Weill Cornell discloses unauthorized use of radiology patient data in AI tools

Weill Cornell Medicine says it found no evidence of unauthorized viewing or misuse, but patient information was processed by AI tools without permission. In a November 5, 2026 patient notice, the institution disclosed that a radiology research study used medical details in violation of its policies. It suspended the research and requested deletion.

The incident occurred between June 10 and June 20, 2026. The information came from patients at Weill Cornell Imaging at NewYork-Presbyterian or NewYork-Presbyterian Hospital. According to the notice, it was entered into AI tools and processed using machine learning in connection with the study. The institution describes the processing itself as unauthorized, regardless of whether anyone subsequently viewed the information.

No patient names, but detailed medical information

Weill Cornell said the information did not include patient names, addresses, telephone numbers, email addresses, Social Security numbers or patient-specific financial information. That exclusion did not extend to medical record numbers or the clinical details associated with patients’ radiology examinations. The notice identifies several categories of information involved:

• Record and image references: medical record numbers and radiology accession numbers, the internal numbers assigned to radiology images.
• Details of care: dates and times of radiology services, the facility’s name and the health care provider’s name.
• Clinical histories: diagnoses, treatment, surgical and procedural histories, and medication information relating to patients’ radiology examinations.

At this time WCM has not identified evidence that an unauthorized individual has viewed your information.

Weill Cornell Medicine, November 5 patient notice

From June processing to November disclosure

Weill Cornell learned of the incident on September 6, 2026, and began an investigation to determine what happened. Its public notice followed on November 5.

MedicalDaily noted that the public notice appeared 60 days after discovery. The outlet cited the federal HIPAA Breach Notification Rule, which requires notification without unreasonable delay and no later than 60 days after discovery. That timing provides context for the disclosure; it does not establish when any individual patient received notice.

Beyond stopping the research, Weill Cornell said it provided additional education on its requirements for appropriate AI use and protecting patient information. It also said it was continuing to expand security measures, including additional training.

A deletion request, not confirmed deletion

The notice does not name the AI tools, identify who entered the information or state how many patients were affected. It also does not confirm that the requested deletion has been completed.