This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A hospital employee at Baltimore's Bayview Medical Center uploaded a spreadsheet containing sensitive personal data of 3,182 patients to an unauthorized public-facing AI tool to crunch numbers, resulting in a potential data breach.
An employee at Johns Hopkins Bayview Medical Center in Baltimore, Maryland, reportedly uploaded a spreadsheet containing patient information to an unapproved public AI tool. The hospital notified 3,182 patients of potential exposure, sought deletion of the data, and reinforced staff training. The tool and its developer were not identified; further disclosure or misuse has not been established.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The employee unsafely relied on an unauthorized public consumer AI tool to process highly sensitive medical data, bypassing institutional security protocols.
The incident involved uploading non-public sensitive patient medical data to a public-facing AI tool, exposing the private information of 3,182 individuals without authorization.
Human
Due to a decision or action made by humans
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The potential data breach was caused by a human hospital employee's decision to upload sensitive patient data to an unauthorized public AI tool. The employee did not intend to cause a data breach, but rather sought to use the tool to crunch numbers.
A hospital employee's unauthorized upload of 3,182 patient records to a public AI tool highlights the operational risks of 'shadow AI' in healthcare. The incident is a minor privacy breach with negligible national security implications, manageable under standard institutional compliance and data security protocols.
The report describes the AI system as a 'public-facing AI website' and a 'consumer AI tool' used by an employee to 'crunch some numbers' on an uploaded spreadsheet. It performed a specific, well-defined data processing function on direct input.
Limited Risk: The system is described as a 'public-facing AI website' and 'consumer AI tool' (such as a general-purpose chatbot or utility), which falls under Limited Risk due to transparency obligations for users interacting with AI.
The employee used the AI tool to 'crunch some numbers' on a spreadsheet containing patient data, which aligns with data processing, grouping, and basic value estimation functions.
The report provides clear, specific details about the incident, including the date of discovery (Sept 21), the number of affected patients (3,182), the types of data exposed, and the actions taken by the hospital. There is no conflicting information.
None. The facts of the unauthorized upload and subsequent data exposure are straightforward.
Technology
Public AI Tool Accessibility
Public-facing AI tool was accessible on hospital network without restriction.
Lack of Data Loss Prevention
No DLP software blocked the upload of sensitive PHI to external websites.
Data Inputs
Unencrypted Patient Spreadsheet
Spreadsheet containing PHI was unencrypted and easily uploaded.
Unmasked Personal Data
Patient names and medical record numbers were not anonymized.
Human Factors
Shadow AI Adoption by Staff
Employee chose unapproved AI tool to quickly perform work tasks.
Poor AI Risk Perception
Staff failed to recognize privacy risks of uploading data to public AI.
Process and Methods
Deficient AI Validation
Hospital lacked rigorous validation mechanisms for AI tools.
Weak Policy Reinforcement
Lack of active reinforcement regarding unauthorized AI tool usage.
Management
Inadequate Shadow IT Oversight
Management failed to monitor and govern unauthorized AI tool usage.
Insufficient Staff Training
Hospital did not provide adequate training on secure AI practices.
Regulatory Environment
Evolving AI Compliance Standards
Regulatory frameworks for healthcare AI usage are still developing.
