{"meta":{"exportedAt":"2026-10-12T09:13:02.374Z","formatVersion":2,"selection":{"q":"insurance","system":"","harm":"","context":"","country":"","role":"","relation":"","evidence":"","year":"2026","response":"","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":2,"coverage":{"cases":2,"countries":1,"languages":2,"unknownLocation":1,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":0,"minors":0,"coreRelations":1,"contextualRelations":1,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2026-japan-health-guidance-contractor-employee-uploaded-insured-members-health-data-to-unauthorised-ai-service","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'令和８年８月 20 日、委託先におけるデータ抽出業務において、委託先担当者が個人情報を含む'; 'データを、委託先が利用を許可していない AI サービスに入力等を行ったことが判明しました。'","relation":"supports","source_id":"s1"},{"locator":"'RIZAPの特定保健指導運営事務局で、従業員がデータ抽出業務を行う際、2024年度、2025年度、2026年度にRIZAPの特定保健指導を利用した210名分の個人情報を生成AIへ参照させたことが、当該従業員の自己申告で判明したとしています。'","relation":"supports","source_id":"s2"},{"locator":"'個人で利用している外部の生成AIサービスへ、要配慮個人情報を含む顧客情報を誤ってアップロードしていたという事象です。'","relation":"supports","source_id":"s3"}],"assertion":"RIZAP reported to its client insurers that it came to light on 20 August 2026 that, in data-extraction work, one of its staff had entered data containing members' personal information into an external generative AI service the company had not authorised.","causal_attribution":"All three accounts rest on RIZAP's own report of its employee's action, relayed by each insurer and by RIZAP's release; the transfer to the AI service is admitted by the company."},{"id":"c2","status":"reported","evidence":[{"locator":"'対象者は 726 名で、対象支部は 14 支部'; '疾患情報（高血圧症、糖尿病、脂質異常症のいずれかに該当する方）'","relation":"supports","source_id":"s1"}],"assertion":"The mutual aid association says 726 of its members across 14 branches are covered, and that the data included membership numbers, email addresses, names, dates of birth and sex, some addresses and phone numbers, the type of health guidance and disease information on high blood pressure, diabetes or dyslipidaemia.","causal_attribution":"The association's count of its own members, from its notice."},{"id":"c3","status":"reported","evidence":[{"locator":"'対象は2024年度、2025年度、2026年度にRIZAPの特定保健指導を利用した210名です。'; '当該従業員の自己申告で判明したとしています。'; '9月1日、OpenAIから「当該データはモデルの学習に利用されていない」との回答を得ています。'","relation":"supports","source_id":"s2"}],"assertion":"The IHI group health insurance society reported 210 of its members, said the matter was found through the employee's self-report, and said OpenAI answered on 1 September that the data had not been used for model training.","causal_attribution":"Relayed from the society's notice by a security news site; the notice itself was not read."},{"id":"c4","status":"reported","evidence":[{"locator":"'ビスに入力等を行ったデータについて、AI サービス提供事業者による閲覧・アクセスの有無に関し'","relation":"supports","source_id":"s1"},{"locator":"'一方、IHIグループ健康保険組合は、現時点で第三者への情報漏えい等の事実は確認されていないとする一方、OpenAIによる閲覧の有無については確認を継続しています。'","relation":"supports","source_id":"s2"},{"locator":"'当該生成AIサービスの運営事業者以外の第三者に閲覧された可能性と、生成AIの学習に利用された可能性はないことを確認したとしています。'","relation":"supports","source_id":"s3"}],"assertion":"The IHI society said no third-party leak had been confirmed, and both insurers said that whether the AI provider viewed or accessed the data was still being checked; RIZAP's release says it confirmed no possibility of viewing by third parties other than the operator and no training use.","causal_attribution":"Statements by the insurers and RIZAP about the limits of the exposure; not independently verified."},{"id":"c5","status":"reported","evidence":[{"locator":"'漏えいの可能性のある対象者に対しては、委託先から令和８年９月４日１０時に電子メールによりご'","relation":"supports","source_id":"s1"}],"assertion":"RIZAP notified affected members by email on 4 September 2026.","causal_attribution":"The association's statement of the notification."}],"effects":[{"label":"insured members' identifying details and disease information entered into an external generative AI service without their knowledge (insurers' notices)","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.chikyosai.or.jp/info/pdf/info_260904.pdf","kind":"official_record","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. Text extracted from the PDF with pdftotext; the notice relays what RIZAP reported to the association.","independence_group":"chikyosai-notice"},{"id":"s2","url":"https://rocket-boys.co.jp/security-measures-lab/ihi-rizap-openai-210-incident/","kind":"news_report","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. A security news site's report of the IHI group health insurance society's 2 September notice; the society's own page was not read.","independence_group":"ihi-kenpo-notice"},{"id":"s3","url":"https://monoist.itmedia.co.jp/mn/spv/2609/18/news007.html","kind":"news_report","access":"read","language":"ja","translation_note":"Read