Otter.ai Transcription Tool Records Hospital Meeting Without Consent
An Otter.ai transcription tool autonomously recorded and distributed confidential details from a hospital hepatology rounds meeting to 65 participants in September 2024 without consent. The breach occurred after a former physician who had left the hospital granted the tool access to his personal calendar, which still contained active hospital meeting invitations. Ontario's information commissioner opened an investigation in December 2024.
What happened
On September 23, 2024, Otter.ai, an AI-powered transcription tool, automatically recorded a hospital hepatology rounds meeting without explicit consent. A former physician who had left the hospital in June 2023 had downloaded Otter.ai in September 2024 and granted it access to his personal digital calendar, which still contained meeting invitations from the hospital.
The tool accessed the meeting invitation via the physician's personal email address retained in the hospital's invitation list and autonomously joined the virtual meeting. It recorded the discussion, generated a summary, and automatically emailed both the summary and a transcript link to all 65 meeting participants without user intervention.
Reported impact
Confidential medical information and healthcare staff communications from the hepatology rounds meeting were disclosed to 65 meeting participants without authorization. The breach involved disclosure of health information protected under Ontario's Personal Health Information Protection Act.
Index analysis
The breach resulted from two security gaps: the physician using his personal email rather than his work email for hospital communications contrary to hospital policy, and the meeting organizer failing to remove the physician from meeting invitations after his June 2023 departure. The tool's agentic capabilities, including autonomous calendar integration and automatic meeting participation, enabled the unattended breach.
Governance controls
The hospital had not approved Otter.ai for use. The Ontario IPC opened an investigation, reported the breach on December 17, 2024, and requested the hospital provide updates on its response to recommendations by late January 2026.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.