Your AI scribe's BAA covers HIPAA. It doesn't cover this $5,000-a-patient lawsuit.

Three California patients filed a proposed federal class action on April 8, 2026 against Sutter Health and MemorialCare, alleging their AI ambient scribe recorded clinical conversations without informed consent (Washington et al. v. Sutter Health, N.D. Cal., Case No. 4:26-cv-03012-KAW, via Northeastern University School of Law, July 2026). The scribe vendor, Abridge AI, had a signed Business Associate Agreement in place. The plaintiffs are not claiming a HIPAA violation. They are suing under California's wiretap law, which pays $5,000 per violation with no need to prove any actual harm.

That distinction is the one most physio practice owners weighing, or already running, an AI scribe have never been told. A vendor's sales pitch usually stops at "we sign a BAA, so you're covered." HIPAA compliance and consent to be recorded are two separate legal questions, governed by two separate bodies of law, and a signed BAA only answers one of them. Below are six questions physio owners are asking about where that leaves them, answered with sources rather than sales copy.

1. Is my AI scribe HIPAA compliant if the vendor signed a BAA?

Largely yes, and this part is worth taking at face value. Any vendor that creates, receives, maintains, or transmits protected health information on a practice's behalf meets the definition of a business associate under 45 CFR 160.103, and is required to sign a BAA before touching a single session recording (U.S. Department of Health and Human Services, HIPAA Business Associate guidance). Major ambient scribe vendors, including Abridge, Nuance DAX, and Suki, do sign BAAs with their healthcare clients (reporting on the Sutter Health case, via Northeastern University School of Law, July 2026). That agreement should also spell out audio and transcript retention periods, whether recordings are used to train the vendor's models, and breach notification terms, details worth reading rather than assuming.

So what for you: a signed BAA genuinely satisfies HIPAA. It was never designed to answer the next question, and treating it as if it does is the gap that's now showing up in court filings.

2. Does that BAA protect my practice if a patient sues over the recording itself?

No, and this is the finding behind the Sutter Health case. The plaintiffs do not allege a HIPAA violation. They allege that recording a clinical conversation without informed consent violated the California Invasion of Privacy Act, the state's Confidentiality of Medical Information Act, and the federal Wiretap Act. The legal theory, as described in coverage of the case, is that the violation occurs at the moment of interception, when the recording starts, not later when the data is stored or shared. A downstream BAA cannot undo that first moment. Abridge signs BAAs with its clients as standard; the lawsuit was filed anyway, against the health systems that deployed the tool.

So what for you: HIPAA compliance and recording consent are two separate legal tests. Passing one says nothing about the other, and a vendor telling you otherwise is not a legal opinion you can rely on.

3. Which states require patient consent before an AI scribe can record a session?

California is the one behind the current lawsuit. Penal Code Section 632 requires all parties to consent before a confidential communication can be recorded, and Section 637.2 allows a plaintiff to recover $5,000 per violation without proving any actual harm, a provision the California legislature confirmed applies per violation, not per lawsuit, effective 2017. California is not unique. A number of other states, including Illinois, Pennsylvania, Florida, Massachusetts, and Washington, also require every party to consent to a recording, not just the clinician holding the device. The exact list and its exceptions vary by state and by source, so confirm your own state's current wiretap and eavesdropping statute rather than relying on a vendor's general assurance that "this is legal everywhere."

So what for you: check your specific state's consent requirement before assuming a one-party-consent rule protects you. If you operate across state lines, build your process around the strictest state you're in, not the most permissive.

4. Does Texas's new AI law affect how I use an AI scribe in my clinic?

If you practice in Texas, yes. The Texas Responsible AI Governance Act took effect January 1, 2026 and requires healthcare providers to clearly disclose AI system use in treatment contexts, giving patients awareness of, and the ability to decline, the AI-assisted parts of their care (Baker Botts, "Texas Enacts Responsible AI Governance Act," July 2025). A companion law, Senate Bill 1188, goes further for anyone running an AI scribe: it requires a provider to review every AI-generated medical record against Texas Medical Board standards before it's finalized, and restricts sending those records offshore for processing. Even outside Texas, both requirements describe good practice regardless of which state you're in: tell the patient before the microphone turns on, and never let an AI-drafted note reach the chart without a clinician reading it first.

So what for you: if you have a Texas location, confirm your disclosure and review workflow meets TRAIGA and SB 1188 specifically, not just HIPAA. If you don't, treat both as a preview of where other states are likely headed.

5. What should my consent process actually look like before the microphone turns on?

A spoken disclosure at the start of every session that names the tool and gives the patient a real chance to decline, not a line buried in a new-patient intake packet signed once and forgotten. The Sutter Health complaint specifically alleges that patients received no clear notice that a conversation would be recorded, transmitted outside the clinic, and processed by a third party. Separately, some ambient scribes have been documented inserting template consent language into the finished note that didn't reflect what actually happened in the room, according to a 2026 compliance analysis, which turns a missing consent conversation into a fabricated one on paper. Don't let the software write your consent record for you.

So what for you: script the disclosure, say it out loud every session, and keep the record of that disclosure separate from the AI-generated note itself.

6. Are AI scribe notes accurate enough to trust without checking them?

Not without a clinician reading every one. Industry compilations of peer-reviewed evaluations put the hallucination rate for ambient AI clinical notes at roughly one in five to one in three, a range wide enough that it should be treated as a reason for mandatory review rather than a precise figure (composite of published evaluations, cited via industry clinical notes compliance guides, 2026, vendor-adjacent source, flagged accordingly). The American Physical Therapy Association's own practice advisory on AI-enabled ambient scribe technology, published September 19, 2025, sets out documentation responsibilities and reviews the evidence behind these tools' benefits and limits for physical therapy specifically (American Physical Therapy Association, September 2025).

So what for you: treat every AI-drafted note as a first draft, not a finished record, and build the review time into your workflow before you build the time savings into your marketing.

The bottom line

A BAA is not optional, and it is not the finish line. Three moves are worth making this quarter regardless of which state you practice in: confirm your scribe vendor's BAA explicitly addresses audio retention and model training, script a spoken consent disclosure for every session rather than relying on paperwork signed once at intake, and build a mandatory human review step into every AI-drafted note before it reaches the chart. None of these cost anything beyond a few minutes of setup. The Sutter Health case is one lawsuit against two health systems, not evidence that ambient scribes are unsafe to use. It is evidence that "we signed a BAA" and "we're covered" are not the same sentence, and the practices treating them as identical are the ones a plaintiff's firm will find next. For the economics of choosing a scribe in the first place, see our bundled versus standalone AI scribe decision, and for the wider question of which AI tools are even allowed to touch patient data, see ChatGPT versus a purpose-built AI scribe.

Related: $15 vs $150: the physio AI scribe decision  ·  $20 vs $150: ChatGPT or an AI scribe  ·  6 HIPAA questions solo clinicians ask about AI, answered

This article is for informational purposes only and does not constitute legal advice. State wiretap, consent, and AI disclosure laws vary and change; confirm current requirements with a licensed attorney in your state before changing your practice's consent process.