Bayview Patients Get Letters After Staff Member Uploaded Data to Public AI

Johns Hopkins Bayview Medical Center is mailing letters this week to roughly 3,182 former patients. The hospital disclosed that an employee uploaded a spreadsheet containing names, medical record numbers, and medications to a public artificial intelligence platform that had not been cleared for internal use.

The incident occurred on Sept. 21, 2026, during an internal review. The employee uploaded the file to an outside tool, and hospital officials learned of the error that same day. Hopkins has not identified the specific AI platform involved. The Baltimore Banner reported that it is unclear whether the employee faced any consequences for the upload.

The affected group includes individuals admitted or treated at the Eastern Avenue campus between May and September 2026. The hospital stated that Social Security numbers were not part of the spreadsheet. However, the data included medical record numbers and account numbers, which carry the risk of medical identity theft or phishing attempts. Hopkins has not confirmed whether anyone outside the hospital viewed the spreadsheet after it reached the AI platform.

The hospital took steps to remove the data immediately. Staff deleted the original prompt, conversation thread, and document from the tool's history. Hopkins also asked the platform operator to delete the data. The hospital is now reinforcing policies on protected health information and training staff on which apps and AI tools are approved for use with patient records.

Letters began going out on Oct. 22. Each includes instructions for 12 months of free credit monitoring through Experian IdentityWorks. Hopkins established a toll-free line at 1-833-931-7766, open Monday through Friday from 9 a.m. to 9 p.m. Eastern time. Callers need the engagement number B174716. The hospital noted that notices are arriving by mail only, so patients should be cautious of unsolicited calls or emails asking for personal information.

Credit monitoring tracks new accounts and inquiries on a credit file. Since Social Security numbers were not exposed, experts suggest patients also watch their Explanation of Benefits documents from insurers. Patients should check their MyChart portals for appointments or medications they do not recognize. If something looks wrong, they can request their full records under HIPAA rights.

This breach stems from a growing workplace habit of using consumer chatbots for work tasks. Under federal HIPAA rules, providers must notify patients within 60 days of discovering a breach affecting 500 or more people. Hopkins started mailing letters about a month after the Sept. 21 discovery. Johns Hopkins University made its own HopGPT platform available in December 2025, but the hospital has not said whether a sanctioned tool could have prevented this specific incident.