Weill Cornell Medicine and Washington state mental health facilities expose patient PHI to unauthorized AI tools
Two separate privacy incidents involve patient data entered into AI tools without authorization. Weill Cornell Medicine in New York discovered on September 6, 2026 that PHI used in a radiology research study had been entered into AI and machine learning tools between June 10 and June 20, 2026, in violation of its policies. The uploaded data included medical record numbers, radiology accession numbers, dates of service, facility and provider names, and clinical details such as diagnoses and medications, but not patient names or Social Security numbers. The institution reports no misuse, has suspended the research, has requested deletion of the data, and has not disclosed how many patients are affected. In Washington, a staff member at the Lake Burien Transitional Care Facility used a personal ChatGPT account to draft summaries of client case notes containing names, diagnoses and medications, and the Washington Department of Social and Health Services later found several earlier instances plus a similar case involving four Western State Hospital patients. The article's risk is privacy and compliance exposure rather than an exploited vulnerability: no CVE or vendor advisory is involved, and consumer AI tools are described as lacking the safeguards HIPAA requires.
Detalhes técnicos
- Weill Cornell Medicine: the uploads happened between June 10 and June 20, 2026, and the institution discovered them on September 6, 2026. Names, contact details, Social Security numbers and financial information were not included. The article does not name the AI tools involved.
- Lake Burien and Western State Hospital (Washington DSHS): the employee used a personal ChatGPT account, and the case notes contained names, diagnoses and medications. DSHS identified one instance first, then multiple earlier ones.
- Patient safety context: the article recalls a separate case in which a woman with epilepsy followed a medication-reduction regimen suggested by ChatGPT and suffered a fatal seizure. A lawsuit against OpenAI alleges the tool effectively practiced medicine without a license.
Remediação
- Weill Cornell Medicine suspended the research activity, submitted a request to delete the data, and provided additional education on appropriate AI tool use.
- The Washington employees were told to delete all ChatGPT prompts before deleting their accounts, and the state has written to 12 affected families.
- Defenders should govern or block personal consumer AI accounts used by staff who handle PHI, and allow only AI tools that can be used in compliance with the HIPAA Rules.
Linha do tempo
-
Weill Cornell Medicine and Washington state mental health facilities expose patient PHI to unauthorized AI tools
ler a análise desta fonte ocultar
Two separate privacy incidents involve patient data entered into AI tools without authorization. Weill Cornell Medicine in New York discovered on September 6, 2026 that PHI used in a radiology research study had been entered into AI and machine learning tools between June 10 and June 20, 2026, in violation of its policies. The uploaded data included medical record numbers, radiology accession numbers, dates of service, facility and provider names, and clinical details such as diagnoses and medications, but not patient names or Social Security numbers. The institution reports no misuse, has suspended the research, has requested deletion of the data, and has not disclosed how many patients are affected. In Washington, a staff member at the Lake Burien Transitional Care Facility used a personal ChatGPT account to draft summaries of client case notes containing names, diagnoses and medications, and the Washington Department of Social and Health Services later found several earlier instances plus a similar case involving four Western State Hospital patients. The article's risk is privacy and compliance exposure rather than an exploited vulnerability: no CVE or vendor advisory is involved, and consumer AI tools are described as lacking the safeguards HIPAA requires.
Technical Details
- Weill Cornell Medicine: the uploads happened between June 10 and June 20, 2026, and the institution discovered them on September 6, 2026. Names, contact details, Social Security numbers and financial information were not included. The article does not name the AI tools involved.
- Lake Burien and Western State Hospital (Washington DSHS): the employee used a personal ChatGPT account, and the case notes contained names, diagnoses and medications. DSHS identified one instance first, then multiple earlier ones.
- Patient safety context: the article recalls a separate case in which a woman with epilepsy followed a medication-reduction regimen suggested by ChatGPT and suffered a fatal seizure. A lawsuit against OpenAI alleges the tool effectively practiced medicine without a license.
Remediation
- Weill Cornell Medicine suspended the research activity, submitted a request to delete the data, and provided additional education on appropriate AI tool use.
- The Washington employees were told to delete all ChatGPT prompts before deleting their accounts, and the state has written to 12 affected families.
- Defenders should govern or block personal consumer AI accounts used by staff who handle PHI, and allow only AI tools that can be used in compliance with the HIPAA Rules.