Johns Hopkins Bayview Notifies 3,182 Patients After Data Upload to Public AI
An employee uploaded a spreadsheet containing patient names and medical history numbers to an unauthorized platform, prompting credit monitoring offers and a formal security review.
By Samir Patterson ·
Baltimore residents who sought care at a major local medical center recently learned that their private health information had been placed on a public digital platform. Johns Hopkins Bayview Medical Center has begun sending formal notices to 3,182 patients affected by this data exposure.
The breach was discovered on September 21, 2026. Hospital investigators found that a staff member uploaded a spreadsheet to a public artificial intelligence tool that the institution had not authorized for use. The document contained specific clinical data for patients treated between May and September of this year.
The spreadsheet listed patient names, medical record numbers, admission dates, and details of the treatments provided. Hospital representatives clarified that the file did not include Social Security numbers or banking and financial information. The staff member removed the file, the text prompts, and the chat history immediately after the error was detected.
The hospital’s cybersecurity team contacted the AI service provider to ensure all remaining data was permanently deleted from their servers. To help mitigate the risk of identity theft, the institution is providing one year of free credit monitoring for every affected individual. A dedicated phone line is now available for patients to ask questions about the incident.
This event raises questions about the use of unauthorized digital tools in healthcare settings, a practice often referred to as shadow AI. The case highlights the need to update data protection standards, including the federal HIPAA law, to better address modern digital risks.
The hospital has released full details of the investigation and its official stance through local media outlets and technical cybersecurity reports. Patients can find more information in the coverage provided by CBS Baltimore and the technical report from Wisevoter Baltimore.
Local news stations in Maryland, including WMAR 2 News Baltimore, have also aired video reports detailing the immediate protective steps taken by the hospital management team.
