A Bayview Staffer Pasted 3,182 Patients’ Records Into an AI Chatbot
Johns Hopkins Bayview is notifying 3,182 patients after an employee uploaded a spreadsheet of their records, including medications and record numbers, to an unapproved public AI tool.
Nobody hacked Johns Hopkins Bayview Medical Center. An employee pasted a spreadsheet of patient records into a public AI chatbot. The Baltimore hospital is now notifying 3,182 patients treated between May and September that their health information went to an outside AI tool it hadn’t approved, according to Hoodline, citing WMAR 2 News, and The Banner. The hospital hasn’t named the tool.
The upload happened in late September and was caught the same day during an internal review, the reports say. Bayview says the file held patient names, admission and treatment dates, medical record and account numbers, treating departments and providers, and medications given. It says Social Security numbers and financial account details weren’t included. Investigators had the employee delete the prompt, the chat thread and the file from the tool, and the hospital asked the AI company to delete the data on its side. Whether that request was honored, and whether the employee faces consequences, hasn’t been disclosed. Letters started reaching patients around Oct. 22.
This kind of leak is often called “shadow AI”: staff using personal or unapproved AI accounts for work. Hoodline points to Medical Economics survey figures suggesting 71% of healthcare workers did so last year. Many consumer AI services don’t sign the business associate agreements HIPAA expects from anyone handling patient data on a provider’s behalf. Bayview says it’s tightening policy, retraining staff on approved tools and limiting unapproved apps.
What it means for you
If you were treated at Bayview between May and September 2026, check your mail for a letter. The exposed details aren’t the kind that let someone open a credit card in your name, but they’re enough for very convincing scam calls that mention your real hospital stay, doctor or medications. Bayview is offering 12 months of free credit monitoring through Experian IdentityWorks and has a call center at 1-833-931-7766 (engagement number B174716 in the reports). If you run a small business, this is the cheap lesson: tell staff in writing what they may and may not paste into AI tools.
Do this now
- Patients: enroll in the free monitoring using the details in your letter, and check your insurer’s explanation-of-benefits statements for care you didn’t receive.
- Treat any call about your Bayview visit with suspicion. Hang up and call the number on the official letter or the hospital’s website.
- Employers: give staff an approved AI tool with a proper data agreement, and ban pasting customer or patient data into personal AI accounts.
- Admins: use data-loss-prevention rules or a web filter to block uploads of sensitive files to unapproved AI sites.