Johns Hopkins Bayview asked an AI operator to delete patient data and has not said whether the operator did

Editor’s Note: Johns Hopkins Bayview Medical Center in Baltimore began mailing notices Oct. 22 to about 3,182 patients after an employee uploaded a spreadsheet of their information to a public artificial intelligence tool the hospital had not approved. The file may have included names, medical record numbers and medications. Becker’s Hospital Review, citing a Johns Hopkins release, reported the upload and its discovery on Sept. 21.

The hospital said the employee deleted the prompt, thread and uploaded document from the tool’s history, and that it asked the tool’s unnamed operator to delete the data. Straight Arrow News reported that Johns Hopkins did not answer whether the operator confirmed the deletion. Johns Hopkins IT guidelines, announced in 2025, already told users not to enter clinical data into unapproved AI tools.

Under the breach notification rule of the Health Insurance Portability and Accountability Act (HIPAA), a hospital bears the burden of showing that its notices met federal requirements and must keep supporting records for six years. For cybersecurity, information governance and eDiscovery professionals, the episode shows why a user’s chat deletion is weak evidence that a provider deleted anything. Next, watch the U.S. health department’s breach portal and the AI tool’s operator.

Industry News – Artificial Intelligence Beat

Johns Hopkins Bayview asked an AI operator to delete patient data and has not said whether the operator did

ComplexDiscovery Staff

Johns Hopkins Bayview Medical Center began mailing letters Oct. 22 to about 3,182 patients, a month after an employee put a spreadsheet of their information into a public AI tool the Baltimore hospital had not approved, news outlets reported.

The hospital’s response, as reported, came down to two deletions: one the employee carried out in the tool’s history, and one the hospital asked the tool’s operator to perform. None of the accounts reviewed for this article says whether the operator has done it, and Straight Arrow News reported that Johns Hopkins did not answer that question when the outlet put it to the hospital. Under the federal breach rule, the hospital carries the burden of showing that its notices met the rule’s requirements.

The hospital’s account of the upload

The upload happened Sept. 21 during an internal review, and the hospital found out that day, Becker’s Hospital Review reported, citing an Oct. 23 Johns Hopkins news release. Baltimore television stations WMAR-2 News and WBAL reported the same date. The file covered patients admitted and treated from May through September 2026, and according to WMAR, it may have included patient names, medical record and account numbers, dates of admission and treatment, the treating department, medications given and provider names. The hospital said the file held no Social Security numbers or financial account details.

The Baltimore Banner, also citing the release, reported that administrators directed the employee to delete the prompt, the thread and the uploaded document. Johns Hopkins then asked the tool’s parent company to delete the data, the Banner reported. The Baltimore Sun’s account, as quoted by lawyer Michael Berman on his E-Discovery LLC blog, also said the hospital sent a deletion request to the tool’s owner and operator. The Banner described the platform as unnamed, and Becker’s said the release did not name it either.

Affected patients are being offered 12 months of credit monitoring through Experian IdentityWorks and a toll-free call center, WMAR reported. The hospital said it is strengthening policy, retraining staff on approved tools and limiting the use of unapproved applications and AI tools. Berman, who mediates disputes over electronically stored information, drew a short lesson from the episode in his Oct. 25 post: “AI policies should address the use of shadow artificial intelligence.”

Johns Hopkins already had written guidance on the point. Guidelines from IT@JH, which say they apply at Johns Hopkins University and Johns Hopkins Medicine, tell users not to enter “nonpublic proprietary Hopkins data,” including clinical data, into third-party AI tools Johns Hopkins has not approved. The university’s news site announced the guidelines in May 2025, and the current version of the page carries no date. Bayview is one of the Johns Hopkins Medicine hospitals, though no account reviewed says whether the employee had been trained on the guidelines. Straight Arrow News, which reported them alongside the incident, said Johns Hopkins left unanswered its question about whether any technical safeguard had been set up to stop such uploads before the incident.

Why a deleted chat proves little

A policy can tell staff not to use a tool, but once a file reaches one, deleting the conversation is only a user action. What that deletion sets in motion on the provider’s side depends on the provider’s own policy. Nothing in the accounts reviewed identifies which service the Bayview employee used, so no single policy can be assumed to apply, but two widely used services show the range.

OpenAI’s help center, as read Oct. 26, says a deleted ChatGPT chat leaves the user’s account view immediately. OpenAI then schedules it for permanent deletion within 30 days, “unless the chat was already de-identified and disassociated from your account or OpenAI must retain it longer for security or legal obligations.” The same page says a file kept in ChatGPT’s Library survives when the chat that used it is deleted, a distinction that matters when the upload is a spreadsheet.

That exception for legal obligations is not hypothetical, because a court order has already imposed one that overrode routine deletion. On May 13, 2025, U.S. Magistrate Judge Ona T. Wang of the Southern District of New York directed OpenAI “to preserve and segregate all output log data that would otherwise be deleted on a going forward basis.” Her order covered data a user asked to delete, and it came in copyright litigation brought by The New York Times and other news organizations. OpenAI says its obligations under the order ended Sept. 26, 2025, for data going forward, though it continues to store a limited set of user data from April through September 2025.

