Full Breakdown
Data Exposure at Johns Hopkins Bayview Medical Center
By Drooid · · How we work
Core Event
In late September, an employee at Johns Hopkins Bayview Medical Center in Baltimore mistakenly uploaded a spreadsheet containing the records of 3,182 patients to a public, third-party generative-AI tool that had not been approved for clinical use. The upload was discovered the same day during an internal review, prompting the hospital to begin an immediate investigation and to delete the prompt, thread, and document from the AI tool’s user history.
Background on AI Governance
Johns Hopkins Medicine’s AI guidelines, issued the previous year, prohibit entering clinical records into unapproved external AI platforms because such tools do not guarantee privacy. The hospital’s public statements reaffirm that only AI applications vetted by the institution may be used for patient care, and that additional oversight groups monitor privacy, security, and ethics as the system expands its use of artificial intelligence.
Official Response and Mitigation Measures
Johns Hopkins Medicine announced that it contacted the AI tool’s parent company to request full deletion of the uploaded data and to implement corrective actions. The hospital also said it is reinforcing policies and training on the handling of protected health information, emphasizing restrictions on unauthorized applications. Affected patients received mailed letters offering twelve months of complimentary credit monitoring through Experian IdentityWorks and were provided a dedicated hotline (1-833-931-7766) for questions.
Scope of the Breach
The disclosed spreadsheet covered admissions and treatment from May through September 2026 and included patient names, dates of admission, medical record numbers, account numbers, departments of service, medications administered, and provider names. The release confirmed that Social Security numbers, financial account details, and other uniquely identifying information were not part of the exposed data.
Next Steps for Patients
Patients can enroll in the free credit-monitoring program and may file a complaint with the U.S. Department of Health and Human Services’ Office for Civil Rights, which enforces HIPAA privacy rules. The hospital’s investigation remains ongoing, and it has not disclosed whether the AI company confirmed complete data removal or whether the uploaded information could be used to train the tool.