Johns Hopkins Bayview warns patients of data breach involving more than 3,100 people
Johns Hopkins Bayview Medical Center is notifying patients of a data breach that may have exposed the personal and medical information of more than 3,100 people after an employee uploaded a spreadsheet containing patient data to an unauthorized artificial intelligence tool.
The medical center discovered the incident during an internal review, according to Johns Hopkins, which said an employee uploaded the spreadsheet to a public third-party AI platform not approved for use.
The spreadsheet contained patient information on admissions and treatment from May through September 2026.
The information may have included patients' names, admission and treatment dates, medical record numbers, account numbers, departments of service, medications administered and provider names.
Johns Hopkins said the spreadsheet did not contain Social Security numbers, financial account information or other identifying information.
After discovering the breach, Johns Hopkins Bayview Medical Center (JHBMC) launched an investigation and took steps to address the unauthorized disclosure. Those steps included directing the employee to delete the initial AI prompt, subsequent conversation thread and document from the AI tool's history, as well as contacting the company that operates the platform to request deletion.
The medical center also implemented corrective measures to help prevent similar incidents.
Johns Hopkins said it reinforced its policies and training on handling protected health information, including restrictions on unauthorized applications and AI tools, and provided additional education on institutionally approved tools.
On Oct. 22, JHBMC began mailing letters to patients whose information was identified during its review. The letters include instructions for enrolling in 12 months of complimentary credit monitoring through Experian IdentityWorks.
The medical center also established a toll-free call center to answer patients' questions. The center can be reached at 1-833-931-7766, Monday through Friday from 9 a.m. to 9 p.m. Callers should reference engagement number B174716.
"Johns Hopkins is committed to maintaining the privacy and security of its patients' information and is taking this incident very seriously," the medical center said. "We sincerely regret any inconvenience or concern this may have caused."