Google’s Gemini Apps Privacy Hub, updated Oct. 23, 2026, describes a different gap. Chats that human reviewers have examined, along with related data, “are not deleted when you delete your activity,” the page says, and Google keeps them for as long as three years, disconnected from the user’s account.

None of the cited pages says what a provider does with a deletion request from an organization whose employee used the service. That is the record problem at the center of this incident. A user-side deletion typically removes the conversation from the user’s view, while the provider’s deletion, if it happens, takes place on the provider’s own systems and outside the hospital’s view.

HIPAA puts the burden on the hospital

The gap matters because federal health privacy law asks the hospital to document what it did. The Health Insurance Portability and Accountability Act (HIPAA) breach notification rule, at 45 CFR 164.402, sets out three narrow exclusions. Outside them, it presumes that an acquisition, access, use or disclosure of protected health information the Privacy Rule does not permit is a breach. The presumption holds unless the covered entity demonstrates a low probability that the information has been compromised. That showing rests on a risk assessment of at least four factors. They are what kind of information was involved and how much, including how identifiable it is; who received it; whether anyone actually acquired or viewed it; and how far the risk has been mitigated.

Mitigation is where a provider’s deletion would count. When it adopted the four factors in 2013, the Department of Health and Human Services (HHS) said entities should try to mitigate by getting “satisfactory assurances” from the recipient. Those assurances would say the information “will not be further used or disclosed” or “will be destroyed.” HHS cautioned that who received the data affects whether those assurances can be relied on. A covered entity “may be able to obtain and rely on the assurances of an employee, affiliated entity, business associate, or another covered entity that the entity or person destroyed information it received in error,” HHS wrote. But it added, “such assurances from certain third parties may not be sufficient.” The accounts reviewed do not identify the recipient or say whether that company has any agreement with the hospital.

The rule also assigns the proof. Under 45 CFR 164.414(b), the covered entity bears the burden of demonstrating either that all required notifications were made or that the use or disclosure was not a breach. A separate provision, 45 CFR 164.530(j), requires documentation sufficient to meet that burden, which must be kept for six years from its creation or the date it was last in effect, whichever is later.

Because Bayview is notifying patients, its file will need to support the first limb: that each required notice went out on time and with the required content. Individual notices are due without unreasonable delay and no later than 60 calendar days after discovery, and the letters began Oct. 22, 31 days after the Sept. 21 discovery. Each notice must describe, to the extent possible, what happened, including the dates of the breach and its discovery if known, and what the covered entity is doing to mitigate harm.

Two other provisions support keeping the deletion request in that file. The Privacy Rule, at 45 CFR 164.530(f), requires a covered entity to mitigate known harmful effects of an impermissible disclosure to the extent practicable. The Security Rule, which covers electronic records, adds a documentation duty if the upload constitutes a security incident as that rule defines one: 45 CFR 164.308(a)(6)(ii) requires covered entities to “document security incidents and their outcomes.” Under 45 CFR 164.316(b), that documentation is kept for six years, and the deletion request and whatever answer comes back would be part of the incident’s outcome.

Notice to HHS runs on the same clock. Breaches affecting 500 or more people must be reported to the department contemporaneously with the individual notices, and the department is required to post a public list of those larger breaches. As of Oct. 27, the breach portal run by the HHS Office for Civil Rights (OCR) listed no Johns Hopkins entry among breaches under investigation, and the newest submission date on that list was Oct. 5. HHS says it verifies each report with the entity before posting it, a process that generally finishes within 14 days, so an unlisted report is not by itself evidence of a missing one. Straight Arrow said Johns Hopkins did not answer its question about an HHS report.

Building a deletion record someone else completes

For information governance teams, that file is where third-party deletion either becomes evidence or stays an assertion, and the organization asking for the deletion has to build it. Capture what was disclosed before anyone deletes it, because the conversation thread is often the best evidence of exactly what left the organization. Record who performed the user-side deletion, when and in which account, with screenshots or exports.

Then send the provider a written request that names the account and the time window. Ask whether the content was deleted from production systems and backups, whether any copy went to human review or safety retention, and whether a legal hold or preservation order applies. Ask, too, when deletion will be complete. A reply that answers those questions is evidence, and silence or a form acknowledgment is a fact to document as well, which is why the mitigation description in the patient letter should match what the correspondence shows.

Deleting an unauthorized copy is also a different act from disposing of the organization’s own records, and eDiscovery teams should keep the two apart in the file. In federal court, Rule 37(e) of the Federal Rules of Civil Procedure addresses electronically stored information “that should have been preserved in the anticipation or conduct of litigation.” The rule reaches such information when it is gone because a party did not take reasonable steps to keep it, and when other discovery cannot restore or replace it. The rule’s advisory committee note says many courts find a duty to preserve once litigation is reasonably foreseeable. At that point the source spreadsheet, the incident file and the vendor correspondence are the hospital’s own records, and a request that a provider purge its copy does not reach them. If the provider’s copy is the only record of a prompt or an output, capture it before asking for its destruction.

