Confidential medical information about patients at two Washington state mental health facilities may have been exposed. An employee at one of the facilities used a personal ChatGPT account to draft notes and summaries of patient histories, despite a ban on using AI without prior approval.
In mid-August, the families of 12 patients at Lake Burien Transitional Care Facility received notices of a possible privacy breach. This is not an emergency hospital, but a facility providing intermediate, longer-term care for young people with severe mental health disorders. It offers intensive treatment and monitoring, helps stabilize patients, and prepares them to transition to less restrictive living arrangements and continued care.
According to state officials, outsiders may have gained access to patients’ names, diagnoses, and medication information. Social Security numbers were not affected, and there was no evidence that the data had been shared further or used for identity theft.
A similar incident was reported at Western State Hospital, where information about four patients may have been exposed. The Lake Burien employee was briefed on cybersecurity and the handling of confidential information, and instructed to delete the prompts and account. However, the agency does not know how the information is stored on ChatGPT’s servers or whether outsiders may have seen it.
Washington state rules on AI use and data protection apply to facilities under the state Department of Social and Health Services. New tools generally must undergo risk, security, and privacy assessments. There is no single body that approves all services for every facility: responsibility is shared among management, IT staff, privacy offices, and the relevant agencies. Federal HIPAA requirements also apply when protected health information is processed.
Hospital representatives stress that consumer chatbots differ from specialized medical AI systems that may meet HIPAA requirements. When working with outside technology companies, facilities typically restrict data access, use encryption, and assess vendors’ practices. If a company processes protected health information on behalf of a hospital, the parties sign a Business Associate Agreement (BAA). It requires the vendor to protect the data, report breaches, and use the information only for agreed purposes. Even when using an approved tool, medical staff must review and approve the records it generates.
Industry representatives say written policies alone are not enough: staff need training and a clear understanding of which services are allowed. University of Washington expert Bill Howe suggests reducing risks by using AI systems managed by the organization itself or by entering into robust legal agreements with vendors. However, locally hosted models are not yet available to everyone and may be less capable than large systems, while ensuring compliance with contracts and medical privacy laws grows more complicated as technology evolves.
Hospitals and unions do not believe AI should be ruled out entirely: it can make record-keeping easier, but should not replace medical professionals’ judgment. Clinic leaders must train employees, and people remain responsible for decisions based on a system’s responses. Experts also warn that AI errors can have serious consequences and remind users that chatbot advice is no substitute for consulting a specialist.
Based on: AI use leads to potential privacy breach at WA mental health facilities