Johns Hopkins Bayview Told 3,182 Patients Their Records Went Into an Unapproved AI Tool

Johns Hopkins Bayview Medical Center has started notifying about 3,182 patients that a spreadsheet of their health information was uploaded to a public AI tool the hospital had not cleared for that use. The Baltimore hospital says it discovered the upload on September 21, 2026, during an internal review, and that a staff member had put the file into an outside platform the same day.

The spreadsheet covered patients admitted and treated between May 2026 and September 2026. According to the hospital notice, the exposed fields may have included patient names, dates of admission and treatment, medical record numbers, account numbers, the department that treated them, medications administered and the names of their providers. Social Security numbers, financial account details and other identifying information were not part of the file, the hospital said.

The response followed a familiar sequence. The hospital opened an investigation, and the employee deleted the AI prompt, the conversation thread and the uploaded document from the tool history. Johns Hopkins Bayview also asked the company operating the AI tool to delete the data, and says it has added measures intended to stop a repeat.

Notification letters began going out on October 22, roughly a month after discovery. They explain how to enroll in 12 months of free credit monitoring through Experian IdentityWorks. The hospital has also stood up a toll-free call center at 1-833-931-7766, engagement number B174716, open Monday to Friday from 8 a.m. to 8 p.m. Central time.

The policy changes are the usual mix: tighter limits on unapproved applications and AI tools, retraining for staff on which tools the hospital has sanctioned, and a review of how protected health information is handled. None of that is unusual, and none of it addresses the underlying problem, which is that a consumer chat window is one paste away from any employee with a spreadsheet and a deadline.

The data itself is more sensitive than the absence of Social Security numbers suggests. A combination of admission and discharge dates, a treating department, a medication list and a record number is often enough to re-identify a patient inside a small clinic population, and medication plus department can disclose a diagnosis by inference. That is why health systems treat this class of exposure as a reportable event rather than a training failure.

There is also a forensic problem the notice glosses over. Because the employee deleted the thread and the document from the tool history, the hospital is relying on the vendor to confirm deletion on its side. Consumer AI products vary widely in whether they retain prompts for abuse review, model improvement or logging, and a deleted conversation is not proof of a deleted record.

The incident belongs to a pattern rather than a one-off. Shadow use of consumer chatbots is now the most common route by which health data leaves a hospital, and the controls that work are boring: an explicit approved-tool list, network blocks on everything else, logging for sanctioned tools, and a fast path for staff who need to summarize a spreadsheet without pasting it into a stranger's model. Bayview has promised the first two. The logging and the fast path are the parts that would actually have caught this on September 21 rather than after the fact.