Two data privacy incidents have recently been announced that involved patient data uploaded to artificial intelligence (AI) tools without authorization.
Weill Cornell Medicine, New York
Weill Cornell Medicine, Cornell University’s school of medicine and biomedical research institution in New York City, has alerted certain patients about a privacy incident involving patient information being used in an unauthorized capacity related to a radiology research study. On September 6, 2026, Weill Cornell Medicine discovered that certain patients’ protected health information used in connection with the study had been entered into AI and machine learning tools without authorization and in violation of its policies.
The data was uploaded to the tools between June 10 and June 20, 2026, and included the information of patients who received medical imaging services at NewYork-Presbyterian (WCINYP) or NewYork-Presbyterian Hospital. The data uploaded to the tools did not include patient names, contact information, Social Security numbers, or financial information. The uploaded information was limited to medical record numbers, radiology accession numbers assigned to radiology images, dates and times of radiology services, facility names, healthcare provider names, and clinical information relating to radiological examinations, which may have included diagnoses, treatment information, surgical and procedural histories, and medication information.
Weill Cornell Medicine said it has not identified any misuse of patient data as a result of the incident, has suspended the research activity, and submitted a request to have the data deleted. Additional education has been provided to appropriate individuals regarding appropriate use of AI tools and the importance of protecting patient information. The number of affected individuals has not yet been publicly disclosed.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
@media only screen and (min-width: 961px) {
.inpage_mobile {
display: none;
}
.inpage_banner_12838 {
margin-bottom: 18px;
}
.inpage_banner_12838 a {
max-width: 80%;
display: block;
margin: 0 auto;
}
}
@media only screen and (max-width: 960px) {
.inpage_desktop { display: none; }
}
.hj_co_m_12838 {
margin-bottom: 30px;
}
.hj_co_m_12838 .sbwf-main-form-container {
max-width: 340px;
margin: 0 auto;
box-shadow: 0 4px 6px rgba(0,0,0,0.05),0 6px 6px rgba(0,0,0,0.05);
padding: 30px;
box-sizing: border-box;
border: 1px solid #f4f4f4;
}
.hj_co_m_12838 .sbwf-main-form-container img {
max-width: 200px;
margin: 0 auto;
display: block;
}
.hj_co_m_12838 .sbwf-main-form-container p.cl_title1,
article.entry-content .lp-main .lp-main-content .hj_co_m_12838 .sbwf-main-form-container p.cl_title1 {
text-align: center;
border-top: 1px dashed #c8c8c8;
padding: 20px 0 0;
margin: 30px 0 20px;
color: #753043;
font-weight: 600;
line-height: 30px;
}
.hj_co_m_12838 .sbwf-main-form-container p.cl_title2,
article.entry-content .lp-main .lp-main-content .hj_co_m_12838 .sbwf-main-form-container p.cl_title2 {
text-align: center;
font-size: 16px;
color: #3B3B3B;
line-height: 24px;
font-weight: 600;
margin: 0;
padding: 0;
}
#sidebar .sbwf-main-form-container p.cl_title1 span {
font-weight: 700;
color: #000;
padding-top: 4px;
display: block;
line-height: 34px;
}
.hj_co_m_12838 .sbwf-main-form-container p.cl_title2 span {
font-weight: 600;
}
.hj_co_m_12838 .sbwf-main-form-container p.terms,
article.entry-content .lp-main .lp-main-content .hj_co_m_12838 .sbwf-main-form-container p.terms {
text-align: center;
font-size: 11px;
padding-bottom: 0;
line-height: 19px;
margin: 10px 0 10px;
}
.hj_co_m_12838 .sbwf-main-form-container p.terms a {
color: #753044;
text-decoration: none;
}
.hj_co_m_12838 .sbwf-main-form-container p.terms a:hover {
text-decoration: underline;
}
.hj_co_m_12838 .sbwf-main-form-container p.terms_title,
article.entry-content .lp-main .lp-main-content .hj_co_m_12838 .sbwf-main-form-container p.terms_title {
text-align: center;
font-size: 11px;
font-weight: 600;
color: #752f43;
padding-bottom: 0;
line-height: 19px;
}
.hj_co_m_12838 .sbwf-main-form-container p.info,
article.entry-content .lp-main .lp-main-content .hj_co_m_12838 .sbwf-main-form-container p.info {
text-align: center;
color: #727272;
font-size: 14px;
line-height: 20px;
padding-bottom: 20px;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form input.wpforms-field-medium {
width: 100%;
max-width: 100%;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form .wpforms-field {
padding-top: 0;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form input[type="text"],
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form input[type="email"],
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form input[type="tel"] {
border: 2px solid #f4f3f3;
font-size: 14px;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full {
margin: 24px 0;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form button[type="submit"] {
border: 0;
color: #fff;
margin: 0 auto;
display: flex;
align-items: center;
justify-content: center;
box-sizing: border-box;
padding: 0 65px 0 30px;
background-image: url(https://www.hipaajournal.com/wp-content/uploads/2026/08/btn.png);
background-color: unset;
background-size: cover;
background-repeat: no-repeat;
width: 260px;
height: 61px;
font-size: 16px;
font-weight: 600;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form button[type="submit"]:hover {
background-image: url(https://www.hipaajournal.com/wp-content/uploads/2026/08/btn_hover.png);
background-color: unset;
border: 0;
}
