Johns Hopkins Hospital Notifies 3,200 Patients After Staffer Used Unapproved AI Tool

A Johns Hopkins Bayview worker uploaded a spreadsheet of patient records to a public AI tool the hospital hadn't approved, triggering breach notices and free credit monitoring.

What happened: Johns Hopkins Bayview Medical Center in Baltimore is notifying about 3,182 patients that their health information may have been exposed after a staff member uploaded a spreadsheet of patient data to a public AI tool the hospital had not approved for that use. The hospital says it discovered the mistake on September 21, 2026, during an internal review. The worker deleted the prompt, the chat thread, and the uploaded file from the AI tool's history, and the hospital asked the company behind the tool to delete the data and add safeguards against repeat incidents.

Why it matters: This isn't a hack — it's a case of an employee treating a consumer AI chatbot like a work folder. As hospitals and other employers let staff use AI tools for everyday tasks, patient records, financial data, and other sensitive files increasingly end up pasted into systems never vetted for privacy or security. Once data leaves a hospital's own systems, the hospital can ask for deletion but can't fully verify it happened, or that the information wasn't logged, used for model training, or seen by someone else in the meantime.

What was exposed, plainly: The spreadsheet covered patients treated at the facility between May and September 2026. It may have included patient names, admission and treatment dates, medical record and account numbers, which department treated them, medications given, and treating providers' names. Johns Hopkins says Social Security numbers, financial account details, and other identifying information were not included, which limits — but doesn't eliminate — the risk of identity theft or targeted scams using the exposed medical details.

What happens next: Johns Hopkins began mailing notification letters on October 22, 2026, offering affected patients 12 months of free credit monitoring through Experian IdentityWorks. A toll-free call center (1-833-931-7766, engagement number B174716) is open weekdays for questions. The hospital says it's using the incident to tighten rules on which apps and AI tools staff can use with patient data, and to retrain employees on handling protected health information.