When a health system announces a data breach, most people picture an outside attacker breaking in. The incident Johns Hopkins disclosed in October started somewhere far more familiar: an employee with a spreadsheet, a task to finish and an AI tool that was easy to reach. The lesson for every health system is that shadow AI is already a patient data problem, and the controls that stop it have to hold up on the day someone is busy and in a hurry, not only on the day they completed their training.
At Johns Hopkins Bayview Medical Center in Baltimore, a staff member uploaded a spreadsheet of patient data to a public-facing AI website that the hospital had not approved for that use. Hopkins discovered the upload on Sept. 21, 2026, during an internal review. The spreadsheet covered patients treated between May and September 2026, and the health system is now notifying 3,182 of them that their information may have been exposed.
The data may have included names, dates of admission and treatment, treating department, medications, provider names, medical record numbers and account numbers. According to the hospital, it did not include Social Security numbers or other financial data. Hopkins deleted the prompt and related information from the tool's history, asked the tool's developer for "further deletion and corrective measures," and is offering affected patients a year of free credit monitoring.
In last week's blog, we defined shadow AI as unapproved AI acting as the user. In its most common form today it is simpler than that: any AI tool employees use for work without the organization's approval or oversight, usually a consumer chatbot or browser-based assistant that sits entirely outside the security team's view. Nothing in the reporting suggests the Bayview employee was trying to steal anything. They appear to have used a consumer AI tool to help crunch some numbers, which is exactly how shadow AI shows up inside a hospital: a staff member with a real task and a deadline, and a capable tool sitting one browser tab away.
That is also why good intentions are not enough to stop it. The problem is not that the employee wanted to use AI, but what happened to the patient data once they did. Anything entered into an AI tool the organization doesn't control should be treated as potential training data, which makes it effectively public, with no reliable way to get it back. Deleting the chat history removes the data from the user's view, and asking the vendor to delete it is a request rather than a guarantee.
There is a second issue that gets less attention. When staff hand work to an unapproved AI tool, they are outsourcing more than a task; they are outsourcing decisions about patient data that nobody approved and nobody could audit until after the fact.
Hopkins' public response focuses on policy and training. The health system said it will "reinforce our policies and training concerning the appropriate handling of protected health information, including restrictions on use of unauthorized applications and artificial intelligence tools and reeducation on the tools that are institutionally approved."
That statement is worth reading closely, because it tells us something important: Hopkins already had tools that were institutionally approved, and the employee still reached for one that wasn't.
Training matters, and every health system should be doing more of it. But a rule that isn't enforced on the endpoint and on the web is guidance, not a control. The next employee with a spreadsheet and a deadline will face the same choice, and the unapproved tool will still be one tab away unless something technical stands in the way.
The obvious reaction is to block every AI tool that isn't approved. That's part of the answer, but on its own it tends to push the problem somewhere less visible. In a survey of 2,000 U.S. and UK employees, 60% said using unsanctioned AI is worth the security risk if it helps them work faster, and 63% said using AI without IT oversight is acceptable when no approved option exists. Block the tool without giving people a workable alternative, and the work moves to personal phones and laptops, where security teams can't see it at all.
The more effective lever is availability. Research cited by the Cloud Security Alliance found that when organizations provide sanctioned AI tools, unauthorized use drops by 89%. The approved option has to actually fit the work and the unapproved options have to actually be blocked, because either one on its own leaves a gap.
Healthcare can't afford to treat this as a minor policy violation. IBM's 2025 Cost of a Data Breach study, which examined breaches at 600 organizations, found that one in five reported a breach due to shadow AI, and organizations with high levels of shadow AI saw an average of $670,000 in higher breach costs than those with little or none. Healthcare breaches averaged $7.42 million, the most expensive of any industry IBM studied, and took the longest to identify and contain: 279 days, more than five weeks longer than the global average.
The figures that don't show up in a report matter too: notification letters, call centers, credit monitoring, staff time spent on the investigation, and the patient trust that's hard to rebuild once a letter like that arrives.
The Bayview incident is a useful prompt for any health system to check its own foundation:
We cover these controls in more detail in Before You Can Detect Shadow or Rogue AI, Lock Down the AI You Approved.
Bayview involved a person uploading a file, but the next incident may not involve a person deciding to share anything. Once approved tools, allowlists and containers are in place, the easiest path left is the human input channel: AI acting through a user's keyboard and mouse, under that user's identity, with that user's access. Shadow AI is unapproved AI acting as the user. Rogue AI is an approved AI that oversteps by borrowing the user's access. To every control a hospital has in place, both look like a clinician or staff member doing their job.
At that point, behavior is the only signal left: is the person driving this session the human you authenticated, or not a human at all? That's the question Twosense's Continuous Authentication Platform answers, continuously and without adding friction to the clinical workday.