2026 Johns Hopkins Bayview Medical Center — staff entered patient records into an unapproved public AI tool; 3,182 patients notified
Data compromised
Patients admitted and treated May–September 2026. The hospital says exposed information may include patient names, dates of admission and treatment, medical record and account numbers, treating department, medications and provider names. It says Social Security and financial account numbers were not included.
Technical writeup
Hospital notification to patients, reported by the Baltimore Sun, WMAR and Hoodline (Oct 23–24, 2026). Discovered Sep 21, 2026; notification letters began arriving the week of Oct 22. The hospital says it opened an investigation, the employee deleted the prompt, thread and file from the tool’s history, and it asked the AI vendor to delete the data and add safeguards. The AI tool is not named. This is a separate matter from the hospital’s older MOVEit-related breach. recordsAffected 3182 (patients notified).
Root cause
A staff member entered a spreadsheet of patient information into a public AI tool the hospital had not approved. The hospital found it on Sep 21, 2026.
References
- https://www.baltimoresun.com/2026/10/24/johns-hopkins-bayview-medical-center-data-breach/
- https://www.wmar2news.com/local/patients-data-sent-to-ai-tool-johns-hopkins-bayview-medical-center-oct-23-2026
- https://hoodline.com/2026/10/johns-hopkins-bayview-warns-3-182-patients-after-staffer-fed-data-to-ai-tool/