Johns Hopkins Bayview Notifies 3,182 Patients After Employee Uploaded Records to Public AI Tool
The hospital says no Social Security or financial data was included in the spreadsheet.
By Alessia Diallo ·
Johns Hopkins Bayview Medical Center began notifying 3,182 patients this week that their clinical records were loaded by an employee onto a public artificial intelligence platform the hospital had not approved. The medical center disclosed the exposure on October 27, 2026, more than a month after its internal investigation identified the incident on September 21, 2026.
The uploaded file was a spreadsheet containing patient names, medical record numbers, admission dates and treatment details covering May through September 2026, the hospital said. Representatives said the material did not include Social Security numbers, banking records or other financial information.
After the exposure was identified, the employee deleted the spreadsheet, the prompts and the chat history. The medical center's cybersecurity team also asked the provider of the AI tool to remove any copies remaining on its servers.
Johns Hopkins Bayview is offering affected patients one year of credit monitoring at no cost and has set up a dedicated phone line for questions about the incident. The case concerns a practice known as shadow AI, in which staff use unauthorized tools, and the data handling obligations that federal HIPAA rules place on such tools.
The hospital's disclosure follows its own investigation; additional detail about that inquiry and the medical center's official position appears in reporting by CBS Baltimore and in a cybersecurity report by Wisevoter Baltimore. WMAR 2 News Baltimore also broadcast a segment on the immediate protective steps taken by the medical center.
Source: Latin Opinion
