Johns Hopkins Bayview Medical Center in Baltimore has begun notifying about 3,182 patients that their health information may have been exposed after an employee uploaded a spreadsheet to a public AI tool the hospital had not approved for that use.
According to the hospital, the problem surfaced on 21 September 2026 during an internal review — and happened the same day. A staff member uploaded a spreadsheet of patient information to an outside AI platform that was not cleared for the purpose, which shared the data with the third-party tool. The spreadsheet covered patients admitted and treated between May and September 2026. The exposed details may have included names, dates of admission and treatment, medical record numbers, account numbers, treating department, medications given and the names of providers. Social Security numbers and financial account details were not included, the hospital says.
What makes the incident notable is what it was not. There was no intrusion, no vulnerability, no ransomware and no sign of a targeted attack. A person, presumably trying to finish a task faster, pasted data into a consumer tool. That is what turns the case into a pattern rather than an outlier: shadow AI needs no adversary, only a deadline.
The response followed the familiar sequence. The hospital opened an investigation, the employee deleted the prompt, the thread and the document from the tool's history, and the hospital asked the company running the tool to delete the data. It says it has added measures to prevent a repeat, including limits on unapproved apps and AI tools and retraining staff on which tools are approved. Letters went out from 22 October with an offer of 12 months of free credit monitoring through Experian IdentityWorks, alongside a toll-free call centre.
For privacy officers, the interesting part is not the apology but the evidentiary problem. An employee deleting a thread and a vendor being asked to delete data does not undo the processing. Whether copies persisted in training pipelines, logs or backups is not something an outsider can verify — and the affected patients have no way to check independently. In the United States, HIPAA applies; in the EU, a comparable case would be measured against the GDPR, including whether a data processing agreement existed with the tool's vendor. That the notification reached the public roughly a month after discovery is also part of the picture.
The lesson is about governance rather than technology. Bans push usage underground; hospitals need approved tools that are actually good enough for the intended work, and a technical block on everything else. A prompt filter that recognises medical record numbers would probably have prevented this incident. A memo saying "do not use unapproved AI tools" would not.
The scale is the least important detail. Set against large breaches, 3,182 people is small. Set against the number of hospital employees currently discovering how useful a language model is for summarising notes, it is the size of a problem that can recur in any hospital in the world — usually without anyone noticing at all.
