Loading story…
Several California patients filed a proposed federal class-action lawsuit against Sutter Health and MemorialCare Medical Foundation, alleging the providers used Abridge AI to record, transcribe, and process doctor-patient conversations without informed consent. The complaint, filed in San Francisco, says the ambient clinical documentation tool captured confidential discussions during visits over the past six months, including medical histories, symptoms, diagnoses, medications, and treatment plans, and that patients were not clearly told their conversations would be recorded, transmitted outside the exam room, or handled by third-party systems.
The lawsuit alleges violations of California privacy and medical confidentiality laws, unfair business practices statutes, and federal wiretapping law. Reporting on the case says Abridge’s software converts live speech into text and generates structured clinical notes, and its rapid adoption by major health systems has intensified scrutiny over notice, consent, retention, access controls, HIPAA compliance, Security Rule obligations, patient opt-out rights, and whether providers need business associate agreements when vendors store recordings or transcripts.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
On April 8, 2026, several California patients filed a proposed federal class-action lawsuit in San Francisco alleging that Sutter Health and MemorialCare unlawfully used Abridge AI to record, transcribe, and process doctor-patient encounters without informed consent, in violation of state and federal law.
According to the complaint, medical staff at Sutter Health and MemorialCare used Abridge AI during patient visits over the prior six months, capturing and processing confidential doctor-patient conversations and identifiable medical information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcearstechnica.com
Open sourceismg-cdn.nyc3.cdn.digitaloceanspaces.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several healthcare organizations are resolving class-action litigation tied to alleged exposure of sensitive patient data, with settlements emphasizing cost avoidance rather than admissions of wrongdoing. **Kaiser Permanente** agreed to a **$46 million** settlement over claims that patient interactions with certain Kaiser websites and digital tools resulted in personal health information being transmitted to third parties (including **Google, Microsoft Bing, Twitter/X, and Adobe**) via online tracking/advertising technologies; the allegations focus on web/digital activity rather than Kaiser’s core electronic medical record systems, and the proposed class period spans **2017–2024**. Separately, two healthcare entities reached settlements following **network intrusions** that allegedly exposed protected health information and other sensitive identifiers. **Mystic Valley Elder Services** agreed to pay **$520,000** to settle claims stemming from an **April 2024** incident in which attackers accessed its network and potentially obtained data including SSNs, financial/payment data, credentials, and medical/insurance information affecting **~89,600** people; plaintiffs also alleged delayed detection and notification. **Consulting Radiologists Ltd.** received approval for a **$2.2 million** settlement after a 2024 intrusion affecting up to **583,824** individuals, with allegations including inadequate security controls and delayed breach notification; the organization reported that some impacted records included medical/insurance data and SSNs (for a subset of individuals).
Jun 29, 2026
AI-driven healthcare tools are expanding rapidly, but legal and security protections for patient data often lag behind their clinical ambitions. Reporting highlighted that consumer-facing medical chatbots and AI health offerings from **OpenAI**, **Anthropic**, and **Google** may fall outside **HIPAA** obligations in many common use cases, meaning sensitive health information shared with these services may not receive the same statutory protections as data handled by regulated healthcare providers; experts warned that terms-of-service promises are not equivalent to regulated safeguards and that non-HIPAA consumer health data can be sold or shared with third parties, including data brokers. Separately, an investigation summarized from Reuters described patient-safety concerns tied to “AI-enhanced” medical devices, citing lawsuits and FDA adverse-event reporting that allege AI-related changes contributed to serious surgical injuries. One example involved an AI-updated sinus surgery navigation system where reported malfunctions increased sharply after an AI “enhancement,” though the reporting noted FDA incident data is incomplete and does not by itself prove causation; the same coverage also pointed to a higher recall rate for FDA-authorized medical AI devices versus baseline and described FDA capacity constraints in reviewing AI-enabled devices due to staffing losses in relevant technical teams.
Jun 29, 2026
The U.S. Federal Trade Commission, joined by California and Utah, sued telehealth provider **Hims & Hers** over allegations that it disclosed sensitive patient and health-related information to advertising and technology platforms including **Meta** and **Snap** while representing that it protected user privacy. Regulators say the company used tracking pixels and similar tools from multiple third parties, including Microsoft, Pinterest, Reddit, and X, to collect and transmit users’ website activity and health-related data without adequate disclosure or consent. The complaint also alleges broader consumer protection violations, including charging some users before medical consultations and making subscription cancellations unnecessarily difficult, leading to recurring charges. Hims & Hers said its privacy policy explains users’ choices regarding data use and that it plans to contest the allegations, while the case adds to growing enforcement pressure on telehealth and healthcare firms over the use of advertising trackers on services handling sensitive medical information.
Jul 31, 2026