Busy doctors have embraced AI-powered devices that record patient conversations and automatically generate visit notes. 

But the expansion of what are commonly known as ambient notetakers may also be exposing medical professionals to unexpected legal risks.

Some researchers are increasingly concerned about what is known as bycatching — inadvertent recordings of people and potentially sensitive conversations that aren't directly involved in the healthcare visit.

"Most people who are visiting a patient are not expecting to be recorded," said I. Glenn Cohen, a health law professor at Harvard University who recently published a paper about inadvertent recordings in healthcare. "On the flip side, I think many clinicians are not thinking seriously of the likely liability issues."

With the healthcare industry quickly adopting these tools, AI advocates say they allow doctors to passively record important clinical information while focusing on the patient.

However, the use of AI scribes has already led to lawsuits from patients alleging that their healthcare visits were recorded without their agreement.

Cohen, who co-authored a paper on the legal landscape on ambient AI in the New England Journal of Medicine in May, said bycatching has raised legal questions about what happens when a device records somebody who hasn't given consent to be recorded in a healthcare setting.

"There's no reason that individual clinicians, for example, should know much about eavesdropping or wiretapping laws, and this is one of the big legal risks that we think exists," he said.

Carmel Shachar, faculty director of Harvard Law School's Health Law and Policy Clinic, told Law360 that hospitals in particular will have to consider whether they must obtain informed consent from visitors or contractors who may be within earshot of ambient recording devices.

With little legal guidance on bycatching, preventing inadvertent recordings also raises practical complications. If an ambient notetaker captures a conversation with a third party, whether legal liability lies with the clinician or the health system will likely depend on location and state law nuances, said Shachar, an assistant legal professor.  

"I think most clinicians are unlikely to be aware of the relevant laws because ambient AI is a new development and bycatching is a complex legal issue," Shachar said. 

Shachar added that it's likely to come down to each individual state's eavesdropping or wiretapping laws, which vary. In California, for example, consent is required of all parties to be recorded.

Ambient AI notetakers also run the risk of catching criminal activity, raising another set of questions about duties to report.

For example, in a nursing home facility, an ambient listening device could capture a troubling patient interaction. While an AI notetaker isn't designed to monitor for elder abuse, Shachar said this situation could raise questions about whether a facility or clinician has an obligation to report that kind of captured information to law enforcement.

Shachar also wondered if providers and hospitals have a responsibility to review AI-generated notes for evidence of abuse or other criminal activity.

"Another wrinkle is whether it would be the clinician or the health care system … who would face liability," Shachar said.

In his paper, Cohen reviewed a patchwork of eavesdropping and wiretapping laws, finding that 34 states require one-party consent, while 16 require all-party consent. Some states have "mixed standards."

"In the latter jurisdictions, institutions and clinicians face potential civil and criminal penalties for failing to obtain consent from all recorded parties, a risk compounded by 'bycatching' incidental conversations in shared clinical spaces," the paper says.

David A. Simon, a health law professor at Northeastern University, said that healthcare facilities will need to educate clinicians and vet the technology.

Doctors should also be aware that patient visit recordings can pick up third-party conversations, and any such captured information should be deleted.

"They also have to pay attention to state laws and carefully parse what exposes them to liability under the law," he said.

The potential for liability from ambient AI bycatching falls against a backdrop of new legal cases focused on AI and informed consent.

So far, at least two lawsuits have already been filed accusing providers of not informing patients they were recorded during their doctor visits.

In December 2024, patient Jose Saucedo filed a proposed class action lawsuit in California alleging that during his treatment at Sharp Healthcare the system failed to notify him of the use of ambient AI or seek his consent.

"Defendants did not ensure that patients received clear, conspicuous pre-visit notices that recording might occur, did not use standardized scripts requiring providers to obtain verbal consent on the record, and did not provide reliable visual or auditory indicators that recording was active," Saucedo claimed in his complaint.

The San Diego man accused Sharp Healthcare of violating the California Invasion of Privacy Act, California's Confidentiality of Medical Information Act, the state's unfair competition law and negligent representation.

Cohen said that the Sharp Healthcare lawsuit likely caught general counsel at hospitals off guard. While hospital lawyers were experienced with HIPAA, the idea of wiretapping and eavesdropping claims against hospitals was off their radar, according to Cohen.

"The idea that there's this separate overlay from these laws is something that I don't think they necessarily had registered," he said.

Since the Sharp lawsuit, at least three other patients have filed proposed class actions claiming use of an ambient AI tool without first obtaining consent violates numerous state and federal laws.

In April, three California patients filed a lawsuit against Sutter Health, Memorial Health Services Inc. and MemorialCare Medical Foundation for violating the California Invasion of Privacy Act and the California Confidentiality of Medical Information Act.

Those patients also claim that those healthcare systems didn't get their informed consent to be recorded by Abridge AI, an "ambient clinical documentation system," according to the lawsuit.

They also brought claims under the Federal Wiretap Act, which they say gives them a private right of action.

"Communications between a patient and a physician during a medical appointment constitute protected communications under the statute because they involve private discussions concerning medical symptoms, diagnoses, treatment plans, and other confidential health matters," according to the suit.

Jennifer Kreick, co-chair of Haynes Boone's healthcare and life sciences practice group, told Law360 these new legal theories aren't necessarily traditional healthcare privacy claims.

"While these cases remain in the early stages and many of the legal questions have yet to be resolved by the courts, they highlight the potential risks that can arise when ambient AI captures communications," she said via email.

As ambient AI listening devices become more ubiquitous, clinicians and healthcare systems need to be more transparent about their use. They should be upfront about what the notetaker might capture, how doctors and systems will use the information and how long the records will be kept.

"They should provide notices to everyone entering into the space being recorded and obtain consent," Shachar said.

Sharp Healthcare and Sutter Health declined to comment. The plaintiffs and Memorial Health Services Inc. didn't respond to requests for comment.

--Editing by Amy Rowe and Leah Bennett. 

For a reprint of this article, please contact reprints@law360.com.