Johns Hopkins Bayview Medical Center (JHBMC) in Baltimore is notifying patients that their health information may have been exposed. A staff member uploaded a spreadsheet of patient data to a public third-party AI platform that the hospital had not approved. Nobody broke in and there was no ransomware. Becker's Hospital Review cites an October 23 Johns Hopkins news release and puts the number of affected patients at about 3,182. WMAR, The Baltimore Banner, The Baltimore Focal, WBAL and Ilta-Sanomat report the same figure. CBS Baltimore says "more than 3,100" and WYPR says "nearly 3,200", and both are consistent with 3,182. The hospital has not named the AI tool. None of the sources available for this brief is a primary document such as the hospital's notice letter or a regulator filing. The details below come from press reporting of the Johns Hopkins release.
What Happened
Reporting agrees that the upload took place on September 21, 2026 and that the hospital found out about it the same day. The sources describe the sequence a little differently:
- Becker's (citing the hospital release) and WMAR say the workforce member uploaded the spreadsheet while conducting an internal review, and the hospital learned of it the same day.
- CBS Baltimore and WBAL say the incident was discovered during an internal review.
- The Baltimore Focal says the hospital discovered the issue on September 21 and that the upload happened during an internal review that same day.
These versions can all be true at once. Still, the public reporting does not settle whether the review is what caught the upload or simply the work the employee was doing at the time. Every outlet calls the upload a mistake and not malicious.
JHBMC says it took these steps after finding the upload:
- Opened an investigation.
- Had the employee delete the initial AI prompt, the follow-up conversation thread and the uploaded document from the AI tool's history.
- Asked the company that owns and operates the AI tool to delete the data. The Banner describes this as a request to "delete and correct" the mistake.
- Put corrective measures in place and is reinforcing its policies and training on protected health information (PHI). That includes restrictions on unauthorized apps and AI tools and retraining staff on which tools the institution has approved.
Notification letters started going out on October 22, 2026, about a month after the incident. The Banner reports that patients only began learning about the exposure after the hospital finished its internal review. The letters offer 12 months of free credit monitoring through Experian IdentityWorks. The Focal and WBAL give a toll-free line, 1-833-931-7766, with engagement number B174716, but they disagree on hours: the Focal says 8 a.m. to 8 p.m. Central and WBAL says 9 a.m. to 9 p.m. Those are probably the same window stated in different time zones. Patients should check their letter for the authoritative hours.
The Banner reports that it is unclear whether the employee will face any consequences.
What Was Taken
Strictly speaking, nothing was "taken." The data was disclosed to a third-party AI service outside the hospital's control. The spreadsheet covered patients admitted or treated between May and September 2026. Reporting says it may have included:
- Patient names
- Admission and treatment dates
- Medical record numbers
- Account numbers
- Departments of service
- Medications administered
- Provider names
The hospital says the file did not include Social Security numbers, financial account information or "other identifying information." The sources agree on this list. WYPR and The Banner give shorter versions, but nothing they say contradicts it.
The data is low-value for financial fraud. It is still sensitive. Medications combined with department of service can reveal diagnoses such as behavioral health, oncology or infectious disease treatment. Medical record and account numbers can also help with medical identity fraud or targeted social engineering. Credit monitoring, the standard remedy, does little against those particular risks.
Why It Matters
This is a clear, publicly confirmed case of shadow AI leading to a reportable healthcare breach. Defenders should note three things:
- The risk boundary has shifted. The main control failure here was not a perimeter or endpoint compromise. An authorized user, working inside their normal job, sent PHI to an external processor. Most data loss prevention programs were built for email, USB and file-sharing services. Browser-based AI chat interfaces often get past them.
- Remediation depends on the vendor. Once data reaches a public AI service, the hospital's options are to delete it in the user interface and ask the vendor to purge it. Deleting a chat history does not guarantee the data is gone from backend logs, abuse-monitoring retention or, depending on the tool's terms, training pipelines. JHBMC has not said whether the vendor confirmed deletion.
- It is a regulatory event. Under HIPAA, disclosing PHI to a vendor without a business associate agreement is an impermissible disclosure, whatever the intent. Healthcare organizations should expect more incidents like this as staff adopt AI tools for routine spreadsheet and summarization work.
For context, WYPR notes that the wider Johns Hopkins system had a breach in 2023 that affected tens of thousands of people and led to patient lawsuits. That incident had a different cause, but it means this organization's data handling is already under scrutiny.
The Attack Technique
No external attacker was involved. This was an accidental insider disclosure through an unsanctioned SaaS application:
- Vector: A workforce member pasted or uploaded a PHI spreadsheet into a public, consumer-grade generative AI tool.
- Intent: All reporting describes it as a mistake, apparently made while doing legitimate work (an internal review).
- Control gap: The tool was not approved for this use, so acceptable-use policy existed but was not enforced technically. Nothing in the reporting suggests that browser controls, DLP or network filtering blocked or flagged the upload when it happened.
- Tool identity: Not disclosed by Johns Hopkins in any source reviewed.
Because the tool is unnamed, it is unknown whether the provider retains uploads, uses them for model training or exposes them to human reviewers. Those answers would determine how much real exposure the patients face.
What Organizations Should Do
- Provide approved AI tools before banning others. Shadow AI grows when staff have no sanctioned option. Deploy enterprise AI services covered by a business associate agreement, with no-training and no-retention terms, and tell staff clearly which tools are approved.
- Enforce AI acceptable-use policy with technical controls. Use secure web gateway, CASB or browser-extension controls to block or force isolation for unsanctioned generative AI domains. Inspect uploads and pastes to AI endpoints for PHI patterns such as MRNs, account numbers and medication lists.
- Extend DLP to the browser. Traditional DLP often misses paste events and drag-and-drop uploads into web apps. Make sure your DLP covers clipboard and file-upload actions to external AI services and alerts on them.
- Minimize data in working exports. Spreadsheets created for internal reviews should be de-identified or limited to the fields the review needs. A file without names and MRNs would have made this a much smaller incident.
- Pre-negotiate a response playbook with AI vendors. Know in advance how to request verified deletion from major AI providers, who to contact and what written confirmation you can get. Record the outcome for your breach risk assessment.
- Train staff with concrete examples. General privacy training is not enough. Show staff this incident and similar ones, and make clear that pasting PHI into an unapproved chatbot is a reportable disclosure even when it is quickly deleted.
Sources: Johns Hopkins Bayview warns patients of data breach involving more... | Johns Hopkins alerts 3,182 patients after worker uploads data to un... | Johns Hopkins alerts 3,000+ patients after data sent to AI tool | Johns Hopkins data exposure caused by employee using unauthorized A... | Baltimore’s Hopkins Bayview patients data accidently exposed to AI... | Johns Hopkins Bayview says 3,182 patients’ records were uploaded to... | Johns Hopkins Bayview warns 3K patients after AI tool upload expose... | Sairaalan työntekijä jakoi potilastietoja tekoälylle - Ilta-Sanomat