in Japanese on 2026-10-12; quoted passages were translated into English by the research agent (an AI), not by a human translator. A columnist's description of RIZAP group's release; the release page itself rendered no text to the fetcher and was not read directly. The page was decoded from Shift_JIS.","independence_group":"rizap-group-release"}],"version":1,"ai_roles":["others_use"],"contexts":["health","work","privacy"],"unknowns":["Whether 20 August 2026 is the date the data was entered or the date it was discovered.","The total number of people across all of RIZAP's client insurers, and whether the 726 and 210 counts overlap.","Which OpenAI product and account type the employee used; RIZAP's release does not name the service.","Whether the provider's staff viewed or accessed the data.","Whether the Personal Information Protection Commission has taken any action."],"geography":{"basis":"The affected members belong to Japanese insurers; the mutual aid association lists them by Japanese prefectural branches (Iwate, Akita, Osaka and others). The notices do not state where the employee did the data-extraction work, so no event country is recorded. No court is involved.","court_countries":[],"event_countries":[],"affected_person_countries":["JP"]},"publication":{"basis":"Published under the 2026-10-06 private-information ruling: two insurers' notices describe their contractor's employee actually entering members' identifying and disease information into an external generative AI service the contractor had not authorised, without the members' knowledge. The account rests on RIZAP's own admission as relayed by its clients and its release; the provider's answer on training and the open question of provider access are recorded.","reviewed_on":"2026-10-12"},"ai_involvement":{"basis":"The insurers' notices state that a contractor's staff member entered data containing members' personal information, including disease information, into an external generative AI service the contractor had not permitted, and that the data was deleted from the service afterwards; the provider was asked to delete stored copies. The privacy harm is that transfer of members' health-guidance data to an AI service without their knowledge. The notices record transmission and a provider answer that the data was not used for training; whether provider staff viewed it was unresolved, and no generated output about the members is reported.","status":"reported"},"person_relations":["received_personal_information"]},"name":"Health-guidance contractor says an employee entered insured members' names and disease information into an unauthorised external generative AI service","summary":"A local-government employees' mutual aid association said in a notice dated 4 September 2026 that RIZAP, the company it contracts for specific health guidance, had reported that on 20 August 2026 it emerged that a RIZAP staff member, during data-extraction work, had entered data containing personal information into an external generative AI service that RIZAP did not permit. The association says 726 of its members across 14 branches are covered and lists the data as membership numbers, email addresses, names, dates of birth, sex, some addresses and phone numbers, the type of health guidance and, for members with them, high blood pressure, diabetes or dyslipidaemia. The IHI group health insurance society reported 210 of its members in a 2 September notice that, according to a security news site, names OpenAI as the provider, says the matter came to light through the employee's own report, and says OpenAI answered on 1 September that the data had not been used for model training. RIZAP's own release, as described in an ITmedia column, says the information was uploaded by mistake to a generative AI service the employee used privately, and that the company confirmed no possibility of viewing by third parties other than the service operator or of use in training. Whether the provider's staff could view the data was still being checked when the insurers published.","incidentDate":"2026-08-01","incidentKind":"single_event","incidentDatePrecision":"month","exposurePattern":"single_interaction","reportedDate":"2026-09-02","aiSystem":"An external generative AI service that the contractor had not authorised for work; RIZAP's own release calls it an external generative AI service used privately by the employee, and the IHI group health insurance society's notice, as relayed by a security news site, names OpenAI as the provider","aiProduct":"Unidentified OpenAI generative AI service (reported)","severity":"medium","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"According to notices from two client insurers, an employee of their health-guidance contractor RIZAP entered personal data on insured members, including names, birth dates, insurance numbers, contact details and, for some, high blood pressure, diabetes or dyslipidaemia, into an external generative AI service that the company had not authorised; one insurer counts 726 affected members and another 210.