Shadow AI at Johns Hopkins Bayview Medical Center

Executive summary

One employee at Johns Hopkins Bayview Medical Center pasted a patient spreadsheet into an unapproved public AI tool in late September 2026, exposing records on 3,182 patients. The data left the hospital in seconds, and no firewall rule or policy memo could pull it back.

• Automatic anonymization of patient records, transcripts and prescriptions before they reach any AI agent.
• Claude and GPT plugins that let staff redact a file inside the chat assistant they already use, before it hits Anthropic or OpenAI servers.
• Real-time compliance reporting showing how much data was kept private and how many patients were protected, by health, financial and other sensitive categories.

The Banner does not say which AI tool was used or whether regulators were notified. Healthcare IT News also covered the incident, but that page could not be retrieved for this draft, so its details are not included.

Regulatory exposure

A disclosure like Bayview's raises questions under several regimes. This is general context, not legal advice, and whether any of it applied to this incident has not been reported.

• HIPAA. Patient identifiers combined with treatment details are protected health information. An impermissible disclosure to a vendor without a business associate agreement generally triggers breach assessment and notification duties.
• State law. Maryland and other states add their own breach-notification and privacy requirements.
• EU and cross-border operators. Organizations with European patients or data face GDPR and, for high-risk health uses, the EU AI Act. Questa operates between Luxembourg and Estonia and sees these obligations daily.

Across all of them, the cheapest compliance position is the same: data that has been de-identified before it leaves the organization is far less likely to be a reportable disclosure at all.

What is missing is a control that sits in the path of the data and works whether or not the employee thinks about compliance.

Solution 1: anonymize before any AI agent sees the data

Questa automatically anonymizes or redacts critical patient records, transcripts and prescriptions before they go to any AI agent. The AI still gets a document it can summarize, analyze or reformat, but names, record numbers, account numbers and other identifiers never leave the organization.

Applied to the Bayview spreadsheet, the 3,182-patient file would reach the AI tool with patient identifiers, medical record numbers and account numbers removed or replaced. The employee gets the help they wanted; the hospital discloses nothing that identifies a patient.

This works for the document types hospital staff actually handle: spreadsheets and exports, clinical transcripts and dictation, prescriptions and medication lists, and discharge or referral records.

Solution 2: redaction inside the tools staff already use

Shadow AI exists because the approved route is slower than the public one. Questa removes that trade-off with plugins for Claude and GPT. An employee uploads a document in their current work tool or chat assistant, Questa redacts it first, and only the redacted file reaches Anthropic or OpenAI servers.

For a clinician or analyst nothing changes in their routine: same assistant, same document, same request. The compliant path becomes the convenient one, so there is little reason to go around it with an unapproved tool.

Solution 3: real-time compliance and data mapping

After an incident like Bayview's, the hospital had to work out what was exposed and for whom. Questa answers that continuously, before anything goes wrong.

Its real-time reporting shows how much data has been kept private and how many patients have been protected, broken down by health, financial and other sensitive metrics. That gives compliance and security teams a clear data map: which information types flow toward AI tools, from which workflows, and how much of it was shielded.

In practice this means privacy officers can evidence protection to auditors and boards, spot workflows that send the most sensitive data, and size any exposure in minutes instead of weeks.

Rolling it out and key takeaways

A hospital system can put Questa in place in four steps:

• Map where staff already use AI, officially or not, and which documents they handle.
• Switch on automatic anonymization for the highest-risk document types: patient lists, transcripts and prescriptions.
• Deploy the Claude and GPT plugins to the teams using those assistants, so redaction happens at upload.
• Use the compliance dashboard to report protected volumes and tune coverage.

The takeaways from Bayview:

• Shadow AI is a workflow problem, not a discipline problem. Policy and training alone leave the gap open.
• Once data reaches a public AI tool, the hospital depends on the vendor to undo it.
• Redacting before the data leaves is the only control that works whether or not the employee gets it right.
• Evidence of what was protected is as valuable as the protection itself.

SHADOW AI AND PATIENT DATA SAFETY

What is Shadow AI in a hospital?

Shadow AI is staff using AI tools that IT, security and compliance have not approved. In hospitals it usually means pasting patient records, transcripts or spreadsheets into a public chatbot to save time. At Johns Hopkins Bayview, one such upload exposed records on 3,182 patients, according to The Banner.

