{"meta":{"exportedAt":"2026-10-23T09:02:10.419Z","formatVersion":2,"selection":{"q":"health-guidance","system":"","harm":"","context":"","country":"","role":"","relation":"contextual","evidence":"","year":"2026","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":1,"coverage":{"cases":1,"countries":0,"languages":1,"unknownLocation":1,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":0,"minors":0,"coreRelations":0,"contextualRelations":1,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2026-japan-health-guidance-contractor-employee-uploaded-insured-members-health-data-to-unauthorised-ai-service","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'令和８年８月 20 日、委託先におけるデータ抽出業務において、委託先担当者が個人情報を含む'; 'データを、委託先が利用を許可していない AI サービスに入力等を行ったことが判明しました。'","relation":"supports","source_id":"s1"},{"locator":"'RIZAPの特定保健指導運営事務局で、従業員がデータ抽出業務を行う際、2024年度、2025年度、2026年度にRIZAPの特定保健指導を利用した210名分の個人情報を生成AIへ参照させたことが、当該従業員の自己申告で判明したとしています。'","relation":"supports","source_id":"s2"},{"locator":"'個人で利用している外部の生成AIサービスへ、要配慮個人情報を含む顧客情報を誤ってアップロードしていたという事象です。'","relation":"supports","source_id":"s3"}],"assertion":"RIZAP reported to its client insurers that it came to light on 20 August 2026 that, in data-extraction work, one of its staff had entered data containing members' personal information into an external generative AI service the company had not authorised.","causal_attribution":"All three accounts rest on RIZAP's own report of its employee's action, relayed by each insurer and by RIZAP's release; the transfer to the AI service is admitted by the company."},{"id":"c2","status":"reported","evidence":[{"locator":"'対象者は 726 名で、対象支部は 14 支部'; '疾患情報（高血圧症、糖尿病、脂質異常症のいずれかに該当する方）'","relation":"supports","source_id":"s1"}],"assertion":"The mutual aid association says 726 of its members across 14 branches are covered, and that the data included membership numbers, email addresses, names, dates of birth and sex, some addresses and phone numbers, the type of health guidance and disease information on high blood pressure, diabetes or dyslipidaemia.","causal_attribution":"The association's count of its own members, from its notice."},{"id":"c3","status":"reported","evidence":[{"locator":"'対象は2024年度、2025年度、2026年度にRIZAPの特定保健指導を利用した210名です。'; '当該従業員の自己申告で判明したとしています。'; '9月1日、OpenAIから「当該データはモデルの学習に利用されていない」との回答を得ています。'","relation":"supports","source_id":"s2"}],"assertion":"The IHI group health insurance society reported 210 of its members, said the matter was found through the employee's self-report, and said OpenAI answered on 1 September that the data had not been used for model training.","causal_attribution":"Relayed from the society's notice by a security news site; the notice itself was not read."},{"id":"c4","status":"reported","evidence":[{"locator":"'ビスに入力等を行ったデータについて、AI サービス提供事業者による閲覧・アクセスの有無に関し'","relation":"supports","source_id":"s1"},{"locator":"'一方、IHIグループ健康保険組合は、現時点で第三者への情報漏えい等の事実は確認されていないとする一方、OpenAIによる閲覧の有無については確認を継続しています。'","relation":"supports","source_id":"s2"},{"locator":"'当該生成AIサービスの運営事業者以外の第三者に閲覧された可能性と、生成AIの学習に利用された可能性はないことを確認したとしています。'","relation":"supports","source_id":"s3"},{"locator":"'第三者が生成AIサービスを通じて閲覧・利用した事実はないことを同社に確認済です。'","relation":"supports","source_id":"s4"}],"assertion":"The IHI society said no third-party leak had been confirmed, and both the IHI society and the mutual aid association said that whether the AI provider viewed or accessed the data was still being checked; Doken Kokuho says RIZAP confirmed to it that no third party viewed or used the information through the service; RIZAP's release says it confirmed no possibility of viewing by third parties other than the operator and no training use.","causal_attribution":"Statements by the insurers and RIZAP about the limits of the exposure; not independently verified."},{"id":"c5","status":"reported","evidence":[{"locator":"'漏えいの可能性のある対象者に対しては、委託先から令和８年９月４日１０時に電子メールによりご'","relation":"supports","source_id":"s1"}],"assertion":"RIZAP notified affected members by email on 4 September 2026.","causal_attribution":"The association's statement of the notification."},{"id":"c6","status":"reported","evidence":[{"locator":"'個人情報を含むデータ（19,996名分（うち当組合分 は1,167名分））が、同社が業務利用を許可していない外部の生成AIサービスに入力・参照される事態が発生していたことが判明しました。'; '外部の生成AIサービス（法人契約をしていない）'; '本事案は、作業を行った同社の従業員自身が情報の送信に気付き申告したことにより確認されたものです。'","relation":"supports","source_id":"s4"},{"locator":"'全国土木建築国民健康保険組合の公表によると、2026年8月20日、19,996名分のデータがRIZAPで業務利用を許可されていない外部生成AIサービスに入力・参照されました。'; 'IHI健保の210名、地方職員共済組合の726名、全国土木建築国保の1,167名などは、その中に含まれる委託元別の対象者とみられるため'","relation":"supports","source_id":"s5"}],"assertion":"Doken Kokuho says that on 20 August 2026 it emerged that data containing personal information on 19,996 people, 1,167 of them its members, had been entered into or referenced by an external generative AI service that RIZAP had not authorised for work and had no corporate contract for, and that the matter was found when the employee noticed the transmission and reported it.","causal_attribution":"The insurer's notice relaying RIZAP's report (one origin: the Doken Kokuho notice, which the security news site also relays); the site's reading that the 726 and 210 are subsets of the 19,996 is its own inference."