Hopkins Bayview AI Breach: Deleting the Chat Isn’t a Fix

On October 22, Johns Hopkins Bayview Medical Center in Baltimore began mailing letters to about 3,182 patients. A workforce member had uploaded a spreadsheet of patient data to a public AI tool the hospital had not approved.

No hacker was involved. The exposure came from a person, a spreadsheet, and an open browser tab.

What Happened

According to reporting by Becker’s Hospital Review, the Baltimore Sun, and local outlets, the hospital found the problem on September 21 during an internal review. The spreadsheet covered patients admitted and treated between May and September 2026. Local reports say it included names, medical record numbers, and medication information.

The hospital has not named the AI tool. It says it investigated, strengthened its policies and training, restricted unapproved apps and AI tools, and is retraining staff on the tools it has approved.

The Policy Was Already There

Johns Hopkins University’s AI guidelines, issued last year, told members of the community not to enter clinical records into unapproved third-party generative AI tools, warning that such tools do not guarantee privacy.

So the rule existed. It did not stop a well-meaning person under time pressure from using a tool that was easy to reach. That gap between written policy and daily habit is the lesson most teams recognize from their own workplace.

Why Deleting the Chat Isn’t the Fix

The hospital’s first response was to have the worker delete the prompt, the conversation thread, and the uploaded document from the tool’s history. It also asked the company behind the tool to delete the data.

Deleting your own history removes what you can see. What the vendor keeps depends on the vendor’s own terms, which is why the hospital had to ask. As of this week, reporting notes that Hopkins has not confirmed whether the company deleted the records, so patients cannot verify where their information now sits.

Why Writing Teams Should Pay Attention

This was a spreadsheet, not a manuscript, but the pattern is the same one writing teams face every day:

• A long document and a deadline

• A free tool that is faster than the approved route

• Content that feels routine but contains identifiable detail

Case narratives, site listings, safety summaries, and review spreadsheets all carry the same risk as the file in this case.

What to Put in Place Before the Next Slip

1. Make the approved tool the easy one. If the safe route is slower, people will route around it.

2. Prefer tools that keep nothing. If content is not retained, there is nothing to chase after a mistake.

3. Get the paperwork. Ask for a BAA or DPA before anyone pastes real content.

4. Write a one-page rule. State which content never goes into unapproved tools.

5. Prepare an incident checklist. Know what to ask a vendor in writing: what was stored, for how long, whether it was used for training, and whether deletion can be confirmed.

Where Trinka’s Confidential Data Plan Fits

Trinka’s Confidential Data Plan is built around the second and third points. Content is processed in memory with zero data retention, is never used to train a model, and is encrypted in transit and at rest. Trinka states that a Business Associate Agreement is available on request for healthcare organizations.

Confidential Data Plan does not stop someone from pasting content into a different, unapproved tool, and it does not replace de-identification or the minimum-necessary habit. What it changes is what the approved route offers: a tool that keeps nothing, so a mistaken upload does not leave a copy to chase.

Conclusion

The Bayview case shows that policy alone is not enough, and that cleaning up afterward is slow and uncertain. The stronger move is to give people an approved tool that is quick to use and keeps no copy, and to agree the rules before the deadline arrives.

Key Takeaways

• A staff upload to an unapproved AI tool, not a hack, led to notices for about 3,182 patients.

• A written policy already existed, which shows policy alone is not enough.

• Deleting your own history does not confirm the vendor deleted its copy.

• An approved tool with zero retention and a signed agreement changes what a slip costs.