Healthcare Providers Discover Unauthorized PHI Disclosures to AI Tools
Two data privacy incidents have recently been announced that involved patient data uploaded to artificial intelligence (AI) tools without authorization.
Weill Cornell Medicine, New York
Weill Cornell Medicine, Cornell University’s school of medicine and biomedical research institution in New York City, has alerted certain patients about a privacy incident involving patient information being used in an unauthorized capacity related to a radiology research study. On September 6, 2026, Weill Cornell Medicine discovered that certain patients’ protected health information used in connection with the study had been entered into AI and machine learning tools without authorization and in violation of its policies.
The data was uploaded to the tools between June 10 and June 20, 2026, and included the information of patients who received medical imaging services at NewYork-Presbyterian (WCINYP) or NewYork-Presbyterian Hospital. The data uploaded to the tools did not include patient names, contact information, Social Security numbers, or financial information. The uploaded information was limited to medical record numbers, radiology accession numbers assigned to radiology images, dates and times of radiology services, facility names, healthcare provider names, and clinical information relating to radiological examinations, which may have included diagnoses, treatment information, surgical and procedural histories, and medication information.
Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha
Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.
Learn More About This Offer
Weill Cornell Medicine said it has not identified any misuse of patient data as a result of the incident, has suspended the research activity, and submitted a request to have the data deleted. Additional education has been provided to appropriate individuals regarding appropriate use of AI tools and the importance of protecting patient information. The number of affected individuals has not yet been publicly disclosed.
Lake Burien Transitional Care Facility & Western State Hospital, Washington
The protected health information of a small number of patients of two mental health facilities operated by the Washington Department of Social and Health Services has been impermissibly uploaded to ChatGPT. A Lake Burien Transitional Care Facility staff member used their personal ChatGPT account to draft summaries for client case notes, which included the patients’ personal health information.
The Department of Social and Health Services identified one instance where the tool had been impermissibly used. Further investigation identified multiple previous instances where the employee had used the tool to generate case summaries. The case notes included information such as names, diagnoses, and medications. The state has written to 12 families of patients who were affected. A similar incident was identified affecting four Western State Hospital patients. The employees were instructed to delete all ChatGPT prompts before deleting their accounts.
A Growing Privacy Risk
A survey conducted by the clinical technology company Wolters Kluwer Health earlier this year suggests many healthcare employees are using AI tools that have not been authorized for use by their IT department. According to the survey, 40% of hospital workers said they were aware of colleagues using unauthorized AI tools, and 20% admitted to using the tools themselves.
AI tools have tremendous potential in healthcare and can greatly improve efficiency, and employees often turn to these tools to get more done in less time. While many AI tools can be used in healthcare in compliance with the HIPAA Rules, consumer versions of AI tools lack the necessary safeguards to comply with the HIPAA Rules and must not be used by healthcare staff in connection with any protected health information.
In addition to the privacy risks, these tools can also pose a risk to patient safety, as they can generate responses containing misleading or inaccurate information. In one recent case, a woman with epilepsy took the advice of ChatGPT while attempting to wean herself off her anti-seizure prescription medication. She suffered a fatal seizure after following the medication reduction regimen suggested by ChatGPT. A lawsuit has been filed against OpenAI in response, that alleges that ChatGPT effectively practiced medicine without a license.