},{"id":"c7","status":"reported","evidence":[{"locator":"'当該サービス提供事業者に対して保管データの削除依頼を行い削除しました。'; '個人情報保護委員会への報告につきましても8月21日に完了しております。'","relation":"supports","source_id":"s4"},{"locator":"'日立健康保険組合は9月3日、実効性のある再発防止策を確認できるまで、RIZAPによる特定保健指導の新規受付を停止すると発表しました。'","relation":"supports","source_id":"s5"}],"assertion":"Doken Kokuho says the stored data was deleted from the provider and that the report to the Personal Information Protection Commission was completed on 21 August 2026; the Hitachi health insurance society, according to a security news site, stopped accepting new RIZAP health-guidance referrals until it could confirm effective measures against recurrence.","causal_attribution":"The insurer's own statement of its response; the Hitachi society's suspension is relayed by the security news site and its notice was not read."}],"effects":[{"label":"insured members' identifying details and disease information entered into an external generative AI service without their knowledge (insurers' notices; 19,996 people in one insurer's count)","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.chikyosai.or.jp/info/pdf/info_260904.pdf","kind":"official_record","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12 and re-read on 2026-10-16; quoted passages were translated into English by the research agent (an AI), not by a human translator. Text extracted from the PDF with pdftotext; the notice relays what RIZAP reported to the association.","independence_group":"chikyosai-notice"},{"id":"s2","url":"https://rocket-boys.co.jp/security-measures-lab/ihi-rizap-openai-210-incident/","kind":"news_report","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12 and re-read on 2026-10-16; quoted passages were translated into English by the research agent (an AI), not by a human translator. A security news site's report of the IHI group health insurance society's 2 September notice; the society's own page was not read.","independence_group":"ihi-kenpo-notice"},{"id":"s3","url":"https://monoist.itmedia.co.jp/mn/spv/2609/18/news007.html","kind":"news_report","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12 and re-read on 2026-10-16; quoted passages were translated into English by the research agent (an AI), not by a human translator. A columnist's description of RIZAP group's release; the release page itself rendered no text to the fetcher and was not read directly. The page was decoded from Shift_JIS.","independence_group":"rizap-group-release"},{"id":"s4","url":"https://dokenpo.or.jp/pop/detail2069","kind":"official_record","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-16; quoted passages were translated into English by the research agent (an AI), not by a human translator. The insurer's own web notice; it relays what RIZAP reported and carries no publication date on the page.","independence_group":"doken-kokuho-notice"},{"id":"s5","url":"https://rocket-boys.co.jp/security-measures-lab/rizap-employee-ihi-ai-upload-incident/","kind":"news_report","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-16; quoted passages were translated into English by the research agent (an AI), not by a human translator. A security news site's summary of several insurers' notices (published 4 September, updated 13 September 2026); its 19,996 figure is taken from the Doken Kokuho notice.","independence_group":"doken-kokuho-notice"}],"version":1,"ai_roles":["others_use"],"contexts":["health","work","privacy"],"unknowns":["Whether 20 August 2026 is the date the data was entered or the date it was discovered.","RIZAP has not published a total; the 19,996 figure is one insurer's statement of the whole data set, and how the other insurers' counts fit inside it is the security news site's inference.","Which OpenAI product and account type the employee used; RIZAP's release does not name the service.","Whether the provider's staff viewed or accessed the data.","Whether the Personal Information Protection Commission has taken any action beyond receiving the report."],"geography":{"basis":"The affected members belong to Japanese insurers; the mutual aid association lists them by Japanese prefectural branches (Iwate, Akita, Osaka and others). The notices do not state where the employee did the data-extraction work, so no event country is recorded. No court is involved.","court_countries":[],"event_countries":[],"affected_person_countries":["JP"]},"publication":{"basis":"Published under the 2026-10-06 private-information ruling: client insurers' notices describe their contractor's employee actually entering members' identifying and disease information into an external generative AI service the contractor had not authorised, without the members' knowledge. The 2026-10-16 review adds one insurer's notice putting the data set at 19,996 people. The account rests on RIZAP's own admission as relayed by its clients and its release; the provider's answer on training