.hj_co_m_12838 .sbwf-main-form-container {
padding: 20px;
}
.hj_co_m_12838 .sbwf-main-form-container img {
max-width: 170px;
}
.hj_co_m_12838 .sbwf-main-form-container p.cl_title1,
article.entry-content .lp-main .lp-main-content .hj_co_m_12838 .sbwf-main-form-container p.cl_title1 {
font-size: 22px;
line-height: 28px;
}
.hj_co_m_12838 .sbwf-main-form-container p.cl_title1 span {
font-weight: 700;
color: #000;
padding-top: 4px;
display: block;
line-height: 34px;
}
.hj_co_m_12838 .sbwf-main-form-container p.cl_title2,
article.entry-content .lp-main .lp-main-content .hj_co_m_12838 .sbwf-main-form-container p.cl_title2 {
font-size: 18px;
line-height: 24px;
}
.hj_co_m_12838 div.wpforms-container-full .wpforms-form input.wpforms-field-medium[type="text"],
.hj_co_m_12838 div.wpforms-container-full .wpforms-form input.wpforms-field-medium[type="email"],
.hj_co_m_12838 div.wpforms-container-full .wpforms-form input.wpforms-field-medium[type="tel"] {
height: 36px;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form button[type="submit"] {
border: 0;
color: #fff;
margin: 0 auto;
display: flex;
align-items: center;
justify-content: center;
box-sizing: border-box;
padding: 0 65px 0 30px;
background-image: url(https://www.hipaajournal.com/wp-content/uploads/2026/08/btn.png);
background-color: unset;
background-size: cover;
background-repeat: no-repeat;
width: 220px;
height: 52px;
font-size: 15px;
font-weight: 600;
}
.hj_co_m_12838 .sbwf-main-form-container div.wpforms-container-full .wpforms-form button[type="submit"]:hover {
background-image: url(https://www.hipaajournal.com/wp-content/uploads/2026/08/btn_hover.png);
background-color: unset;
border: 0;
}
.hj_sb_m_12838 div.wpforms-container-full .wpforms-form .wpforms-field-row.wpforms-field-medium {
max-width: 100%;
}
form[data-zi-mapped-form] #wpforms-28160-field_1,
form[data-zi-mapped-form] #wpforms-28160-field_1-last,
form[data-zi-mapped-form] #wpforms-28160-field_3-container,
form[data-zi-mapped-form] #wpforms-28160-field_6-container {
display: none;
}
form[data-zi-mapped-form] #wpforms-28160-field_1[data-zi-input-enriched="false"],
form[data-zi-mapped-form] #wpforms-28160-field_1-last[data-zi-input-enriched="false"],
form[data-zi-mapped-form] #wpforms-28160-field_3-container[data-zi-field-enriched="false"],
form[data-zi-mapped-form] #wpforms-28160-field_6-container[data-zi-field-enriched="false"] {
display: block !important;
}
form[data-zi-mapped-form] #wpforms-28155-field_1,
form[data-zi-mapped-form] #wpforms-28155-field_1-last,
form[data-zi-mapped-form] #wpforms-28155-field_3-container,
form[data-zi-mapped-form] #wpforms-28155-field_6-container {
display: none;
}
form[data-zi-mapped-form] #wpforms-28155-field_1[data-zi-input-enriched="false"],
form[data-zi-mapped-form] #wpforms-28155-field_1-last[data-zi-input-enriched="false"],
form[data-zi-mapped-form] #wpforms-28155-field_3-container[data-zi-field-enriched="false"],
form[data-zi-mapped-form] #wpforms-28155-field_6-container[data-zi-field-enriched="false"] {
display: block !important;
}
Lake Burien Transitional Care Facility & Western State Hospital, Washington
The protected health information of a small number of patients of two mental health facilities operated by the Washington Department of Social and Health Services has been impermissibly uploaded to ChatGPT. A Lake Burien Transitional Care Facility staff member used their personal ChatGPT account to draft summaries for client case notes, which included the patients’ personal health information.
The Department of Social and Health Services identified one instance where the tool had been impermissibly used. Further investigation identified multiple previous instances where the employee had used the tool to generate case summaries. The case notes included information such as names, diagnoses, and medications. The state has written to 12 families of patients who were affected. A similar incident was identified affecting four Western State Hospital patients. The employees were instructed to delete all ChatGPT prompts before deleting their accounts.
A Growing Privacy Risk
A survey conducted by the clinical technology company Wolters Kluwer Health earlier this year suggests many healthcare employees are using AI tools that have not been authorized for use by their IT department. According to the survey, 40% of hospital workers said they were aware of colleagues using unauthorized AI tools, and 20% admitted to using the tools themselves.
AI tools have tremendous potential in healthcare and can greatly improve efficiency, and employees often turn to these tools to get more done in less time. While many AI tools can be used in healthcare in compliance with the HIPAA Rules, consumer versions of AI tools lack the necessary safeguards to comply with the HIPAA Rules and must not be used by healthcare staff in connection with any protected health information.
In addition to the privacy risks, these tools can also pose a risk to patient safety, as they can generate responses containing misleading or inaccurate information. In one recent case, a woman with epilepsy took the advice of ChatGPT while attempting to wean herself off her anti-seizure prescription medication. She suffered a fatal seizure after following the medication reduction regimen suggested by ChatGPT. A lawsuit has been filed against OpenAI in response, that alleges that ChatGPT effectively practiced medicine without a license.
The post Healthcare Providers Discover Unauthorized PHI Disclosures to AI Tools appeared first on The HIPAA Journal.
