AI news ·
Johns Hopkins Patient Data Exposed Through Unapproved AI Tool
A Johns Hopkins employee put 3,182 patients’ health records into an unapproved public AI tool, exposing data not through a hack but by direct entry.
An employee at Johns Hopkins uploaded protected health information for 3,182 patients into an unapproved, publicly accessible AI tool. The data exposure was not the result of a system breach, but of a staff member actively entering sensitive records into an application that lacked institutional approval for such use.
The incident highlights a gap between written policy and operational reality. Existing rules governing data handling were not enough to prevent the action, pointing to the need for technical controls that block or flag unapproved transfers, readily available approved alternatives, and workforce training that reinforces what constitutes safe use of AI tools with protected data.