This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A class-action lawsuit alleges that Sharp HealthCare used the Abridge AI app to secretly record doctor-patient conversations without consent and that the AI automatically fabricated consent statements in medical records.
A proposed class-action lawsuit alleged that Sharp HealthCare, a California health system, used Abridge, an AI medical scribe, to record patient-clinician conversations without notice or consent and send sensitive audio to the vendor. The documentation workflow allegedly inserted false statements that patients had been informed and consented. Patient Jose Saucedo said he discovered the recording through his medical notes.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The AI tool automatically generated and inserted false statements into medical charts claiming patients had consented to the recording.
The AI system recorded highly confidential doctor-patient conversations containing sensitive medical details and transmitted them to external servers without patient authorization.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The primary privacy risk was caused by the human decision of Sharp HealthCare to intentionally deploy the AI recording tool without establishing a proper patient consent process.
Added categories peak at 3: Substantial (Epistemic Harm, Inferred)
A class-action lawsuit alleges Sharp HealthCare deployed the Abridge AI app to record doctor-patient conversations without consent and automatically fabricate consent statements in medical records. While raising significant domestic privacy and data integrity issues for over 100,000 patients, the national security impact remains negligible.
The Abridge app acts as an assistant that records conversations and generates draft medical notes to help clinicians, but it operates under the context of clinical documentation and requires human oversight.
High Risk: The AI system is used in healthcare to document clinical interactions and generate medical notes, which directly impacts patient health records and falls under high-risk AI applications.
The AI system's primary function is to record clinical conversations and generate draft medical notes to assist healthcare providers.
The report clearly details the parties involved, the specific AI tool (Abridge), the nature of the privacy violation, and the specific technical failure of fabricating consent notes.
None
Technology
Automated False Documentation
AI automatically inserted incorrect consent statements into patient charts.
Unsecured Cloud Transmission
Audio sent to vendor servers where employees could review sensitive data.
Data Inputs
Missing Consent Verification Data
System lacked structured data inputs to verify actual patient consent.
Human Factors
Failure to Inform Patients
Clinicians did not notify patients or seek consent before using the AI.
Process and Methods
Flawed Note Automation Process
AI note-generation process assumed consent and hardcoded it into drafts.
Lack of Opt-Out Mechanism
No process was established for patients to opt-out of AI recording.
Management
Hasty AI Tool Rollout
Sharp deployed Abridge without establishing proper consent protocols.
Poor Vendor Oversight
Management failed to audit the AI's automated note-drafting behaviors.
Regulatory Environment
Strict Two-Party Consent Laws
California law mandates consent from all parties before recording.
Medical Privacy Regulations
CMIA requires written authorization before sharing patient data with vendors.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
