Johns Hopkins: 3,182 patients' data sent to unapproved AI

What happened?

Johns Hopkins Bayview Medical Center in Baltimore is notifying about 3,182 patients that their health information may have been exposed (WMAR-2 News). According to the hospital, on September 21, 2026, during an internal review, a staff member uploaded a spreadsheet of patient information to an outside AI platform not cleared for that use. The problem was discovered the same day.

What data was involved?

• The spreadsheet covered patients admitted and treated between May and September 2026.
• It may have included names, admission and treatment dates, medical record numbers, account numbers, treating department, medications given and provider names.
• The hospital says no Social Security numbers or financial account details were included.

What the hospital did

The staff member deleted the prompt, the thread and the document from the tool's history. The hospital asked the AI tool's operator to delete the data and is strengthening its policies and training, including limits on unapproved apps and AI tools and retraining on approved tools. Notification letters started going out on October 22, and affected patients get 12 months of free credit monitoring.

Why it matters

This is a textbook shadow AI case: no attack, just an employee trying to work faster with a public chatbot. It shows that bans alone are not enough without an approved, safe alternative at hand. Healthcare, education and public sector organizations should publish a clear list of approved AI tools, put technical controls (DLP) in front of personal data uploads and train staff regularly. In the EU, a similar incident could count as a personal data breach under GDPR.