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":0,"otherPeopleHarmedMin":726,"affectedCountStatus":"partial","affectedCountEvidence":"One insurer's notice (a local-government employees' mutual aid association) states that 726 of its members were covered by the data entered into the AI service, across 14 branches; that is the counted minimum. A second client, the IHI group health insurance society, separately reported 210 of its members, as relayed by a security news site; these people are additional but the two lists are not shown to be disjoint, so they are left in the unquantified remainder. RIZAP's own release, as described in an ITmedia column, gives no total. The employee who entered the data is not counted.","victimAgeRange":"adult","jurisdiction":"JP","platformType":"other","outcomeStatus":"ongoing","primarySourceUrl":"https://www.chikyosai.or.jp/info/pdf/info_260904.pdf","primarySourceLabel":"Local-government employees' mutual aid association (Chikyosai), notice of 4 September 2026 on its contractor's AI-service data entry","firstPublishedAt":"2026-10-12T03:35:18.489537+00:00","updatedAt":"2026-10-12T03:35:18.489537+00:00","scopeVersion":"facts-v3","tags":["privacy","health-data","generative-ai","unauthorised-ai-use","contractor","insurance","japan","openai"]},{"id":"2026-trofa-portugal-urologist-handed-patient-unvalidated-gemini-diet-printout","caseFacts":{"claims":[{"id":"c1","status":"reported","evidence":[{"locator":"'Uma consulta no Trofa Saúde Hospital da Trofa terminou com um médico a entregar a uma paciente uma recomendação impressa diretamente do Gemini'; 'o caso ocorreu a 2 de junho durante uma consulta de urologia. Em vez de um plano nutricional personalizado para um problema renal, o paciente recebeu uma folha impressa que trazia, no cabeçalho, a etiqueta de \"vista geral de IA\".'","relation":"supports","source_id":"s1"},{"locator":"'o paciente procurou uma consulta de urologia para acompanhamento de um problema renal e esperava receber um plano nutricional personalizado. Em vez disso, afirma ter recebido uma folha impressa com recomendações alimentares, identificada no topo como uma \"vista geral de IA\", gerada pelo Gemini.'","relation":"supports","source_id":"s2"}],"assertion":"During a urology consultation on 2 June 2026 at the Trofa Saúde Hospital da Trofa, a patient with a kidney problem who expected a personalised nutrition plan received a printed sheet of food recommendations headed 'AI overview', generated by Google's Gemini.","causal_attribution":"Patient's account to Correio da Manhã; relays repeat it."},{"id":"c2","status":"reported","evidence":[{"locator":"'Para quem paga cerca de 90 euros pela consulta numa das unidades do grupo de saúde privado, se não tiver seguro de saúde, a experiência deixou um gosto amargo.'; '\"Nunca experienciei uma coisa assim. Eu preferia que ele demorasse o seu tempo\", confessou o paciente, questionado pelo CM, considerando \"uma falta de consideração\" por parte do profissional de saúde.'; '\"O médico estava a escrever no computador e eu não estava à espera de receber um print do Google\", relatou.'","relation":"supports","source_id":"s1"},{"locator":"'O doente, que pagou cerca de 90 euros pela consulta, descreveu a experiência como inédita e dececionante.'; 'Segundo o seu relato, o médico limitou-se a imprimir e entregar a informação produzida pelo chatbot, sem explicar se tinha revisto ou adaptado o conteúdo ao seu quadro clínico.'","relation":"supports","source_id":"s2"},{"locator":"'Uma paciente que pagou cerca de 90 euros por uma consulta de urologia numa unidade do grupo Trofa Saúde recebeu, no final, um documento alegadamente gerado por Inteligência Artificial'","relation":"supports","source_id":"s3"}],"assertion":"The patient said the doctor simply printed and handed over the list without showing it had been checked against the patient's case, and called it a lack of consideration; the consultation costs about EUR 90 without insurance.","causal_attribution":"Patient's account; CM frames the EUR 90 as the price for patients without health insurance, and whether this patient was insured is not stated."