New York City-based Weill Cornell Medicine disclosed that patient health information was entered into AI tools and processed using machine learning without authorization as part of a radiology research study.
Weill Cornell learned of the incident Sept. 6 and launched an investigation, which determined that certain patient information from Weill Cornell Imaging at NewYork-Presbyterian or NewYork-Presbyterian Hospital had been entered into AI tools between June 10 and June 20.
The use of the information was unauthorized and violated Weill Cornell’s policies, according to a Nov. 5 notice from the organization.
The affected information included medical record numbers, radiology accession numbers, dates and times of radiology services, facility names and healthcare provider names. Clinical information related to patients’ radiology examinations, including diagnoses, treatments, surgical and procedural histories, and medications, was also involved.
Weill Cornell said the information did not include patients’ names, addresses, telephone numbers, email addresses, Social Security numbers or financial information.
The organization said it has not identified evidence that an unauthorized individual viewed the information or that any patient data was misused.
In response, Weill Cornell suspended the research activity and requested that all involved data be deleted. It also provided additional education on its requirements for the appropriate use of AI tools and protection of patient information.
The organization said it is continuing to expand its security measures, including additional training.
The notice did not identify who entered the data into the AI tools, which AI tools were used, how many patients were affected or whether the requested data deletion had been completed.