Shadow AI as an inventory and egress gap

Records explain an incident after it happens; the next question is which controls keep the file from being needed. Johns Hopkins already had written guidelines, and HHS’s own proposals point to what has to stand behind them. The department’s proposed overhaul of the HIPAA Security Rule, published in January 2025, would require a written inventory of technology assets and a network map tracing how electronic protected health information moves into, through and out of an organization’s systems. The proposal’s preamble said HHS would expect AI software that interacts with such information to be listed in that inventory. The proposal is not final, and HHS’s regulatory agenda lists July 2027 for final action, as a long-term item with no legal deadline.

An inventory limited to the tools an organization approved can miss shadow use. In this article’s reading, the control positioned to catch an upload like Bayview’s sits at the exit points that the proposed network map would have to document. That means data-loss-prevention rules and blocked categories that stop regulated data from reaching unapproved services. A properly configured egress control can also log where and when data was sent and which rule it matched, a record an organization otherwise has to reconstruct after the fact.

Vendor telemetry suggests regulated data is what those controls most often catch in health care. Netskope, a vendor that sells such controls, said in its Threat Labs Report: Healthcare 2026 that regulated data accounted for 89 percent of the data policy violations involving generative AI it recorded. That figure covers a subset of Netskope’s health care customers from Dec. 1, 2024, through Dec. 31, 2025.

Watching for the vendor’s answer

Three questions remain open, and Straight Arrow reported that Johns Hopkins did not answer any of them: which company runs the tool, whether that company confirmed the deletion and whether a report has gone to HHS. Even inside approved platforms, AI records can be hard to govern. ComplexDiscovery reported this week that Microsoft’s memory documentation and an archived Message Center notice disagree on whether Purview retention reaches Copilot memory, though administrators can search saved and inferred memories with eDiscovery tools. Bayview’s spreadsheet went to a service the hospital had not approved, and the accounts reviewed describe no administrative access the hospital has to it.

One deletion happened in a chat window, and the other depends on a company no account reviewed has named. A file kept for six years is the record that will have to answer for both. If your organization learned tomorrow that a workforce member pasted regulated data into an unapproved tool, what evidence could you produce that the copy is gone?

News Sources

• 45 CFR Part 164 Subpart D: Notification in the Case of Breach of Unsecured Protected Health Information (eCFR)
• 45 CFR 164.530: Administrative requirements. (eCFR)
• 45 CFR Part 164 Subpart C: Security Standards for the Protection of Electronic Protected Health Information (eCFR)
• Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules (Department of Health and Human Services via Federal Register)
• HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (Department of Health and Human Services via Federal Register)
• HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information (RIN 0945-AA22) (Office of Information and Regulatory Affairs via reginfo.gov)
• Breach Portal: Notice to the Secretary of HHS Breach of Unsecured Protected Health Information (HHS Office for Civil Rights)
• Change Healthcare Cybersecurity Incident Frequently Asked Questions (Department of Health and Human Services)
• Rule 37. Failure to Make Disclosures or to Cooperate in Discovery; Sanctions (Legal Information Institute)
• In re OpenAI, Inc., Copyright Infringement Litigation: Order of May 13, 2025 (ECF No. 551) (U.S. District Court for the Southern District of New York via Duane Morris)
• Chat and file retention in ChatGPT (OpenAI)
• How we’re responding to The New York Times’ data demands in order to protect user privacy (OpenAI)
• Gemini Apps Privacy Hub (Google)
• The next chapter in AI at Johns Hopkins begins (Johns Hopkins University Hub)
• Guidelines for Responsible Use of AI (IT@JH)
• Threat Labs Report: Healthcare 2026 (Netskope)
• Johns Hopkins alerts 3,182 patients after worker uploads data to unapproved AI tool (Becker’s Hospital Review)
• Johns Hopkins alerts 3,000+ patients after data sent to AI tool (WMAR-2 News)
• Hospital data mistakenly uploaded to AI tool (WBAL via Yahoo News)
• Johns Hopkins data exposure caused by employee using unauthorized AI tool (The Baltimore Banner)
• Johns Hopkins Bayview Medical Center alerts patients of data breach (The Baltimore Sun)
• A hospital employee uploaded patient data to an unapproved AI tool. Where is it now? (Straight Arrow News)
• Security Breach Highlights Danger of Shadow A.I. (E-Discovery LLC)
• Ransomware logs and Copilot memory put AI agent records on the eDiscovery agenda (ComplexDiscovery)

Assisted by GAI and LLM Technologies

Additional reading

• Ransomware logs and Copilot memory put AI agent records on the eDiscovery agenda
• 5th Circuit reassigns Mississippi DEI case after judge’s orders cite fabricated parties, quotations and a nonexistent case
• An AI agent can write the story, but EU law asks whether a human reviewed it
• An Oxford tutorial for newsroom leaders who must learn faster than the news
• An Oxford tutorial for cybersecurity, governance and eDiscovery
• Estonia aims to be first to give AI agents official digital IDs
• Parliament hits pause on high-risk AI rules and bans nudifier apps
• Europe’s AI labeling rules arrive with a voluntary code and a hard deadline
• AI is becoming an advisor, and it is rewriting how buyers find you

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.