Johns Hopkins alerts 3,000+ patients after data sent to AI tool

Johns Hopkins Bayview Medical Center is notifying about 3,182 patients that their protected health information may have been exposed after an employee uploaded a spreadsheet to a public AI tool that the hospital had not approved. The hospital discovered the issue on September 21, 2026, during an internal review, and said the information was improperly shared with the third-party platform. The spreadsheet covered patients admitted or treated from May through September 2026. It may have contained names, admission and treatment dates, medical-record and account numbers, treating departments, medications, and provider names. Johns Hopkins Bayview said Social Security numbers and financial account details were not included. The employee deleted the prompt, conversation thread, and document from the tool's history, while the hospital asked the AI company to delete the data and implemented measures intended to prevent similar disclosures. The medical center began mailing notification letters on October 22 and is offering affected patients 12 months of Experian IdentityWorks credit monitoring. It is also retraining staff and tightening restrictions on unapproved applications and AI tools used with protected health information. Patients can contact the hospital's call center at 1-833-931-7766, using engagement number B174716.