is local. Patient Jose Saucedo filed a proposed class action against Sharp HealthCare in San Diego Superior Court in November 2025, alleging that during a July 2025 physical exam at a Sharp Rees-Stealy clinic, his visit audio was captured through his clinician's microphone-enabled device, transmitted to Abridge's cloud platform, and used to draft his clinical note -- all without his informed consent. What turned this into a lawsuit rather than a complaint letter is what Saucedo says he found afterward in his patient portal: documentation stating he had been "advised" that the visit was being recorded and that he had "consented." The complaint calls that language false and alleges the AI tool itself auto-inserted the consent statements into patient charts. Sharp announced its Abridge rollout in April 2025; the suit estimates more than 100,000 patient visits were recorded during that rollout.
Five months later, the pattern repeated at scale. Washington v. Sutter Health (N.D. Cal., Case No. 4:26-cv-03012), filed April 8, 2026 by plaintiffs Christina Washington, Dennis Gueretta, and Rebecca Matulic, accuses both Sutter Health and MemorialCare of deploying the same Abridge ambient scribe to record clinical encounters, generate documentation, and write it into the EHR -- again without patient consent. The complaint pleads the same statutory combination as the Sharp case: California's Invasion of Privacy Act (CIPA), the Confidentiality of Medical Information Act (CMIA), the federal Wiretap Act, and California's Unfair Competition Law, and it seeks class certification, an injunction, and damages. Three different California health systems, one shared vendor, the same three-statute combination, inside roughly five months -- this is no longer an isolated incident, it's a replicable claim pattern plaintiffs' firms have identified and are running again.
The legal mechanism doing the real damage is California's wiretap statute, not HIPAA. Penal Code Section 632 requires the consent of every party to a confidential communication before it can be recorded, and California is one of roughly a dozen all-party-consent states nationwide (alongside Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania, and Washington). Section 637.2 gives any person whose communication was recorded without consent a private right of action for $5,000 per violation, or three times actual damages, whichever is greater -- and critically, a plaintiff never has to prove actual harm to collect it. Each unconsented visit is its own violation. For a health system whose own complaint estimates 100,000+ patients recorded, the arithmetic gets uncomfortable fast: even a fraction of that population at the CIPA statutory floor reaches eight figures before a single dollar of CMIA damages, Wiretap Act damages, or attorney's fees is added.
CMIA and the federal Wiretap Act stack directly on top of CIPA rather than replacing it. Under Civil Code Section 56 et seq., patients can recover nominal damages of $1,000 per violation without proving actual harm, plus attorney's fees, and administrative penalties add up to $2,500 per violation for negligent disclosure or up to $25,000 per violation for knowing and willful misuse. A 2026 California Supreme Court decision lowered the bar further, holding that plaintiffs need only show data faced a "significant risk" of unauthorized access rather than prove it was actually viewed -- directly relevant when the underlying complaint is that a third-party vendor's cloud servers held audio of thousands of unconsented conversations. Layer in the federal Wiretap Act (18 U.S.C. Section 2520), which authorizes the greater of $100 per day of violation or $10,000, plus punitive damages and attorney's fees recoverable in federal court, and it's clear why the Sutter/MemorialCare case was filed there alongside the state claims.
HIPAA compliance does not close this gap, and providers who assume it does are the ones getting sued. The Privacy Rule doesn't require special patient consent to document a treatment encounter -- documentation is a permitted use -- but that permission is entirely a HIPAA-side answer to a HIPAA-side question. It says nothing about a state wiretap statute that requires consent to record in the first place. Separately, an AI scribe vendor is squarely a HIPAA Business Associate: it receives, creates, and transmits PHI -- raw audio, transcript, and the drafted note -- on the covered entity's behalf, which means a signed Business Associate Agreement has to exist before the first transcription, not get retrofitted after go-live, and that BAA needs AI-specific language covering voice capture, transcription, NLP processing, retention, and an explicit prohibition on using patient audio to train or fine-tune the vendor's models. OCR collected $9.9 million across 22 HIPAA settlements in 2024 alone, and missing or inadequate BAAs remain a recurring cited finding -- a gap AI scribes reintroduce every time a new vendor gets bolted onto the documentation workflow without the underlying paperwork catching up.
