{"meta":{"exportedAt":"2026-10-12T09:14:43.537Z","formatVersion":2,"selection":{"q":"health-plan","system":"","harm":"","context":"","country":"","role":"","relation":"","evidence":"","year":"2026","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":1,"coverage":{"cases":1,"countries":0,"languages":1,"unknownLocation":1,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":0,"minors":0,"coreRelations":0,"contextualRelations":1,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2026-texas-health-plan-employee-uploaded-members-personal-and-prescription-data-to-chatgpt","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'On the evening of April 29, 2026, a Community First employee uploaded a file containing personal information of some Community First members to ChatGPT from a home computer network'; 'Community First does not utilize ChatGPT, and our systems immediately detected the violation and notified our IT department.'","relation":"supports","source_id":"s1"}],"assertion":"The health plan says that on the evening of 29 April 2026 an employee uploaded a file containing personal information of some members to ChatGPT from a home computer network, circumventing its firewall safeguards and violating its policy, and that its systems detected the violation.","causal_attribution":"The plan's own account of its employee's action; no independent account was inspected."},{"id":"c2","status":"reported","evidence":[{"locator":"'name, address, date of birth, member identification number, and prescription drug information'","relation":"supports","source_id":"s1"}],"assertion":"The plan says the affected information may have included members' names, addresses, dates of birth, member identification numbers and prescription drug information.","causal_attribution":"The plan's description of the file's contents."},{"id":"c3","status":"reported","evidence":[{"locator":"'directed and verified that the employee had deleted all personal information from their ChatGPT account'; 'contacted OpenAI, LLC (the operator of ChatGPT) to demand deletion of any related data'; 'promptly ended with its relationship with the employee'; 'complimentary identity monitoring services for twelve (12) months'; 'Community First is not aware of any impacted information having been misused'","relation":"supports","source_id":"s1"}],"assertion":"The plan says it had the employee delete the data from their ChatGPT account, asked OpenAI to delete related data, ended its relationship with the employee, notified agencies and members, offered identity monitoring and is not aware of any misuse.","causal_attribution":"The plan's statement of its response; OpenAI's reply, if any, is not reported."}],"effects":[{"label":"health-plan members' personal and prescription information uploaded to ChatGPT without their knowledge (plan's release)","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://communityfirsthealthplans.com/press-release/community-first-health-plans-announces-data-security-incident/","kind":"official_statement","access":"read","language":"en","translation_note":"Read in English on 2026-10-12 from the plan's own press-release page; no translation needed. The research agent (an AI) read the text directly.","independence_group":"community-first-release"}],"version":1,"ai_roles":["others_use"],"contexts":["health","work","privacy"],"unknowns":["How many members' information was in the uploaded file.","What the employee was using ChatGPT for and which account type was used.","Whether OpenAI replied or confirmed deletion, and whether the data was retained or used for training.","Where the employee's home network was located.","Whether any regulator has acted on the notification."],"geography":{"basis":"The affected people are members of a nonprofit health plan that the release places in San Antonio, Texas and the Bexar service area. The release says the upload was made from a home computer network without saying where, so no event country is recorded. No court is involved.","court_countries":[],"event_countries":[],"affected_person_countries":["US"]},"publication":{"basis":"Published under the 2026-10-06 private-information ruling: the health plan's own release describes an employee actually uploading a file of members' personal and prescription information to ChatGPT, without the members' knowledge and against the plan's policy. All facts are attributed to that release; the number of members and OpenAI's response are unknown.","reviewed_on":"2026-10-12"},"ai_involvement":{"basis":"The health plan states that its employee uploaded a file of members' personal information, including prescription drug information, to ChatGPT from a home network in breach of policy, that its systems detected the upload, and that it had the data deleted from the employee's ChatGPT account and asked OpenAI to delete related data. The privacy harm is that transfer of members' information into an AI service without their knowledge. The release reports the transmission; it does not report any ChatGPT output about the members, any retention finding or any use in training.","status":"reported"},"person_relations":["received_personal_information"]},"name":"Texas health plan says an employee uploaded a file of members' personal and prescription data to ChatGPT from a home network, against its policy","summary":"Community First Health Plans, a nonprofit health plan in San Antonio, Texas, said in a 29 June 2026 release that on the evening of 29 April 2026 one of its employees uploaded a file containing personal information of some members to ChatGPT from a home computer network, circumventing the plan's firewall safeguards and violating its policy. The plan says it does not use ChatGPT and that its systems detected the violation and alerted its IT department. According to the release, the file may have included members' names, addresses, dates of birth, member identification numbers and prescription drug information. The next morning the plan revoked the employee's access, directed and verified deletion of the data from the employee's ChatGPT account, asked OpenAI to delete any related data, and ended its relationship with the employee. It notified affected members and federal and state agencies, offered 12 months of identity monitoring and says it is not aware of any misuse. The release gives no number of affected members.","incidentDate":"2026-04-29","incidentKind":"single_event","incidentDatePrecision":"day","exposurePattern":"single_interaction","reportedDate":"2026-06-29","aiSystem":"ChatGPT (OpenAI), used by an employee from a home computer network in breach of the health plan's policy; the plan says it does not use ChatGPT","aiProduct":"ChatGPT","severity":"medium","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"According to the health plan, an employee uploaded a file containing some members' names, addresses, dates of birth, member identification numbers and prescription drug information to ChatGPT on 29 April 2026, in breach of its policy; the plan notified members, offered identity monitoring and says it knows of no misuse.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":0,"otherPeopleHarmedMin":0,"affectedCountStatus":"unquantified","affectedCountEvidence":"The plan's release refers to 'some Community First members' and 'affected Members' but gives no number, so no count is recorded (numeric zero placeholders). The employee who uploaded the file is not counted.","victimAgeRange":"unknown","jurisdiction":"US","platformType":"other","outcomeStatus":"ongoing","primarySourceUrl":"https://communityfirsthealthplans.com/press-release/community-first-health-plans-announces-data-security-incident/","primarySourceLabel":"Community First Health Plans press release, 29 June 2026: data security incident","firstPublishedAt":"2026-10-12T03:35:10.75316+00:00","updatedAt":"2026-10-12T03:35:10.75316+00:00","scopeVersion":"facts-v3","tags":["privacy","health-data","chatgpt","unauthorised-ai-use","health-plan","employee"]}]}