Johns Hopkins Bayview notifies 3,182 patients after upload to unapproved AI tool

Johns Hopkins Bayview Medical Center in Baltimore is notifying about 3,182 patients that their information may have been compromised after a workforce member uploaded a spreadsheet containing patient data to a public AI tool the hospital had not approved, according to an Oct. 23 news release Johns Hopkins shared with Becker's Hospital Review. The hospital describes the upload as a mistake by the workforce member.

This incident had no attacker, no ransomware and no stolen credentials. It began with an ordinary task and a convenient tool. That is what makes it relevant to every organization in the sector. When staff are asked to summarize, sort or clean up spreadsheets and have no sanctioned AI option that works as well as a public one, some will use the public one. The exposure then sits outside the organization's contracts, logging and controls, and the response becomes a patient notification exercise rather than a technical fix.

For the Chief AI Officer, the lesson is that the absence of an approved tool is itself a risk decision. For the CISO, public AI sites belong in the same data loss prevention conversation as personal email and consumer file sharing. For compliance, privacy and legal, the question is whether the AI acceptable use policy is specific, current and tested against real workflows. For the CHRO, the event is a reminder that training and a culture where staff ask before they paste matter as much as blocking rules, and that a mistake framed as a learning moment surfaces problems faster than one framed as a firing offense.

The evidence is limited. Becker's reports the incident from the hospital's own release. The source does not name the AI tool or detail which data fields were in the spreadsheet, and no regulator finding has been published. Leaders should treat this as a well-documented example of a known pattern, not as a full account of cause or consequence.

The move: confirm this week that staff have an approved AI tool for routine work and that public AI sites are covered by data loss prevention rules for patient data. Pair the controls with a short, plain-language message to staff on what they can use and where to ask. The return is fewer notifications to patients and less fear among employees who are trying to get their work done.

You are a security and AI governance advisor to the CISO and executive team of [your organization].

Context: Becker's Hospital Review reports that Johns Hopkins Bayview Medical Center is notifying about 3,182 patients that their information may have been compromised after a workforce member uploaded a spreadsheet containing patient data to a public AI tool the hospital had not approved. The report draws on an Oct. 23 news release from the hospital, which describes the upload as a mistake by a workforce member. No regulator finding has been published, and the source does not name the AI tool or the data fields involved.

Task: Help me confirm this week that staff have an approved AI tool for routine work, such as summarizing, sorting or cleaning up spreadsheets, and that public AI sites are covered by data loss prevention rules for patient data. Identify gaps, the steps to close them, and a short, plain-language message to staff on what they can use and where to ask.

Output: a one-page memo for the executive team with these sections: What happened; Our current state; Gaps; Actions this week, each with an owner and a check; Draft staff message; What we still need to verify.

Use these details: [your approved AI tool, or none], [your data loss prevention platform and whether it covers public AI sites], [the date your AI acceptable use policy was last reviewed], [the number of workforce members who handle spreadsheets with patient data], [where staff currently ask about new tools].

Guardrails: Use only the facts given here and the details I fill in. Cite Becker's Hospital Review and the hospital's release by name. Flag anything uncertain or that needs verifying, and do not speculate about cause beyond what is reported. Do not request or include any patient data. Nothing here is medical or legal advice. Mark the memo as a draft for the team to check.