A recent lawsuit filed in San Diego Superior Court alleges that Sharp HealthCare recorded conversations between doctors and their patients without written consent, using the information to document visits with an artificial intelligence program developed by a private company in Pittsburgh.
While the lawsuit focuses on one particular medical provider in San Diego County, attempting to create a class-action claim made up of Sharp patients, it also shines a spotlight on the quiet, but broad adoption of AI-powered clinical transcription software throughout mainstream medicine.
A survey of San Diego medical providers made after the lawsuit was filed on Nov. 26 shows that several providers in the region are using similar systems.
Rady Children’s Hospital in San Diego said in an email that it is “currently conducting a limited pilot of ambient scribing technology with clinicians required to obtain patient consent prior to use.” UC San Diego Health confirmed that it uses a system called Nabla, which it installed “after a thorough security review.” The university health system says that it requires patient consent before using the system, which includes “an annual written consent (plus) verbal consent from the patient and all parties in the exam room at each visit.” Kaiser Permanente said in a statement that its clinicians “have access to a clinical documentation assistance tool that supports them with securely capturing initial clinical notes during visits with patients, which enables them to focus more on patient care.” Kaiser says its system “calls for the care team to ask our patients and other individuals accompanying them for their permission before using the tool.”
Scripps Health, one of the big four medical providers in the San Diego market, declined to discuss whether it uses such a system, saying in a statement that it “isn’t a topic we will be discussing.”
Paradise Valley Hospital said it is not using any sort of AI note-taking system, while Palomar Health and Tri-City Medical Center in North County did not respond to the query.
Asked for comment on the lawsuit’s allegation that it did not properly inform patients of its medical documentation system, Sharp said that while “patient safety and privacy are our top priorities at all times,” it is “unable to comment on pending litigation.”
The lawsuit, filed on behalf of Sharp patient Jose Saucedo by attorney Robert Salgado, seeks certification as a class action, and alleges that Sharp violated medical privacy laws “by surreptitiously recording entire medical consultations using electronic recording devices and cloud-based processing systems without notice or consent.”
The suit seeks unspecified compensatory and punitive damages, also stating that the state penal code allows damages of $5,000 per violation.
Recordings, the lawsuit states, were transmitted to Abridge, a Pittsburgh-based technology company that has recently received major tech sector investment in its AI-enabled system, which it said in a news release on Dec. 10 is now used “across more than 200 ambulatory care settings annually.”
The company has posted information on its website that helps its customers and the public learn about how it operates.
A “recording basics” entry in the company’s customer support center does urge clinicians to “make sure you follow your organization’s recommended guidelines for patient consent,” even providing sample language that could be used in such situations.
Abridge suggests that doctors could say: “I will be using a tool that records our conversation to help me write my clinical note, so I can pay more attention to our conversation and less time on the computer. Is that okay with you?”
The technology uses an application installed on a physician’s smartphone to make the recording, which a list of “best practices” indicates should be placed “in between you and your patient without any obstructions.” Abridge also says on its website that its technology is “100% HIPAA-compliant, and uses industry best practices to protect patient information,” indicating that the data it collects “is always stored via secure channels” that comply with HIPAA, the Health Insurance Portability and Accountability Act of 1996, which prevents unauthorized disclosure of sensitive patient information.
But Abridge also indicates in the privacy policy for its website that it creates separate privacy agreements with each of its clients, directing patients to “refer to your provider’s Notice of Privacy Practices for information on how they handle your (protected health information). Sharp does list a privacy policy on its website, though the document is dated April 14, 2003.
Abridge indicates that it complies with the California Consumer Privacy Act and on its website it says that it meets “System and Organization Controls” level two requirements created by the American Institute of Certified Public Accountants. Those rules specify how digital information should be kept secure against unauthorized access, free of corruption and private. Abridge indicates that its compliance with SOC 2 rules has been “validated by an independent third-party auditor for security and confidentiality.”
A public statement that Abridge published on its website in 2020 says that it used 10,000 hours of transcribed conversations between doctors and patients to train its AI models, and that this “deidentified” information came from “fully informed and consenting patients.” A separate statement in 2020 indicates that all research and development uses de-identified data and that such information is “acquired with patient consent.” But it is not clear whether or not the company uses the real-world conversations transmitted from its clients to Abridge’s servers for analysis to train future generations of the company’s models.
The company did not respond to a request for comment on the matter.
Privacy advocates are increasingly concerned about the quick-moving world of AI as it enters the world’s most sensitive spaces.
Sara Geoghegan, senior legal counsel for the Electronic Privacy Information Center in Washington, D.C., said that it is quite clear that patient permission is required when recordings are being made.
“Definitely, transparency is a necessary step as is disclosure and meaningful consent,” Geoghegan said.
And that consent, she added, should not just be obtained once. It should be obtained on its own, she added, and not tacked onto the voluminous paperwork process that patients often must wade through during an office visit.
“It should be consent that’s freely informed and can be rescinded,” Geoghegan said. “Once every 10 years is not enough.”
The bigger issue, she added, is when the use of AI in health care moves from simple transcription to decision making. Already, insurance companies have been found to use AI systems to deny claims, a practice that became illegal in 2025 due to a new law, the “Physicians Make Decisions Act,” which requires that determinations of medical necessity be made “only by a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues involved in the health care services requested by the provider.”
“I do think this is where use matters and what the limits of technology are matters,” Geoghegan said. “To me, a doctor that is doing all of the physician work but uses the technology to do some of the note taking, is very different than a situation that involves generative AI, where a doctor is having a conversation with a patient and then a generative AI tool is the one diagnosing and flagging and, you know, doing those tasks that belong to the physician.”
It does not appear that Abridge has crossed that particular Rubicon. The company’s public statements about its products indicate that the main purpose of the system is to accurately document patient-physician conversations, but physicians have to review the resulting information and make necessary corrections before it is added to a patient’s official medical record.
Leave a Reply