The Pulse
Johns Hopkins Notifies 3,182 Patients After Bayview AI Upload
Johns Hopkins Bayview Medical Center is notifying 3,182 patients after a staff member uploaded a spreadsheet of patient information to an unapproved AI tool. The hospital says the file may have included treatment details and medical record
AI.info Team · Written with AI · fact-checked ·
Johns Hopkins’ written rules bar staff from entering clinical data into third-party AI tools the institution has not approved. Yet a staff member at Johns Hopkins Bayview Medical Center uploaded a spreadsheet of patient information to an unapproved AI platform, prompting the Baltimore hospital to notify 3,182 people. The notices began going out October 22, according to WMAR-2 News.
Bayview’s upload crossed a written boundary
The hospital says it discovered the incident on September 21, 2026, during an internal review. A staff member uploaded the spreadsheet to an outside AI platform that had not been cleared for that use. The report does not identify the tool or say how long the information remained available there.
The episode puts a concrete breach of policy beside Johns Hopkins’ stated controls. Its AI-use guidelines tell staff not to enter nonpublic clinical information into unapproved third-party tools and warn that information entered using default settings may not be private. For Johns Hopkins Bayview, the response now includes limits on unapproved apps and AI tools, along with staff retraining, WMAR reported.
The spreadsheet included treatment details
The spreadsheet covered patients admitted and treated at Bayview between May and September 2026. Information that may have been exposed included names, admission and treatment dates, medical record and account numbers, the department involved, medications given, and provider names.
Johns Hopkins said the file did not contain Social Security numbers or financial account details. That narrows the categories of information involved, but the reported data still connected identifiable patients with treatment dates and other medical details. The hospital’s notice count is 3,182 patients.
The hospital asked the AI provider to delete the data
After the incident, the employee removed the prompt, conversation thread and document from the tool’s history. Johns Hopkins also asked the company operating the platform to delete the data and put measures in place to prevent similar incidents, according to WMAR. The report does not identify the provider or describe what steps, if any, the company took in response.
Johns Hopkins began mailing letters to affected patients on October 22. The letters offer 12 months of free credit monitoring through Experian IdentityWorks. A toll-free call center is available at 1-833-931-7766; callers should use engagement number B174716. WMAR lists the line’s hours as Monday through Friday, 8 a.m. to 8 p.m. Central time.
Approved tools are the dividing line
Johns Hopkins’ published guidance directs staff to use approved AI tools and routes requests for additional tools through a review process. The policy treats patient and other nonpublic institutional information differently from material that can safely be shared with a public service: clinical data should not go into an unapproved third-party platform.
In the Bayview incident, the hospital says it asked the tool’s operator to remove the uploaded material and is changing limits and training. The patient letters describe the exposed information and offer a year of credit monitoring.