Posted November 5, 2026
At Weill Cornell Medicine, we are committed to protecting the confidentiality and security of our patients’ information. This notice concerns a privacy incident involving some patient health information used in an unauthorized capacity in connection with a research study. Data was limited and there is no indication that any patient information has been misused, this notice explains the incident, outlines the measures we have taken in response.
What Happened? On September 6, 2026, WCM learned of an incident involving protected health information used in connection with a radiology research study and initiated an investigation to determine what occurred. The investigation determined that between June 10 and June 20, 2026, certain patient information from Weill Cornell Imaging at NewYork-Presbyterian (WCINYP) or NewYork-Presbyterian Hospital was entered into artificial intelligence (AI) tools and processed using machine learning without authorization and in violation of WCM policies. At this time WCM has not identified evidence that an unauthorized individual has viewed your information.
What Information Was Involved? The information included medical record numbers, radiology accession number(s) (i.e., internal numbers assigned to radiology images), date(s) and time(s) of radiology services, the name of the facility, the name of the health care provider, and clinical information relating to patient’s radiological examination(s), such as diagnoses, treatment, surgical and procedural histories, and medication information.
What Information Was NOT Involved? The information did not include patient name, address, telephone number, email address, Social Security number or financial information specific to the patient.
What We Are Doing. We suspended the research activity and requested that all involved data be deleted. We have also provided additional education to reinforce compliance with WCM’s requirements for the appropriate use of AI tools and the protection of patient information.
Weill Cornell deeply regrets any concern this incident may cause. We take the confidentiality and security of our patients' information very seriously, and are continuing to expand our extensive security measures including providing additional training.