Staff at Weill Cornell and two Washington state facilities put patient details into AI tools without permission. Here is what it means if you hold private records.
Hospital workers in New York and Washington state put patient information into AI tools they were not allowed to use. Two incidents came to light this fall. One involved a research study at Weill Cornell Medicine. The other involved a staff member who used a personal ChatGPT account to write up case notes about patients.
Weill Cornell Medicine found on September 6, 2026 that patient data from a radiology research study had been entered into AI and machine learning tools. The uploads happened between June 10 and June 20, 2026. The patients had received imaging services at NewYork-Presbyterian. The use broke the school's own policies.
In Washington, a staff member at Lake Burien Transitional Care Facility used a personal ChatGPT account to draft case note summaries. The notes included names, diagnoses and medications. Investigators found the employee had done this more than once. The state has written to 12 families. A similar case affected four patients at Western State Hospital.
The Weill Cornell data did not include names, contact details, Social Security numbers or financial information. It did include medical record numbers, dates, provider names and clinical details such as diagnoses and medications. Weill Cornell says it has found no misuse. It has paused the research and asked for the data to be deleted. The number of people affected has not been made public.
A free chatbot is not built for private health records. The HIPAA Journal notes that consumer versions of AI tools lack the safeguards that US health privacy rules require. Yet the habit is common. A Wolters Kluwer Health survey found 20% of hospital workers admit using AI tools their IT team did not approve. Another 40% know a colleague who does.
The same shortcut can hurt a small business that handles client files. One employee pasting in a name and a few details can create a privacy problem the owner never knew about.
The article also points to a separate risk. A woman with epilepsy followed ChatGPT's advice on cutting back her seizure medication and died after a seizure. A lawsuit against OpenAI claims the chatbot effectively practiced medicine without a license. Chatbots can give answers that sound sure but are wrong.
The steps in the alert box above cover what patients, employers and staff should do now. The main point is to know which tools are approved before any private record goes near one.
Watch your mail. Patients who are affected get notice letters, and Washington has already sent some. Weill Cornell has not said how many people are involved, so more detail may follow. It is also not clear whether any of the uploaded data can be fully removed from the AI tools.
Never paste private records into a free chatbot, and ask which AI tools your workplace or provider has actually approved.
Apple's new macOS updates make developer tools reject weak eMudhra certificates that could help attackers pose as any trusted website.
Read more: Apple closes a gap that let fake website certificates slip throughDeputies in the Upstate area say scammers are calling while posing as police officers, and a scary call can cost you money or personal details.
Read more: Sheriff's deputies warn of scam calls from fake police officersA hacker stole data from forms on 14 York University websites, going back to 2007. Contact details and student ID numbers could fuel convincing scam messages.
Read more: York University says hackers stole data from website forms back to 2007
