Medical records on over 3K patients exposed after spreadsheet shared with AI platform
A Baltimore-area hospital is alerting 3,182 patients to a data exposure incident, where protected health information was shared with an unauthorized artificial intelligence tool. While not named, the AI application was said to be available to the public and not approved for use with medical records, meaning the sharing is considered a data breach under privacy provisions of the Health Insurance Portability and Accountability Act (HIPAA).
Johns Hopkins Bayview Medical Center said the breach happened when an employee accidentally uploaded a spreadsheet to the AI platform. Contained within were details on patients, including names, admission dates and some details on treatments.
The hospital uncovered the cybersecurity incident while conducting an internal review on Sept. 21. It’s unclear when the employee uploaded the spreadsheet, but it contained records on admissions dating back to May, Johns Hopkins said.
Other exposed information includes medical record numbers, details on prescriptions and provider names. Notably, financial records and Social Security numbers were not on the spreadsheet, the hospital added.
Johns Hopkins said it has sent letters to victims, informing them of the breach and offering 12 months of free credit monitoring through Experian. Those letters began going out on Oct. 22.
In a statement, Johns Hopkins apologized for the breach, and said it’s taken measures to stop similar incidents from happening in the future: "Johns Hopkins is committed to maintaining the privacy and security of its patients' information and is taking this incident very seriously," a spokesperson wrote.
"We sincerely regret any inconvenience or concern this may have caused."
New training and data deletion
Hospital leadership said it's taken all the steps it can to contain the data breach, including having the employee delete user history on the AI platform, including all prompts and conversations related to the spreadsheet.
Further, the employee has contacted the developer of the tool to ask that the data be deleted on their end, Johns Hopkins added.
“Johns Hopkins is also taking this opportunity to reinforce our policies and training concerning the appropriate handling of protected health information, including restrictions on use of unauthorized applications and artificial intelligence tools and reeducation on the tools that are institutionally approved,” the hospital wrote in a statement.
It’s unclear what, if any, disciplinary action was taken against the employee. The incident is being considered a mistake.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.