Johns Hopkins Bayview: a worker put 3,182 patients' records into an unapproved public AI tool
Johns Hopkins Bayview Medical Center is notifying 3,182 patients admitted and treated between May and September 2026 that a worker uploaded a spreadsheet of their information to a public AI tool the hospital had not approved, per WMAR-2 News (Oct 23), which reports the hospital's notice. The hospital says it discovered the problem on Sept 21 during an internal review; the data may have included names, dates of admission and treatment, medical record and account numbers, treating department, medications given and provider names, but not Social Security numbers or financial account details. The worker deleted the prompt, thread and document from the tool's history; the hospital asked the tool's operator to delete the data, opened an investigation, began mailing letters on Oct 22 and is offering 12 months of Experian credit monitoring. The AI tool is not named and no misuse is reported.
Damage
Protected health information on 3,182 patients shared with an unapproved AI provider; no misuse reported
Sources
WMAR-2 News. Evidence confidence: medium. Dated by discovery (Sept 21); the upload date is not given. Disclosed by patient letters from Oct 22; WMAR's story is timestamped Oct 23, 23:34 UTC. The hospital's own notice could not be located by this run, so the figures are WMAR's account of it. Same pattern as panasonic-hr-data-genai-upload two days earlier: an employee pastes a bulk personnel or patient file into a consumer AI service the organization bans.
Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
