Johns Hopkins warns 3,182 patients after employee uploads records to unauthorized AI tool
Potentially exposed information included treatment details and medications. The hospital removed the upload from the tool’s history and asked its operator for further deletion.
Listen to this story
The audio brief
Story brief
3 key pointsAn internal review completed by Johns Hopkins Bayview Medical Center found that an employee had uploaded a spreadsheet containing patient records to an unapproved public AI service; the hospital discovered the exposure on September 21, 2026. Johns Hopkins says it removed the prompt, conversation thread and document from the service’s history, but it has not confirmed that the service operator completed a further deletion request. The incident underscores the operational risk of employees using AI tools outside a healthcare organization’s approved systems.
- 01
The spreadsheet covered admissions and treatment from May through September 2026 and may have included names, dates, record and account numbers, medications, departments and provider names.
- 02
Johns Hopkins said the file did not contain Social Security numbers or financial account information.
- 03
Affected patients received instructions for 12 months of free Experian IdentityWorks credit monitoring.
Approximately 3,182 Johns Hopkins Bayview Medical Center patients are being warned that their information went to an AI service outside the hospital’s approved tools. Johns Hopkins says an employee mistakenly uploaded a patient-information spreadsheet to a public third-party platform. The hospital has sent notification letters about the potential security risk.
Johns Hopkins Medicine said an internal review discovered the exposure on September 21, 2026. Notification letters went out Thursday, according to WBAL-TV, after the hospital completed its review. The spreadsheet concerned admissions and treatment from May through September 2026. The AI platform has not been publicly named.
Care details and hospital account numbers
The information may have included patient names, admission and treatment dates, medical record numbers and account numbers. Departments of service, medications administered and provider names were also among the potentially affected fields. The hospital said the spreadsheet did not contain Social Security numbers or financial account information.
JHBMC is also taking this opportunity to reinforce our policies and training concerning the appropriate handling of protected health information, including restrictions on use of unauthorized applications and artificial intelligence tools and reeducation on the tools that are institutionally approved
Johns Hopkins Bayview Medical Center statement, quoted by WBAL-TV
Deletion requests and patient support
Johns Hopkins said it began an investigation and deleted the initial AI prompt, the subsequent thread and the document from the tool’s history. It also contacted the company that owns and operates the service to request further deletion and corrective measures. The operator’s completion of that request has not been confirmed.
- Credit monitoring: Notification letters include instructions to enroll in 12 months of free credit monitoring through Experian IdentityWorks.
- Questions about the incident: Call 833-931-7766 and use engagement number B174716. The hospital lists weekday hours of 9 a.m. to 9 p.m.
Sources
- thebanner.comJohns Hopkins data exposure caused by employee using unauthorized AI tool
- wbaltv.comHospital warns 3K patients after AI tool upload exposed records
Reader comments
Newest comments first. Replies stay oldest first.