The AI disclosure script is part of the deployment

A Pittsburgh-area patient filed a proposed class action on October 30 against Allegheny Health Network and Highmark. According to the reporting, she was told only that "an AI tool" would be used at a follow-up visit after a hospital stay. The complaint says nobody told her the full conversation would be recorded, sent to the vendor, kept there and possibly used to train the vendor's models. The tool, Abridge, had been rolled out to about 400 providers across more than 40 specialties.

These are allegations, and the court will sort out the law. The part CIOs should not wait on is simpler. The clinician in that room could only explain what the organization had told them. If the answer the patient heard was "an AI tool," that sentence was written, or left unwritten, long before the visit.

This is the second question from the agent sprawl checklist, seen from the other side. Governance is not only which agents run. It is what the people on the other end of them are told.

Where the decision actually sits

None of those answers live in the exam room. Every one of them is set by procurement, legal, security and IT before the first visit. A clinician handed a one-line script cannot fill the gap with good intentions.

A checklist for any AI tool that listens or watches

1. Map the data flow before the pilot. Write down what is captured, where it goes, who holds it, how long it is kept and how it is deleted. If the vendor cannot answer in writing, the pilot is not ready.
2. Read the training clause. "May be used to improve our services" is a training clause. Decide whether you accept it, and if you do, say so to the people being recorded.
3. Write the disclosure script centrally. One short paragraph, in plain words, that answers the five questions in the table above. Clinicians should never have to improvise it.
4. Record consent per encounter, not per policy. A signed intake form from last year is not consent to record today's conversation. Log the consent with the session.
5. Make "no" cheap. If declining the tool means a longer wait or a worse note, the consent is not real. Test the opt-out path the way you would test a failover.
6. Check the wiretap law where the conversation happens. The complaint relies in part on Pennsylvania's all-party consent law. Several states require every party to agree before a conversation is recorded. Your counsel, not your vendor, should tell you which apply.
7. Treat sensitive settings as their own tier. Behavioral health, follow-up after a hospital stay, anything involving minors: the default should be off, with an explicit opt-in.
8. Audit what was actually said. Sample visits and ask patients what they were told. The gap between the script and the room is the risk you are carrying.

What we do in the lab

We hold our own work to the same rule at a smaller scale. Our camera project, oak-events, publishes a data flow document that says plainly what leaves the device (detections and depth, never images) and what is stored. It also says what the software does not yet do: it does not delete old event files on its own. Writing that sentence down was uncomfortable. It is still better than a user finding it out later.

The lesson from Pittsburgh is not "do not use ambient AI." The tools save clinicians real time. The lesson is that the disclosure is part of the system you deploy. If it was not designed, tested and owned, the deployment was not finished.

Not legal advice. Sources: TribLIVE, "Lawsuit: AI recording tool used by AHN, Highmark violates patient rights," Paula Reed Ward, October 30, 2026; The Aigentic wire summary of the complaint, October 30, 2026.