How Does Patient Data End Up in an Unapproved AI Tool?

Patient data ends up in unapproved AI tools when an employee trying to finish real work faster uploads it to a public AI platform the organization never cleared for protected health information. That is what happened at Johns Hopkins Bayview Medical Center in Baltimore, and it can happen in any hospital where staff have a browser and a busy afternoon.

On Sept. 21, 2026, during an internal review, a Bayview staff member uploaded a spreadsheet of patient information to an outside AI tool. The file covered patients treated from May through September 2026 and included names, admission and treatment dates, medical record numbers, account numbers, departments, medications, and provider names, according to WMAR 2 News in Baltimore.

Nobody broke in. Someone uploaded.

That is the AI incident most hospital leaders are not planning for. A January 2026 survey from Wolters Kluwer Health found that 40% of healthcare professionals have encountered unauthorized AI tools at work, and nearly 20% admit to using them. This guide from Five Nines Technology Group, a managed IT and cybersecurity provider headquartered in Lincoln, Nebraska, explains how it happens, why security tools miss it, and how hospitals close the gap.

What Happened at Johns Hopkins Bayview Medical Center?

Short answer: A Johns Hopkins Bayview Medical Center employee uploaded a spreadsheet with health information for 3,182 patients to a public AI tool the hospital had not approved. The hospital found the problem the same day, Sept. 21, 2026, and began mailing notification letters on Oct. 22, 2026.

The exposed details reached well into the clinical record: medical record numbers, account numbers, treating department, medications given, and provider names. The hospital reported that Social Security numbers and financial account details were not included.

The response followed a familiar playbook. The employee deleted the prompt, the conversation thread, and the file from the tool's history. Bayview asked the AI company to delete the data, opened an investigation, and offered affected patients 12 months of credit monitoring through Experian IdentityWorks.

Bayview also said it is tightening limits on unapproved apps and AI tools and retraining staff on which tools are approved. Notice what that step tells every other hospital: the approved list and the training are the fix.

Is Uploading Patient Data to an AI Tool a HIPAA Violation?

Short answer: It can be. Under HHS guidance on HIPAA and cloud computing, a cloud vendor that stores or processes electronic protected health information for a hospital is a business associate and needs a signed business associate agreement (BAA). A public AI tool with no BAA is not a cleared destination for patient data.

The U.S. Department of Health and Human Services Office for Civil Rights spells out the rule plainly. A covered entity may use a cloud service for ePHI only after it signs a HIPAA-compliant BAA with that provider and otherwise follows the HIPAA Rules.

When PHI lands somewhere it should not, the hospital's privacy officer has to work through a breach risk assessment and a notification decision. Five Nines is not a law firm, and every incident needs counsel. The operational lesson is simpler: if staff do not know which AI tools have a BAA behind them, every upload is a guess.

Why Do Hospital Staff Use Unapproved AI Tools?

Short answer: Most staff use unapproved AI tools to work faster, not to cut corners on privacy. Wolters Kluwer Health found that nearly 20% of healthcare professionals admit to using unauthorized AI tools. When the approved path is slow or missing, people take the fast one.

The real issue isn't rogue employees. It's a productivity problem wearing a security costume.

Look at where the Bayview upload happened: during an internal review. Someone had a spreadsheet, a question, and a tool that could answer it in seconds. Nothing about that moment felt like a data breach to the person doing it.

That is why a memo that says "do not use AI" rarely holds. Staff who need speed will find a tool. Leadership's real choice is whether that tool is one they approved, can see, and have a BAA behind.

Five Nines Insight

A ban without an approved alternative does not stop AI use. It stops you from seeing it.

Why Don't Firewalls and Security Tools Catch This?

Short answer: Most hospital security tools are built to stop attackers getting in. An employee uploading a file to a well-known AI website looks like ordinary browsing. Catching it takes a written policy, an approved tool list, trained staff, and technical controls set up for AI destinations specifically.

Endpoint detection, firewalls, and 24/7 security monitoring are designed to find malicious activity. A clinician opening a popular AI site and attaching a spreadsheet is not malicious. It is a legitimate user, on a legitimate device, visiting a legitimate website.

That gap closes in layers. Training tells people where the line is. An approved tool list gives them somewhere safe to go. Web filtering and data loss controls can block or flag uploads to unapproved AI sites. 

