Weill Cornell Medicine: patient PHI entered into AI tools without authorization in radiology research study
Severity: medium · Patch status: no-fix-needed · Since 2026-11-09
Weill Cornell Medicine (New York City) disclosed that patient health information from Weill Cornell Imaging was entered into AI tools and processed using machine learning without authorization as part of a radiology research study. The organization learned of the incident on September 6, 2026, and launched an investigation that determined certain patient information had been improperly shared with the AI systems. This is an insider/policy violation rather than an external attack; no malware, attacker, or in-the-wild exploitation is reported. Affected patients are being notified per the disclosure. Remediation involves internal policy enforcement, access controls, and AI governance rather than a software patch.
What to do
- Review and restrict which staff may submit clinical data to AI/ML tools; enforce approved-tool allowlists
- Audit AI tool usage logs for other unauthorized PHI submissions
- Confirm patient notification and regulatory (HIPAA) reporting obligations are met
- Update data governance policies covering AI processing of PHI
- Train radiology and research staff on authorized data-use boundaries
Sources
All live incidents on Threat Watch
