3,182 Patients Hit by Hospital AI Breach

3,182 patients at Johns Hopkins Bayview Medical Center in Baltimore received formal notification that their confidential health records were accidentally exposed. The breach occurred when an employee uploaded a spreadsheet containing clinical data to a public artificial intelligence platform without institutional authorization. The hospital confirmed the incident on October 27, 2026, following internal investigations.

The timeline of the data leak spans four months. Clinical details, including patient names, medical record numbers, admission dates, and treatment specifics, were loaded into the AI tool between May and September 2026. The hospital identified the unauthorized upload on September 21, 2026. Subsequent reviews determined that the exposed information did not include Social Security numbers or banking details.

Immediate corrective actions followed the discovery. The employee who initiated the upload removed the file, the specific prompts used, and the chat history from the platform. The hospital’s cybersecurity team also contacted the AI service provider to request the permanent deletion of any remaining data hosted on their servers.

To mitigate potential risks for affected individuals, the institution launched a one-year credit monitoring program at no cost. A dedicated phone line for inquiries from the 3,182 impacted patients is now active. These steps aim to address the immediate fallout of the unauthorized data transfer.

The incident has intensified scrutiny on the practice of using unapproved AI tools in healthcare settings, often referred to as shadow AI. The case raises questions about the adequacy of current data protection standards, including federal HIPAA regulations, in the face of rapid digital tool adoption. Hospital representatives are reviewing internal protocols to prevent similar unauthorized data uploads in the future.

Further details regarding the investigation and the hospital’s official stance are available through local CBS Baltimore coverage and a technical cybersecurity report by Wisevoter Baltimore. WMAR 2 News Baltimore also released a video report detailing the immediate safeguards implemented by the medical center.

The hospital continues to process notifications to all affected patients. The credit monitoring period will conclude one year from the date of notification. The cybersecurity team remains in communication with the AI provider to confirm the completion of data deletion requests.