Healthcare Providers Discover Unauthorized PHI Disclosures to AI Tools – The HIPAA Journal
Healthcare Providers Discover Unauthorized PHI Disclosures to AI Tools The HIPAA Journal
Healthcare Providers Discover Unauthorized PHI Disclosures to AI Tools
Two data privacy incidents have recently been announced that involved patient data uploaded to artificial intelligence (AI) tools without authorization.
Weill Cornell Medicine, New York
Weill Cornell Medicine, Cornell University’s school of medicine and biomedical research institution in New York City, has alerted certain patients about a privacy incident involving patient information being used in an unauthorized capacity related to a radiology research study. On September 6, 2026, Weill Cornell Medicine discovered that certain patients’ protected health information used in connection with the study had been entered into AI and machine learning tools without authorization and in violation of its policies.
The data was uploaded to the tools between June 10 and June 20, 2026, and included the information of patients who received medical imaging services at NewYork-Presbyterian (WCINYP) or NewYork-Presbyterian Hospital. The data uploaded to the tools did not include patient names, contact information, Social Security numbers, or financial information. The uploaded information was limited to medical record numbers, radiology accession numbers assigned to radiology images, dates and times of radiology services, facility names, healthcare provider names, and clinical information relating to radiological examinations, which may have included diagnoses, treatment information, surgical and procedural histories, and medication information.
Weill Cornell Medicine said it has not identified any misuse of patient data as a result of the incident, has suspended the research activity, and submitted a request to have the data deleted. Additional education has been provided to appropriate individuals regarding appropriate use of AI tools and the importance of protecting patient information. The number of affected individuals has not yet been publicly disclosed.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Lake Burien Transitional Care Facility & Western State Hospital, Washington
The protected health information of a small number of patients of two mental health facilities operated by the Washington Department of Social and Health Services has been impermissibly uploaded to ChatGPT. A Lake Burien Transitional Care Facility staff member used their personal ChatGPT account to draft summaries for client case notes, which included the patients’ personal health information.
The Department of Social and Health Services identified one instance where the tool had been impermissibly used. Further investigation identified multiple previous instances where the employee had used the tool to generate case summaries. The case notes included information such as names, diagnoses, and medications. The state has written to 12 families of patients who were affected. A similar incident was identified affecting four Western State Hospital patients. The employees were instructed to delete all ChatGPT prompts before deleting their accounts.
A Growing Privacy Risk
A survey conducted by the clinical technology company Wolters Kluwer Health earlier this year suggests many healthcare employees are using AI tools that have not been authorized for use by their IT department. According to the survey, 40% of hospital workers said they were aware of colleagues using unauthorized AI tools, and 20% admitted to using the tools themselves.
AI tools have tremendous potential in healthcare and can greatly improve efficiency, and employees often turn to these tools to get more done in less time. While many AI tools can be used in healthcare in compliance with the HIPAA Rules, consumer versions of AI tools lack the necessary safeguards to comply with the HIPAA Rules and must not be used by healthcare staff in connection with any protected health information.
In addition to the privacy risks, these tools can also pose a risk to patient safety, as they can generate responses containing misleading or inaccurate information. In one recent case, a woman with epilepsy took the advice of ChatGPT while attempting to wean herself off her anti-seizure prescription medication. She suffered a fatal seizure after following the medication reduction regimen suggested by ChatGPT. A lawsuit has been filed against OpenAI in response, that alleges that ChatGPT effectively practiced medicine without a license.
The post Healthcare Providers Discover Unauthorized PHI Disclosures to AI Tools appeared first on The HIPAA Journal.
PJ&A to Pay Up to $10 Million to Resolve Violations of HIPAA; State Law – The HIPAA Journal
PJ&A to Pay Up to $10 Million to Resolve Violations of HIPAA; State Law The HIPAA Journal
PJ&A to Pay Up to $10 Million to Resolve Violations of HIPAA; State Law
A $10 million settlement has been agreed to resolve a multi-state investigation of the medical transcription service provider Perry Johnson & Associates, Inc. (PJ&A) and four related companies. The investigation identified multiple violations of the HIPAA Security Rule and state laws. While the settlement could see a financial penalty of $10 million paid, the vast majority of the penalty has been suspended. PJ&A is required to pay $300,000 in penalties and must adopt and maintain robust data security policies and practices. Should the PJ&A companies fail to meet the terms of the settlement agreement, they will be liable to pay the remaining $9.7 million to the participating states.
PJ&A, a health information technology company that provides medical transcription, coding, and billing services to hospitals and other healthcare providers, experienced a cybersecurity incident in March 2023. A threat actor compromised its network using the credentials of a PJ&A employee and accessed parts of its network containing the electronic protected health information of approximately 13.3 million individuals.
The forensic investigation determined that its network was first accessed by the threat actor on March 27, 2023, and that between April 7 and April 19, 2023, database files containing patient information were exfiltrated, including names, addresses, dates of birth, Social Security numbers, diagnoses, health insurance information, and information contained in transcription files, including lab test results and medications. The intrusion was detected on May 2, 2023, when the hackers started contacting PJ&A employees directly. A ransom payment was demanded to prevent the publication of the stolen data, and when payment was not made, the stolen data was leaked.
