Weill Cornell Medicine · Breach

[Single source] Weill Cornell warns patients of data fed to AI tools

Nov 09, 2026 · 1 min read

Weill Cornell Medicine notified patients in a radiology research study after protected health information was entered into AI and machine learning tools without authorization, in violation of its policies. The uploads occurred between June 10 and 20, 2026, and were discovered on September 6, involving patients who received medical imaging services. Affected patients should watch for communications from the institution.

By HIFY Radar newsroom Updated 11/09/2026 01:48 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Observed

Weill Cornell Medicine has alerted certain patients after discovering on September 6, 2026 that protected health information connected to a radiology research study had been entered into AI and machine learning tools without authorization and in violation of its policies. The data was uploaded to the tools between June 10 and June 20, 2026.

Observed

The information involved patients who received medical imaging services at NewYork-Presbyterian (WCINYP) or NewYork-Presbyterian Hospital. It did not include names, contact information, Social Security numbers, or financial details, but did include medical record numbers, radiology accession numbers, dates and times of services, facility and provider names, and clinical information from radiological examinations.

What happened

Observed

On September 6, 2026, Weill Cornell Medicine, Cornell University's school of medicine and biomedical research institution in New York City, discovered that certain patients' protected health information used in connection with a radiology research study had been entered into AI and machine learning tools without authorization and in violation of its policies.

Observed

According to the report, the data was uploaded to the tools over a ten-day window, June 10 to June 20, 2026, and involved patients who received medical imaging services at NewYork-Presbyterian (WCINYP) or NewYork-Presbyterian Hospital. Weill Cornell has since alerted certain patients about the incident.

Why it matters

Inferred

The case illustrates the exposure risk when protected health information flows into AI and machine learning tools outside authorized channels, an emerging pattern the source notes in reporting on two such recently announced privacy incidents involving healthcare data uploaded to AI tools without authorization.

Inferred

Even though direct identifiers were excluded, the disclosed elements: medical record numbers, diagnoses, treatment information, surgical and procedural histories, and medication information: are clinically sensitive data whose unauthorized entry into external tools can compromise patient privacy.

What to do

Observed

Weill Cornell Medicine has directly alerted certain patients whose information was involved, making direct notification from the institution the primary channel for affected individuals to learn whether they are impacted.

Observed

The available reporting does not specify remediation steps such as credit monitoring or contact instructions, and the evidence excerpt cuts off mid-sentence in Weill Cornell's statement, so affected patients should rely on the official notification from Weill Cornell Medicine for any recommended actions.

Confirmed and still uncertain

Observed

Known: the upload window (June 10–20, 2026), the discovery date (September 6, 2026), the connection to a radiology research study, the affected facilities (WCINYP and NewYork-Presbyterian Hospital), and the specific categories of data involved, which excluded names, contact information, Social Security numbers, and financial information.

Observed

Unknown: the number of affected patients, which AI or machine learning tools received the data, what happened to the data after upload, and the remainder of Weill Cornell's statement, which is truncated mid-sentence in the available evidence. The source also mentions a second similar privacy incident at another provider but does not detail it in the provided text.

What people are saying

Alleged

Weill Cornell Medicine stated that the data uploaded to the tools did not include patient names, contact information, Social Security numbers, or financial information, and that the uploaded information was limited to medical record numbers, radiology accession numbers, dates and times of radiology services, facility names, healthcare provider names, and clinical information relating to radiological examinations.

Alleged

According to the institution, the patient information had been entered into the AI and machine learning tools without authorization and in violation of its policies, in connection with a radiology research study. Weill Cornell Medicine's further statement begins but is cut off in the available reporting ('it has not identi…'), so its complete assessment could not be verified from this evidence.

Evolution

Observed

Timeline of the incident: patient data was uploaded to AI and machine learning tools between June 10 and June 20, 2026; Weill Cornell Medicine discovered the unauthorized use on September 6, 2026; and the institution subsequently alerted certain patients, with the notification framing the event as a privacy incident related to a radiology research study.

Observed

The report situates this case within a broader pattern, noting that two data privacy incidents involving patient data uploaded to AI tools without authorization have recently been announced, although only the Weill Cornell Medicine case is described in the available text.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Observed

Included fields: medical record numbers; radiology accession numbers assigned to radiology images; dates and times of radiology services; facility names; healthcare provider names; and clinical information relating to radiological examinations, potentially including diagnoses, treatment information, surgical and procedural histories, and medication information. Excluded fields: patient names, contact information, Social Security numbers, and financial information.

Observed

The receiving systems are described only as 'AI and machine learning tools'; no vendor, product, or deployment model is named. The unauthorized entry occurred in the context of a radiology research study rather than routine clinical care, and the uploads took place over the June 10–20, 2026 window before being detected on September 6, 2026.

Sources and evidence

Observed

This story is based on a single source: a HIPAA Journal article, 'Healthcare Providers Discover Unauthorized PHI Disclosures to AI Tools,' published in early November 2026, which reports on healthcare providers announcing unauthorized disclosures of protected health information to AI tools. The article text in the evidence batch is truncated mid-sentence during Weill Cornell Medicine's statement.

Inferred

No primary documents: such as Weill Cornell's patient notification, a regulatory breach filing, or the study documentation: are included in the evidence batch, and there is no independent corroboration. Details such as the affected patient count and the identity of the AI tools should be treated as pending until primary sources are available.