A six-card checklist for risk and privacy chiefs, built on the Nov 12, 2026 edition. Weill Cornell Medicine says patient information was entered into AI tools in June and that it learned of it in September. Use the three questions with your team in fifteen minutes.
For: Chief Risk Officer, Chief Privacy Officer, compliance and research-oversight leads in health systems and health plansWeill Cornell Medicine says patient details from a radiology research study were entered into AI tools without authorization between June 10 and June 20, 2026. It learned of it on Sept 6.
Weill Cornell Medicine notice, posted Nov 5, 2026
Medical record and accession numbers, dates of service, facility and provider names, and clinical details. Not names, addresses, Social Security numbers or financial data. Patient count and AI tools were not disclosed.
Weill Cornell Medicine notice, Nov 5, 2026
Evidence to have ready: the approved-tool list, each with its agreement, and the block list. AEGIS Pillar 2, AI System Inventory.
Ariana.Digital checklist (opinion); AEGIS handbook
Evidence: the privacy and research sign-offs for every identifiable export to an AI tool. AEGIS Pillar 1, Governance Architecture.
Ariana.Digital checklist (opinion); AEGIS handbook
Evidence: the alert rule, its last test, and the time from event to discovery in your last drill. Breaches of 500 or more people must be reported to HHS within 60 days. AEGIS Pillar 6, Monitoring and Incident Response.
Ariana.Digital checklist (opinion); Medical Daily, Nov 2026
If staff pasted patient data into an AI tool this week, would you learn in 24 hours, a week, a month, or couldn't tell? Vote in today's poll.
Weill Cornell: June 10 to Sept 6 is about 11 weeks
Vote in today's poll (24 hours, 1 week, 1 month, couldn't tell) on our LinkedIn post, or bring the three questions to your next risk committee. If you want an outside view of how AI use is governed across your organization, the AEGIS operating model maps each control to an owner.