Johns Hopkins Bayview Tells 3,182 Patients Their Records Reached an AI Tool
A hospital employee uploaded a spreadsheet of patient data to a public platform without permission, and the incident was found on Sept. 21, 2026.
By Louis Bennett ·
At Johns Hopkins Bayview Medical Center in Baltimore, the hospital has begun notifying 3,182 patients that their clinical records were loaded by an employee onto a public artificial intelligence platform that the institution had not approved. The material included a spreadsheet with patient names, medical record numbers, admission dates and treatment details covering May through September of this year.
Hospital representatives said the exposure did not cover Social Security numbers, banking information or financial records.
The problem surfaced on Sept. 21, 2026, when the incident was detected. Internal investigations followed, and the hospital detailed what occurred. After the discovery, the employee deleted the file, the prompts and the chat history. The medical center's cybersecurity team also asked the provider of the AI tool to remove any remaining copies from its servers.
To address the exposure, the institution is offering a year of credit monitoring at no cost to those affected and has set up a telephone line for questions about the incident.
The episode returns attention to a practice called shadow AI in health care and to the requirements of federal HIPAA rules for protecting patient data when digital tools are used.
Details on the investigation and the health center's official position are available in coverage from CBS Baltimore and in a cybersecurity report from Wisevoter Baltimore. WMAR 2 News Baltimore has also broadcast a report on the matter.
The notifications to patients are underway as of Oct. 27, 2026.
Source: Latin Opinion · original report published