This is exactly the failure mode 45 CFR 164.308(a)(1) exists to catch. The Security Rule's foundational requirement is an accurate and thorough risk analysis covering every system, in every form, that creates, receives, maintains, or transmits ePHI. An ambient scribe's actual data flow -- a clinician's phone or workstation microphone, a vendor's cloud transcription and NLP pipeline, and a write-back into the EHR -- is precisely that kind of system, yet in most practices it went live well after the last documented Security Risk Assessment and was never added to the technology asset and vendor inventory that risk analysis is supposed to track. The pending HIPAA Security Rule overhaul (NPRM published January 6, 2025) would make this omission explicit: a continuously maintained technology asset inventory and network data-flow map, mandatory rather than the "addressable" safeguard a smaller practice could historically skip. A Security Risk Assessment finished before your practice turned on an AI scribe isn't current documentation -- it's a description of a network that no longer exists.
It's tempting to read Sharp, Sutter, and MemorialCare as a big-hospital problem, given the size of those systems and the enterprise vendor involved -- Abridge, which won Best in KLAS in the Ambient Speech category in both 2025 and 2026. But the vendor landscape reaches much further down-market. Enterprise platforms like Abridge, Ambience Healthcare, and Microsoft Dragon Copilot compete for health-system contracts, while Suki, Nabla, DeepScribe, and Freed target solo practitioners and small groups -- dental offices, behavioral health practices, physical therapy clinics, urgent cares -- with self-serve pricing as low as $99-$149 per month and no IT department required to turn it on. CIPA and CMIA don't scale their penalty structure to practice size. A five-provider clinic in Carlsbad or Escondido recording a full day of unconsented visits accumulates the same $5,000-per-violation exposure as a hospital system, without a hospital system's legal budget to absorb a class action.
The fix set is specific, and it maps directly onto what the Sharp complaint alleges was missing: encounter-specific verbal consent captured at the start of each visit rather than a signature buried in a new-patient intake packet, a pre-visit written notice describing what's recorded and where it goes, a visible or audible indicator that recording is active, and a written authorization kept on file. The Sharp complaint's most damaging allegation isn't the recording itself -- it's that the documentation system auto-inserted language claiming consent had been obtained when it hadn't, which turns a consent gap into an allegation of falsified medical records. None of that substitutes for the underlying compliance step: adding the AI scribe to the Security Risk Assessment's technology and vendor inventory, mapping its audio-to-cloud-to-EHR data flow end to end, and confirming a signed, AI-specific Business Associate Agreement is in place with the vendor before the next patient walks into the exam room.
Mytek Pros conducts HIPAA, SOC 2, and NIST-aligned compliance audits for California healthcare practices and the organizations that support them, and a Security Risk Assessment scoped to include AI documentation tools -- ambient scribes, transcription vendors, and the EHR write-back paths they create -- is exactly the review this article describes. As a licensed low-voltage contractor and Managed Service Provider (License #1116987) with DIR public-works registration (PW-LR-1001158430, BICSI certified, DBE/DVBE/MBE certified) based in Carlsbad and serving San Diego County and businesses throughout California, we also build the network segmentation, encryption, and access-control infrastructure that supports a defensible audit trail, and our managed IT and managed security services (typically $125-$250 per user per month) keep vendor BAAs, MFA enforcement, and monitoring current as new AI tools get added to the stack. If your practice has deployed -- or is about to deploy -- an ambient AI scribe and hasn't updated its Security Risk Assessment to cover it, contact Mytek Pros at (619) 353-5702 or inquire@mytekpros.com before a plaintiff's attorney finds the gap for you.
Questions about audits? Get in touch or explore our Audits services.