An investigation was launched by a coalition of state attorneys general to determine whether the data breach occurred as a result of the failure to comply with federal and state laws. The investigation was led by New York Attorney General Letitia James, and Connecticut Attorney General William Tong, New Jersey Attorney General Jennifer Davenport, and Michigan Attorney General Dana Nessel participated in the investigation.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The investigation determined that the threat actor was able to use the stolen credentials of a coding employee to access an account that did not have multifactor authentication enabled. After gaining access to PJ&A systems, the threat actor harvested passwords over the following months to access further resources and exfiltrated unencrypted files containing personal and protected health information. The intrusion was only detected when the hackers made contact two months after the initial compromise. PJ&A had security software installed that recorded the unauthorized activity; however, it was not configured to generate alerts, so the intrusion went unnoticed.
The multi-state investigation determined that while PJ&A conducted general risk assessments, it failed to conduct a HIPAA risk analysis and did not conduct or evaluate the companies’ administrative, technical, or physical safeguards in the context of the HIPAA Security Rule requirements. PJ&A failed to comply with the HIPAA Security Rule with respect to the use of subcontractors, which were provided with technical access to systems containing ePHI without being contractually obliged to ensure the confidentiality of ePHI or implement reasonable safeguards to protect that information. The investigation also identified a further 16 violations of the HIPAA Security Rule, and violations of New York regulations GBL § 899-aa and GBL § 899-bb. The former relates to issuing data breach notifications in the most expedient time possible, and the latter relates to the implementation and maintenance of reasonable safeguards to protect consumer information.
The settlement agreement was agreed by the participating states, PJ&A, and the associated companies Perry Johnson, Inc., Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc., and Medical Transcription and Coding, Inc. New York will receive $100,000 of the $300,000 penalty, and Connecticut, New Jersey, and Michigan will each receive $66,666.
Under the terms of the settlement agreement, PJ&A is required to implement and maintain robust data security policies and procedures. These include implementing and maintaining a comprehensive information security program and incident response protocol; multi-factor identification; password management; data encryption; and asset management safeguards and policies. Policies and procedures must be implemented governing the collection, use, retention, and disposal of personal health information, and annual risk assessments should be conducted consistent with the HIPAA Rules.
The post PJ&A to Pay Up to $10 Million to Resolve Violations of HIPAA; State Law appeared first on The HIPAA Journal.
Quest Diagnostics Quanum Breach: Check Patient Data Exposure – homeland411.com
Quest Diagnostics Quanum Breach: Check Patient Data Exposure homeland411.com
AI Health Data Privacy: ChatGPT, Gemini and Claude – NeoTeo
Security Incident at EHR Vendor Affects Patients of New York Counselling Practices
Hispanic Counseling Center and Brooklyn Counseling Services in New York have notified patients that some of their personal and health information was compromised in a data security incident at their electronic medical record vendor.
Hispanic Counseling Center
Long Island, New York-based Hispanic Counseling Center operates a mental health clinic and a substance use disorder clinic and provides bilingual counselling services. According to recently mailed notification letters, its electronic medical record vendor, Accumedic Computer Systems, informed Hispanic Counseling Center that it detected suspicious activity within its network on June 8, 2026.
Third-party cybersecurity experts were engaged to investigate the activity, and on August 7, 2026, the EHR vendor concluded that an unauthorized third party first accessed the Accumedic Computer Systems network on April 8, 2026, and potentially obtained customer information between June 4, 2026, and June 8, 2026. The impacted data was reviewed, and on September 1, 2026, Accumedic Computer Systems confirmed that patient health information had been exposed and was potentially obtained. The types of data involved included names, dates of birth, Social Security numbers, medical information, and health insurance information.
The EHR vendor has confirmed that additional technical safeguards have been implemented to prevent similar incidents in the future. Hispanic Counseling Center started notifying the affected individuals on October 30, 2026. The notification letters state that complimentary credit monitoring services are available to the affected individuals. The number of affected individuals has not been publicly disclosed as of the date of this article.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please enable JavaScript in your browser to complete this form.
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Brooklyn Counseling Services
Brooklyn Counseling Services, a Brooklyn, New York-based provider of psychological and emotional care and support, has also notified certain patients about a recent security incident that exposed some of their personal data. The company, which operates formally as BCS Group and is also known as BCS Counselling Group, said the incident affected one of its electronic medical records vendors.
State Attorneys general have been notified about the incident; however, the total number of affected individuals has yet to be publicly disclosed. The incident affected one Massachusetts resident and two Vermont residents; however, the vast majority of individuals are likely to reside in Brooklyn, and the New York Attorney General does not publicly disclose the number of individuals affected by data breaches.
The individual notification letters state the types of information involved for each individual, which include names, email addresses, phone numbers, dates of birth, Social Security Numbers, and health records. The breach notification letter seen by The HIPAA Journal does not state when the incident occurred and does not name the vendor; however, the timing of the letters suggests the incident involved the same vendor, Accumedic Computer Systems, which offers EHR software specifically for behavioral health services providers.
The post Security Incident at EHR Vendor Affects Patients of New York Counselling Practices appeared first on The HIPAA Journal.