and the open question of provider access are recorded.","reviewed_on":"2026-10-16"},"ai_involvement":{"basis":"The insurers' notices state that a contractor's staff member entered data containing members' personal information, including disease information, into an external generative AI service the contractor had not permitted (Doken Kokuho adds that it had no corporate contract for the service), and that the data was deleted from the service afterwards; the provider was asked to delete stored copies. The privacy harm is that transfer of members' health-guidance data to an AI service without their knowledge. The notices record transmission and a provider answer that the data was not used for training; whether provider staff viewed it was unresolved, and no generated output about the members is reported.","status":"reported"},"person_relations":["received_personal_information"]},"name":"An insurer says a health-guidance contractor's employee entered data on 19,996 people, including disease information, into an unauthorised generative AI service","summary":"Notices from RIZAP's client insurers say that on 20 August 2026 it emerged that a staff member of RIZAP, the company they contract for specific health guidance, had entered data containing members' personal information into an external generative AI service that RIZAP had not permitted for work. The National Civil Engineering and Construction National Health Insurance Association (Doken Kokuho) puts the whole data set at 19,996 people, 1,167 of them its own members, and says the service was not under a corporate contract and that the matter was found when the employee noticed the transmission and reported it. A local-government employees' mutual aid association counts 726 of its members across 14 branches, and the IHI group health insurance society 210, according to a security news site that reads these as subsets of the 19,996. The data included membership numbers, email addresses, names, dates of birth, sex, some addresses and phone numbers, the type of health guidance and, for members with them, high blood pressure, diabetes or dyslipidaemia. The IHI society's notice, as relayed, names OpenAI as the provider and says OpenAI answered on 1 September that the data had not been used for model training. RIZAP's release, as described in an ITmedia column, says no third party other than the service operator could have viewed the data. Doken Kokuho says RIZAP confirmed to it that no third party viewed or used the information through the service; whether the provider's staff could view it was still being checked when the mutual aid association and the IHI society published.","incidentDate":"2026-08-01","incidentKind":"single_event","incidentDatePrecision":"month","exposurePattern":"single_interaction","reportedDate":"2026-09-02","aiSystem":"An external generative AI service that the contractor had not authorised for work; RIZAP's own release calls it an external generative AI service used privately by the employee, and the IHI group health insurance society's notice, as relayed by a security news site, names OpenAI as the provider","aiProduct":"Unidentified OpenAI generative AI service (reported)","severity":"medium","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"According to notices from client insurers, an employee of their health-guidance contractor RIZAP entered personal data on insured members, including names, birth dates, insurance numbers, contact details and, for some, high blood pressure, diabetes or dyslipidaemia, into an external generative AI service that the company had not authorised; one insurer puts the data set at 19,996 people.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":0,"otherPeopleHarmedMin":19996,"affectedCountStatus":"exact","affectedCountEvidence":"The Doken Kokuho notice states that data on 19,996 people (名分), 1,167 of them its own members, was entered into or referenced by the external generative AI service; that insurer's figure for the whole data set is the count used. The mutual aid association's 726 members and the IHI society's 210 (relayed by a security news site) are treated by that site as subsets of the 19,996 and are not added. RIZAP's own release gives no total. The count is of people whose personal information was transferred to the AI service, the privacy harm recorded here; it is not a count of people whose data was shown to have reached a third party. The employee who entered the data is not counted.","victimAgeRange":"adult","jurisdiction":"JP","platformType":"other","outcomeStatus":"ongoing","primarySourceUrl":"https://www.chikyosai.or.jp/info/pdf/info_260904.pdf","primarySourceLabel":"Local-government employees' mutual aid association (Chikyosai), notice of 4 September 2026 on its contractor's AI-service data entry","firstPublishedAt":"2026-10-12T03:35:18.489537+00:00","updatedAt":"2026-10-16T03:00:18.543362+00:00","scopeVersion":"facts-v3","tags":["privacy","health-data","generative-ai","unauthorised-ai-use","contractor","insurance","japan","openai"]}]}