Three academic healthcare organizations have reported incidents in 2026 involving patient information being entered into external or unauthorized artificial intelligence tools, raising questions about how hospitals oversee AI use and protect sensitive health data.
The incidents at Weill Cornell Medicine, Johns Hopkins Bayview Medical Center and Loma Linda University Health share several traits. Each stemmed from patient data being put into AI tools during research or internal work rather than from an outside cyberattack. Two of the three occurred during research studies. Each organization’s response centered on requesting deletion of the data, and Weill Cornell and Johns Hopkins did not name the AI tools involved.
Here are the three incidents, listed by date of public disclosure, most recent first:
- Weill Cornell Medicine (New York City): Weill Cornell disclosed Nov. 5 that patient health information was entered into AI tools without authorization during a radiology research study between June 10 and June 20. The information included medical record numbers and clinical details but not patient names, Social Security numbers or financial information. The organization suspended the research activity and requested deletion of the data.
- Johns Hopkins Bayview Medical Center (Baltimore): The hospital notified approximately 3,182 patients after a workforce member mistakenly uploaded a spreadsheet containing patient information to an unapproved public AI tool Sept. 21. The hospital disclosed the incident Oct. 23 and offered affected patients 12 months of complimentary credit monitoring.
- Loma Linda University Health (Loma Linda, Calif.): The health system reported July 27 that a file containing limited patient information was inadvertently uploaded May 25 to an external AI platform during an Institutional Review Board-approved research study. Loma Linda requested deletion of the information and said it is reviewing its policies and training related to external technologies, including AI tools.
