Breaches and incidents
Johns Hopkins Bayview Medical Center (Baltimore): staff uploaded patient spreadsheet to a public AI tool, 3,182 patients
HIPAA Journal reports a staff member uploaded a spreadsheet with limited data on 3,182 patients (names, admission/treatment dates, departments, account and...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- HIPAA Journal reports a staff member uploaded a spreadsheet with limited data on 3,182 patients (names, admission/treatment dates, departments, account and medical record numbers, medications) to a public AI tool that was not approved for staff use; the error was identified on 21 Sep 2026.
- Root cause: insider error, use of an unapproved public AI tool.
- No attacker; the AI tool’s provider is not named.
- The employee deleted the thread, the medical center asked the provider to delete the data, offered 12 months of credit monitoring and retrained staff on permitted AI platforms.