Security Breach Highlights Danger of Shadow A.I.

“Thousands of Baltimore patients may have had their personal health information exposed after a worker uploaded a spreadsheet to a third-party public artificial intelligence tool that the hospital had not approved.”  Bridget Byrne, Data breach: Johns Hopkins Bayview Medical Center alerts patients (Oct. 25, 2026).

The article reports that the breach, caused by employee error, impacted 3,282 patients.  “The spreadsheet in question included patient names, dates of admission, medical record numbers, account numbers, departments of service, medications administered and provider names. It did not include Social Security numbers or financial account information.”

Further, it reports:

The hospital said it had the employee delete the initial AI prompt and thread from the AI tool’s history and reached out to the company that owns and operates the tool to request deletion.

The hospital system said they are taking restrict unauthorized applications and artificial intelligence tools and educating its employees about the tools.

AI policies should address the use of shadow artificial intelligence.