How does Questa AI protect patient data when staff use AI tools?

Questa automatically anonymizes or redacts patient records, transcripts and prescriptions before they reach any AI agent. The AI receives a document it can still analyze, but names, medical record numbers, account numbers and other identifiers never leave the organization.

Can staff safely use ChatGPT, Claude or Copilot with patient data?

Not on their own. A business associate agreement is a contract, not a technical guarantee that raw PHI never reached a third-party model. Questa strips or replaces PHI before the model sees it, which is what makes mainstream AI tools usable with regulated patient data.

We already have a business associate agreement with our AI vendor. Do we still need Questa?

Yes. An agreement shifts legal liability but does not stop PHI from being sent, logged or exposed. Anonymizing first is the technical safeguard that prevents the exposure, and it gives your compliance team evidence of what was protected.

Does anonymizing data make the AI's answers worse?

No, when done correctly. Questa replaces identifiers with structurally realistic placeholders, so the model still understands what kind of information it is working with. Real values can be restored in the response for authorized users.

What types of patient data does Questa detect?

Personal identifiers such as names, dates of birth and addresses; healthcare entities such as medical record numbers, diagnosis codes and medication names; financial data tied to billing; and custom entities you define, such as a proprietary protocol name.

OFFLINE, AIR-GAPPED DEPLOYMENT

Is Questa Blackbox completely offline?

Yes. Questa Blackbox runs entirely inside the customer's own network, offline and air-gapped. Anonymization happens on infrastructure you control, with no dependency on Questa's cloud for that step, so patient data never leaves your environment to be anonymized.

What does air-gapped mean for a hospital?

Air-gapped means the system has no connection to the public internet or to external services. For a hospital it means sensitive records can be processed for AI use while staying on the organization's own network, which suits security teams that cannot accept any data leaving their boundary.

How do employees reach a Blackbox that sits inside our network?

Through the tools they already use. Access is provided inside the customer network, so clinicians and administrative staff keep their familiar workflow while Questa redacts files and text in the background. There is no separate application to learn and no reason to turn to an unapproved tool.

Which Questa deployment fits a single clinic and which fits a health system?

Questa Cloud suits small teams that want protection without deploying infrastructure. Questa Blackbox suits health systems and multi-specialty groups that need a fully self-hosted, air-gapped deployment. Questa Developer is the API layer for health-tech companies building their own clinical AI products.

ONBOARDING AND EVERYDAY USE

How simple is onboarding Questa AI?

Onboarding is designed to be simple because Questa works inside tools staff already use. There is no new interface to train people on: you choose which document types and workflows to protect, connect Questa to your assistants and systems, and employees carry on working as before.

Do employees have to change how they work?

No. With the Questa Claude and GPT plugins, an employee uploads a document in their current chat assistant or work tool, Questa redacts it first, and only the redacted file reaches Anthropic or OpenAI servers. The compliant path is also the convenient one.

Will redaction slow clinicians down?

Runtime anonymization is designed to work at millisecond-level latency, so there is no noticeable delay between a clinician's question and the AI's answer.

Does Questa work with automated workflows and retrieval systems?

Yes. Questa is built to sit inline in agentic and retrieval-augmented workflows, where patient context is fetched and sent to a model automatically, as well as in chat and document upload.

COMPLIANCE AND EVIDENCE

How does Questa help with HIPAA?

HIPAA treats patient identifiers combined with health information as PHI. By removing identifiers before data goes to an AI tool, Questa reduces how much PHI is disclosed in the first place. Questa supports your compliance program; it does not replace your own risk assessment or legal review.

How can we show auditors what was protected?

Questa provides real-time compliance reporting on how much data has been kept private and how many patients have been protected, broken down by health, financial and other sensitive categories. This gives privacy officers a clear data map and evidence for auditors and boards.

Does Questa also help if we treat patients in Europe?

Yes. The technical problem of raw sensitive data reaching an AI model is the same under GDPR, where health data is a special category. The same anonymization approach works against HIPAA and GDPR definitions in one deployment.

Sources

■ The Banner: Johns Hopkins data exposure, unauthorized AI tool, opened, October 25, 2026

■ Healthcare IT News: Johns Hopkins shadow AI use linked to data breach, could not be retrieved; facts above come from The Banner only