Johns Hopkins Bayview notifies 3,182 patients after a staff member put their data into an unapproved AI tool

Johns Hopkins Bayview Medical Center in Baltimore is notifying 3,182 patients that an employee uploaded a spreadsheet containing their information to an outside AI platform the hospital had not approved for that use, according to local reporting by WMAR-2 News. The reports are based on the hospital's statements; we could not locate the hospital's own release or patient letter.

What the reports say happened

WMAR-2 reports that the hospital learned of the upload on September 21, 2026, during an internal review, and that the spreadsheet covered patients treated from May through September 2026. The Banner describes the incident as occurring in late September and says the hospital's news release called it a "digital error."

According to WMAR-2, the information may have included patient names, admission and treatment dates, medical record and account numbers, treating department, medications and provider names. The Banner reports the hospital said the file did not include Social Security numbers, financial accounts or other identifying information. Straight Arrow News likewise says the spreadsheet "may have included" names, medical record numbers, medications and admission and treatment dates.

None of the reports names the AI tool or its operator.

The hospital's response

Per WMAR-2, the employee deleted the prompt, thread and document from the tool's history, and the hospital asked the company operating the tool to delete the data. Letters began mailing October 22, and patients are offered 12 months of credit monitoring through Experian IdentityWorks and a toll-free call center. The hospital also said it is strengthening policies and training on protected health information, including limits on unapproved apps and AI tools.

What is unresolved

Straight Arrow News reports that the hospital did not say whether the tool's operator actually deleted the data, whether the data could be used to train the tool, or whether technical controls could have blocked the upload. It also does not say whether the incident was reported to the U.S. Department of Health and Human Services. The Banner says it is unclear whether the employee will face consequences.

On the wider picture, Straight Arrow News cites a Wolters Kluwer survey released in January that found 17% of more than 500 providers and administrators had used an unapproved AI tool at work. None of the reports says how regulators will treat this incident.