A Johns Hopkins Bayview Hospital Employee in Baltimore Reportedly Uploaded Patient Data to an Unapproved AI Tool

An employee at Johns Hopkins Bayview Medical Center in Baltimore, Maryland, reportedly uploaded a spreadsheet containing patient information to an unapproved public AI tool. The hospital notified 3,182 patients of potential exposure, sought deletion of the data, and reinforced staff training. The tool and its developer were not identified; further disclosure or misuse has not been established.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The incident involved uploading non-public sensitive patient medical data to a public-facing AI tool, exposing the private information of 3,182 individuals without authorization.

Additional risk subdomains

• 5.1 Overreliance and unsafe use: The employee unsafely relied on an unauthorized public consumer AI tool to process highly sensitive medical data, bypassing institutional security protocols.

Causal factors

• Entity: Human
• Intent: Unintentional
• Timing: Post-deployment

The potential data breach was caused by a human hospital employee's decision to upload sensitive patient data to an unauthorized public AI tool. The employee did not intend to cause a data breach, but rather sought to use the tool to crunch numbers.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The system is described as a 'public-facing AI website' and 'consumer AI tool' (such as a general-purpose chatbot or utility), which falls under Limited Risk due to transparency obligations for users interacting with AI.

AI system and alleged parties

• AI system: None named
• AI purpose: Data Grouping; Value Estimation
• Behaviour type: Tool
• Alleged developer: Large language model developers, Chatbot developers
• Alleged deployer: Johns Hopkins Bayview Medical Center, Hospitals, Healthcare workers, Chatbot users
• Alleged harmed parties: Privacy, Patients, Johns Hopkins Bayview Medical Center patients

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Minor
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The report does not explicitly describe direct financial losses to patients, but notes that the hospital offered a year of free credit monitoring to 3,182 affected individuals.

Indirectly caused: The hospital likely incurred unquantified financial costs to investigate the breach, send notification letters, and provide a year of free credit monitoring to 3,182 patients.

Privacy

Reported: The report explicitly describes potential privacy violations involving the exposure of personal data of 3,182 patients.

Directly caused: A hospital employee uploaded a spreadsheet containing sensitive patient data (names, admission dates, medications, medical record numbers) to an unapproved public AI tool, exposing 3,182 patients' private information.

People affected

• Occurrences reported: 1
• People reportedly exposed: 3182

Potential causes

Management

• Inadequate Shadow IT Oversight: Management failed to monitor and govern unauthorized AI tool usage.
• Insufficient Staff Training: Hospital did not provide adequate training on secure AI practices.

Technology

• Public AI Tool Accessibility: Public-facing AI tool was accessible on hospital network without restriction.
• Lack of Data Loss Prevention: No DLP software blocked the upload of sensitive PHI to external websites.

Data Inputs

• Unencrypted Patient Spreadsheet: Spreadsheet containing PHI was unencrypted and easily uploaded.
• Unmasked Personal Data: Patient names and medical record numbers were not anonymized.

Human Factors

• Shadow AI Adoption by Staff: Employee chose unapproved AI tool to quickly perform work tasks.
• Poor AI Risk Perception: Staff failed to recognize privacy risks of uploading data to public AI.

Process and Methods

• Deficient AI Validation: Hospital lacked rigorous validation mechanisms for AI tools.
• Weak Policy Reinforcement: Lack of active reinforcement regarding unauthorized AI tool usage.

Regulatory Environment

• Evolving AI Compliance Standards: Regulatory frameworks for healthcare AI usage are still developing.

Information quality

• Classification confidence: High
• Reason for confidence: The report provides clear, specific details about the incident, including the date of discovery (Sept 21), the number of affected patients (3,182), the types of data exposed, and the actions taken by the hospital. There is no conflicting information.
• Ambiguities identified: The specific public-facing AI website or tool used by the employee is not named.
• Alternative interpretations: None. The facts of the unauthorized upload and subsequent data exposure are straightforward.

A hospital employee's unauthorized upload of 3,182 patient records to a public AI tool highlights the operational risks of 'shadow AI' in healthcare. The incident is a minor privacy breach with negligible national security implications, manageable under standard institutional compliance and data security protocols.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Individual

Threat characteristics

• Imminence: Long-term. The active data exposure has been mitigated through deletion requests, representing a long-term policy and training challenge rather than an active crisis.
• Autonomy: Human-controlled. The AI system acted as a passive tool to process data directly uploaded by a human user, with no autonomous decision-making.
• Novelty: Established threat. Data leakage via unauthorized third-party software (shadow IT) is a well-established threat, with generative AI representing a minor variation of this vector.

Impact by dimension

• Physical security: Negligible. The incident involved a localized data leak of patient records with no impact on physical systems, critical infrastructure operations, or human safety.
• Information security: Negligible. No classified intelligence was compromised, and there were no indications of information warfare, state-sponsored espionage, or systematic disinformation.
• Sovereignty: Negligible. The leak of hospital patient data does not impact state authority, border control, electoral processes, or core government decision-making.
• Economic security: Negligible. No strategic technology, proprietary AI models, or critical supply chains were compromised. Economic impact is limited to local hospital remediation costs.
• Societal stability: Minor. Represents a minor privacy breach affecting 3,182 individuals. The incident is manageable under standard healthcare security and compliance procedures without threatening broader societal stability.