Johns Hopkins Bayview employee uploaded patient spreadsheet to unapproved public AI tool, exposing records of about 3,182 patients
An employee at Johns Hopkins Bayview Medical Center in Baltimore mistakenly uploaded a spreadsheet of patient information to a public third-party AI tool that the hospital had not approved for this use. The data may have included patient names, admission and treatment dates, medical record numbers, account numbers, medications and provider names, but not Social Security numbers. The exposure was found during an internal review on Sept. 21, and the hospital sent letters to approximately 3,182 patients offering 12 months of free credit monitoring. The hospital deleted the prompt and document from the tool's history and asked the AI tool's operator for further deletion.
What the AI did
A hospital employee mistakenly uploaded a spreadsheet of patient information to a public AI tool run by an outside company, which the hospital had not approved for this use. It has not been reported which AI tool was used, and nothing is reported about what the tool did with the data beyond receiving it.
First reported October 26, 2026 · Added to the register November 4, 2026 · 1 source
- Patients notified
- approximately 3,182
- Deployer
- Johns Hopkins Bayview Medical Center
- Affected
- Johns Hopkins Bayview patients
- When it happened
- Not stated in the sources
- First reported
- October 26, 2026
What this means for you
Could this affect you?
If your staff can reach public AI tools from work systems. Details such as names, medical record numbers, account numbers and medications for about 3,182 Johns Hopkins Bayview patients may have been exposed. Any healthcare provider whose staff can use public AI tools at work faces the same risk.
What to check
- Block or monitor uploads of patient health information to unapproved public AI tools.
- Provide staff with approved AI tools as alternatives.
- Train staff on which AI tools may handle patient data.
- Keep an incident plan for asking AI vendors to delete data and for notifying affected patients.
Areas of your AI programme this touches
Every fact and its source (7)
- Date exposure discovered in internal reviewSept. 21“officials were conducting an internal review on Sept. 21 at Johns Hopkins Bayview Medical Center”[1]
- Data possibly exposedPatient names, admission and treatment dates, medical record numbers and more“the data may have included patient names, dates of admission and treatment, medical record numbers, account numbers, departments of service, medications administered and provider names”[1]
- Tool approval statusAI tool not approved by the hospital for this purpose“the AI tool was not approved by the hospital for this purpose”[1]
- Hospital responseContacted AI tool operator for deletion and corrective measures“contacted the company that owns and operates the AI tool for further deletion and corrective measures”[1]
- How the exposure happenedEmployee uploaded a spreadsheet to a public third-party AI tool“mistakenly uploaded a spreadsheet to a public third-party AI tool”[1]
- Data not includedNo Social Security numbers or financial account information“the information did not include Social Security numbers, financial account information or other identifying information”[1]
- Remedy offered to patients12 months of free credit monitoring via Experian IdentityWorks“12 months of free credit monitoring through Experian IdentityWorks”[1]
Sources
- Bayview warns 3K patients after AI tool upload exposed recordswbaltv.com · October 26, 2026
How this record is classified. Severity S (4/5): real harm to one organisation, data exposed, or a containment failure. OECD level: incident, an event in which an AI system led to actual harm. Evidence: Confirmed, meaning a company, official or court statement.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
