Staff at two Washington state facilities drafted patient notes in personal ChatGPT

A staff member at Lake Burien Transitional Care Facility in Burien, Wash., which treats youth with intensive mental health needs, used a personal ChatGPT account to summarize client case notes. A colleague reported it in July. A second incident at Western State Hospital in Lakewood, Wash., brought the total to 16 patients whose protected health information may have been exposed, The Seattle Times reported, per Becker's Behavioral Health. The Department of Social and Health Services (DSHS) notified families of 12 patients in mid-August. Names, diagnosis details and medications may have been exposed. Social Security numbers were not involved, and the state found no evidence of further disclosure or identity theft. DSHS policy already prohibited all unapproved AI use.

The lesson is that the policy existed and the behavior happened anyway. A clinician under documentation pressure reached for the fastest tool available. Taya Briley of the Washington State Hospital Association put it directly: governance "is not going to be effective if staff are not trained to the extent that they need to be." She also said consumer chatbots fall short of required security standards. For CNOs and nursing leaders, this is a workload signal as much as a compliance one: staff are telling you where documentation burden sits.

The broader pattern comes from a survey by security vendor DNSFilter of 400 IT and cybersecurity workers across industries, covered by Cybersecurity Dive. Three-quarters said budgets rose over the past 12 months, and four in 10 said their next dollar goes to AI security and governance. Yet 46% were confident unapproved AI apps were connected to their systems, and one-fifth said an unapproved AI integration had led to a security incident. Thirty-seven percent learn of AI app connections only after the fact. The survey is not specific to healthcare, and the Washington reporting documents two incidents, not a prevalence rate. Neither source says how common this is across health organizations.

For CISOs and compliance teams, note the reporting mechanics: DSHS will report both incidents to HHS' Office for Civil Rights after year end, as federal rules allow for breaches affecting fewer than 500 people. Small incidents still carry notification duties and family trust costs.

The move: this week, inventory which generative AI sites clinical staff can reach from work devices. Pair any block on personal accounts with an approved, contracted documentation tool and role-specific training, so the need that drove the workaround is met inside the perimeter. Patients get protected records, and staff keep the time savings without the risk.

You are a security advisor to the CISO and executive team of [your organization], a health organization with [number of clinical staff] clinical staff on [number of work devices] work devices.

Context: The Seattle Times reported, per Becker's Behavioral Health, that a staff member at Lake Burien Transitional Care Facility, a Washington state facility treating youth, used a personal ChatGPT account to summarize client case notes, and a second incident at Western State Hospital brought the total to 16 patients whose protected health information may have been exposed. DSHS notified families of 12 patients in mid-August. DSHS policy already prohibited unapproved AI use. Separately, Cybersecurity Dive covered a DNSFilter survey of 400 IT and cybersecurity workers across industries: three-quarters said budgets rose over the past 12 months, 46% were confident unapproved AI apps were connected to their systems, one-fifth said an unapproved AI integration led to a security incident, and 37% learn of AI app connections only after the fact. The survey is not healthcare specific, and neither source gives a prevalence rate for health organizations.

Task: Plan a this-week inventory of which generative AI sites clinical staff can reach from work devices, and a plan to pair any block on personal accounts with an approved, contracted documentation tool and role-specific training.

Output: A draft workflow for the executive team with numbered steps, an owner for each step, a check that confirms each step is done, and a short list of open decisions. Use [your web filtering or DNS tool], [your EHR], [your approved documentation tool, or none yet], and [your current training cadence].

Guardrails: Use only the facts above and the slots I fill. Cite Becker's Behavioral Health and Cybersecurity Dive by name for each fact you use. Flag anything uncertain or that must be verified, including regulatory reporting steps. Do not request or include patient data. Nothing here is medical or legal advice. Label the result a draft for the team to check.