Quick Buzz Feed

Healthcare Providers Discover Unauthorized PHI Disclosures to AI Tools

Gary Lloyd | Nov 09,26 | 01:34 EST

Technology

Two data privacy incidents have recently been announced that involved patient data uploaded to artificial intelligence (AI) tools without authorization. Two data privacy incidents have recently been announced that involved patient data being entered into artificial intelligence (AI) tools without authorization.

Weill Cornell Medicine, New York Weill Cornell Medicine discovered on September 6, 2026, that patients' protected health information (PHI) from a radiology research study was inappropriately entered into AI and machine learning tools between June 10 and June 20, 2026. This unauthorized disclosure violated institutional policies. The disclosed data included medical record numbers, radiology accession numbers, dates and times of services, facility and provider names, and clinical information (diagnoses, treatment, surgical history, medications), but did not include patient names, contact info, Social Security numbers, or financial details. Weill Cornell Medicine has not identified any misuse of the data, has halted the research activity, requested data deletion, and provided additional training on appropriate AI tool usage and patient information protection. The exact number of affected individuals remains undisclosed. Lake Burien Transitional Care Facility & Western State Hospital, Washington The protected health information of a small number of patients from two Washington mental health facilities, Lake Burien Transitional Care Facility and Western State Hospital, was improperly uploaded to ChatGPT. A staff member at Lake Burien used their personal ChatGPT account to draft client case summaries, including patient names, diagnoses, and medications. The Washington Department of Social and Health Services found multiple instances of this misuse, affecting 12 families from Lake Burien and four patients from Western State Hospital. Employees involved were instructed to delete all ChatGPT prompts and their accounts. A Growing Privacy Risk A survey by Wolters Kluwer Health indicates a significant privacy risk in healthcare, with 40% of hospital workers aware of colleagues using unauthorized AI tools and 20% admitting to using them themselves. While AI tools offer efficiency benefits, consumer versions lack the necessary safeguards for HIPAA compliance and must not be used with protected health information. Beyond privacy, these tools pose patient safety risks due to potential for misleading or inaccurate information. An example cited is a woman who suffered a fatal seizure after following ChatGPT's advice to reduce her anti-seizure medication, leading to a lawsuit against OpenAI for allegedly practicing medicine without a license. This highlights the critical need for authorized and secure AI tools in healthcare.

Weill Cornell Medicine, New York

Weill Cornell Medicine discovered on September 6, 2026, that patients' protected health information (PHI) from a radiology research study was inappropriately entered into AI and machine learning tools between June 10 and June 20, 2026. This unauthorized disclosure violated institutional policies. The disclosed data included medical record numbers, radiology accession numbers, dates and times of services, facility and provider names, and clinical information (diagnoses, treatment, surgical history, medications), but did not include patient names, contact info, Social Security numbers, or financial details. Weill Cornell Medicine has not identified any misuse of the data, has halted the research activity, requested data deletion, and provided additional training on appropriate AI tool usage and patient information protection. The exact number of affected individuals remains undisclosed.

Lake Burien Transitional Care Facility & Western State Hospital, Washington

The protected health information of a small number of patients from two Washington mental health facilities, Lake Burien Transitional Care Facility and Western State Hospital, was improperly uploaded to ChatGPT. A staff member at Lake Burien used their personal ChatGPT account to draft client case summaries, including patient names, diagnoses, and medications. The Washington Department of Social and Health Services found multiple instances of this misuse, affecting 12 families from Lake Burien and four patients from Western State Hospital. Employees involved were instructed to delete all ChatGPT prompts and their accounts.

A Growing Privacy Risk

A survey by Wolters Kluwer Health indicates a significant privacy risk in healthcare, with 40% of hospital workers aware of colleagues using unauthorized AI tools and 20% admitting to using them themselves. While AI tools offer efficiency benefits, consumer versions lack the necessary safeguards for HIPAA compliance and must not be used with protected health information. Beyond privacy, these tools pose patient safety risks due to potential for misleading or inaccurate information. An example cited is a woman who suffered a fatal seizure after following ChatGPT's advice to reduce her anti-seizure medication, leading to a lawsuit against OpenAI for allegedly practicing medicine without a license. This highlights the critical need for authorized and secure AI tools in healthcare.