The Hidden Risk

Deleting the chat thread cleans up the screen. It does not prove where the data went.

Once a file reaches an outside vendor, what happens next depends on that vendor's retention settings and its willingness to delete on request. Bayview had to ask. No hospital wants to be the one asking.

Where Does Your Hospital Sit on the Five Nines AI Governance Ladder?

Short answer: The Five Nines AI Governance Ladder sorts hospitals into four stages by how AI use is controlled on the floor. Most of the risk sits in the first two stages, where AI use is either invisible or banned on paper with no approved alternative.

The Five Nines AI Governance Ladder

Score your hospital on the row that describes your floor, not your policy binder. The steps Bayview announced, limits on unapproved tools and retraining on approved ones, are Stage 3 work. The goal is to get there before the letters go out.

What Does Five Nines Look for When Reviewing AI Use in a Hospital?

Short answer: When Five Nines reviews AI use in a healthcare organization, the warning signs are usually ordinary: personal AI accounts on work browsers, spreadsheets carrying more PHI than the task needs, and a policy nobody sees at the moment it matters.

• Personal AI accounts on work browsers. Staff sign into free AI tools with personal email, so the hospital has no account, no settings control, and no record.
• Spreadsheets as the carrier. Report exports from the EHR or billing system are the easiest thing to attach, and they often hold more patient detail than the task needed.
• Policy in the handbook, not at the point of use. The rule exists, but nothing on screen reminds staff when they are about to cross it.
• Phishing training with no AI module. Security awareness training covers suspicious email and says nothing about what can go into a prompt.
• No named owner. Nobody can say who decides which AI tools are approved, so nobody does.

What Leadership Misses

Your most likely AI incident will not come from an attacker. It will come from one of your most efficient employees on a busy afternoon.

What Should Hospitals Do This Quarter to Prevent an AI Data Exposure?

Short answer: Start with visibility, then give staff a safe path. Five Nines recommends five steps: find current AI use, publish an approved tool list, adopt a signed acceptable use policy, train every employee on a schedule, and add technical controls on unapproved AI sites.

1. Find out what is already in use. Ask staff without blame and review web traffic for AI destinations. You cannot govern tools you cannot name.
2. Publish an approved and banned tool list. Name at least one sanctioned option with a BAA behind it so staff have somewhere to go.
3. Adopt an acceptable use policy with sign-off. Spell out what never goes into a prompt: patient names, medical record numbers, account numbers, medications, and anything else that identifies a patient.
4. Train leaders and staff live, then repeat it. The HIPAA Security Rule already requires a security awareness and training program for the workforce (45 CFR 164.308(a)(5)). AI use belongs inside it.
5. Add technical controls and a first-hour plan. Block or flag uploads to unapproved AI sites, and write down who gets called first so nobody improvises. 

Five Nines builds and maintains HIPAA compliance programs for healthcare organizations, including gap assessments, policy creation, security awareness training, and the evidence auditors ask for. For existing Five Nines healthcare partners, NineGuard Health adds AI training for leaders and staff, an acceptable use policy drafted and adopted with sign-off, and a published approved and banned tool list. 

What Should You Ask Your IT Provider About AI and Patient Data?

Short answer: Ask your IT provider six questions: which AI tools staff use now, which approved tools have a BAA, whether unapproved uploads can be blocked, whether training covers prompts, who responds first to an AI exposure, and how AI shows up in your HIPAA risk analysis.

1. Which AI tools are our staff using right now, and how would we know?
2. Which of our approved AI tools have a signed BAA?
3. Can we block or flag uploads to AI sites we have not approved?
4. Does our security awareness training cover what can and cannot go into an AI prompt?
5. If someone uploaded PHI to an AI tool today, who would we call first, and what happens in the first hour?
6. How does AI use show up in our HIPAA security risk analysis?

Do You Know Which AI Tools Your Staff Used This Week?

If the honest answer is "I'm not sure," you are not alone, and you are not covered.

A Five Nines AI Exposure Review identifies:

• Which AI tools staff use today, approved or not
• Where PHI is most likely to leave through a prompt or upload
• Which tools have a BAA behind them and which do not
• Gaps in your acceptable use policy and staff training
• The technical controls that would catch the next upload

You leave with your stage on the Five Nines AI Governance Ladder and a prioritized plan to reach Stage 3

The goal isn't to keep AI out of your hospital. It's to make the safe path the easy one.