Washington DSHS employee used personal ChatGPT account for patient notes, potentially exposing youth mental health patients' data
A staff member at Washington's state-run Lake Burien Transitional Care Facility, which cares for youth with intensive mental health needs, used a personal ChatGPT account to draft client case note summaries. Patients' names, diagnosis specifics and medications may have been exposed. The facility contacted families of a dozen patients in mid-August, and the Department of Social and Health Services (DSHS) said four patients at Western State Hospital were also potentially exposed in a similar breach. DSHS said Social Security numbers were not breached and there was no evidence of further disclosure. Staff were reminded of the agency's policy, and the Lake Burien employee deleted their prompts and account.
What the AI did
A staff member at a state-run youth mental health facility used a personal ChatGPT account to draft summaries of client case notes. Patients' names, diagnosis specifics and medications may have been exposed as a result. The state said a similar potential exposure affected four patients at Western State Hospital.
First reported November 2, 2026 · Added to the register November 8, 2026 · 1 source
- Lake Burien patients whose families were notified
- A dozen (12)
- Western State Hospital patients potentially exposed
- 4
- Deployer
- Lake Burien Transitional Care Facility
- Model
- ChatGPT (personal account)
- Affected
- Youth with intensive mental health needs
- Country
- United States (Washington)
- When it happened
- Not stated in the sources
- First reported
- November 2, 2026
What this means for you
Could this affect you?
If your staff can use personal AI chatbots with patient or client data. Any organisation whose staff handle sensitive personal data, especially health data, could expose it the same way when employees put it into personal AI chatbot accounts without approval, as happened at Lake Burien.
What to check
- Block or monitor use of consumer AI chatbots on clinical devices.
- Give staff an approved tool for drafting notes that meets HIPAA, the US health privacy law.
- Back AI-use policies with staff training.
- Run breach notification when protected health information reaches unapproved AI services.
Areas of your AI programme this touches
Every fact and its source (5)
- When ChatGPT use was reportedJuly“draft a summary for client case notes in July”[1]
- Data potentially exposedNames, diagnosis specifics, medications“Details including patients’ names, diagnosis specifics and medications may have been exposed”[1]
- ResponseEmployee deleted prompts and account“was instructed to delete all prompts before deleting their account, which they did”[1]
- Agency policyAI use requires agency approval“Staff may not use AI without approval from the agency”[1]
- Data not breachedSocial Security numbers not breached“Information like Social Security numbers was not breached”[1]
Sources
- AI use leads to potential privacy breach at WA mental health facilitiesyakimaherald.com · November 2, 2026
How this record is classified. Severity S (3/5): real harm to one organisation, data exposed, or a containment failure. OECD level: incident, an event in which an AI system led to actual harm. Evidence: Confirmed, meaning a company, official or court statement.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