},{"id":"c3","status":"reported","evidence":[{"locator":"'\"A inteligência artificial é um apoio, não um substituto. Toda a informação obtida via IA tem de ser obrigatoriamente validada pelo médico antes de chegar ao paciente. O médico tem a responsabilidade total e intransmissível sobre o ato\"'; 'Apesar das sucessivas tentativas de contacto ao longo das últimas três semanas, o grupo não prestou quaisquer esclarecimentos.'","relation":"supports","source_id":"s1"},{"locator":"'Contactada pelo Correio da Manhã, a Ordem dos Médicos afirma não ter conhecimento formal do caso concreto'; 'Para Carlos Cortes, recorrer a um chatbot para produzir recomendações básicas de alimentação em contexto de urologia representa uma atuação \"profundamente inábil\"'","relation":"supports","source_id":"s2"}],"assertion":"The Ordem dos Médicos, which said it had no formal knowledge of the case, said AI information must be validated by the doctor before reaching the patient and called using a chatbot for basic urology food lists 'profoundly inept'; Trofa Saúde did not answer the paper's questions.","causal_attribution":"Professional body's general statement in response to the paper; it did not examine the case."}],"effects":[{"label":"a paid urology consultation ended with an unvalidated Gemini food list instead of a personalised nutrition plan, which the patient called a lack of consideration","claim_id":"c1","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.cmjornal.pt/sociedade/detalhe/urologista-do-hospital-da-trofa-entrega-recomendacoes-geradas-por-ia-a-paciente-sem-validacao-medica","kind":"news_report","access":"read","language":"pt","translation_note":"Original report; full Portuguese body read by curl on 2026-09-29. Researcher's English rendering; no human translation.","independence_group":"correio-da-manha"},{"id":"s2","url":"https://www.onoticiasdatrofa.pt/urologista-do-hospital-da-trofa-entrega-recomendacoes-geradas-por-ia-a-paciente-sem-validacao-medica/","kind":"news_report","access":"read","language":"pt","translation_note":"Local paper's rewrite of the Correio da Manhã report (16 July 2026), read by curl on 2026-09-29; it credits CM and adds no independent reporting.","independence_group":"correio-da-manha"},{"id":"s3","url":"https://postal.pt/nacional/paciente-paga-90e-por-consulta-de-urologia-no-privado-e-as-recomendacoes-do-medico-foram-geradas-por-inteligencia-artificial/","kind":"news_report","access":"read","language":"pt","translation_note":"Postal rewrite of the CM report (16 July 2026), read by curl on 2026-09-29; it refers to the patient in the feminine, while CM mostly uses the masculine, so the record does not state gender.","independence_group":"correio-da-manha"}],"version":1,"ai_roles":["institutional_use"],"contexts":["health"],"unknowns":["The content of the printed recommendations and whether any of it was inappropriate for the patient's condition.","The doctor's identity and whether the hospital or the Ordem dos Médicos took any action.","Whether the patient was insured and what the patient actually paid."],"geography":{"basis":"The consultation took place at the Trofa Saúde Hospital da Trofa in Trofa, Portugal (Correio da Manhã). The patient's country of residence is not stated.","court_countries":[],"event_countries":["PT"],"affected_person_countries":[]},"publication":{"basis":"Published as a concrete adverse experience in which AI output, relayed unvalidated by a hospital doctor, replaced personalised advice in a paid consultation. It rests on the patient's account in one Correio da Manhã report and its relays; no health harm is reported, and neither the patient nor the doctor is named.","reviewed_on":"2026-09-29"},"ai_involvement":{"basis":"The patient's printout was headed 'vista geral de IA', the label of Google's AI overview, and Correio da Manhã identifies it as Gemini output; the printout itself was not inspected and the hospital did not comment.","status":"reported"},"person_relations":["communicated_with"]},"name":"Trofa, Portugal: a patient at a private urology consultation (about EUR 90 without insurance) for a kidney problem, expecting a personalised nutrition plan, was handed a printout of Google Gemini food recommendations headed 'AI overview'; the Portuguese Medical Association called the practice 'profoundly inept'","summary":"According to Correio da Manhã, during a urology consultation at the Trofa Saúde Hospital da Trofa on 2 June 2026, a patient being followed for a kidney problem expected a personalised nutrition plan but received a printed sheet of food recommendations headed 'vista geral de IA' ('AI overview'), generated by Google's Gemini. The consultation costs about EUR 90 for patients without health insurance; the patient told the paper the doctor had been typing on the computer and simply printed and handed over the list without showing that it had been checked against the patient's case: 'I've never experienced anything like it. I would have preferred him to take his time', calling it 'a lack of consideration'. The Portuguese Medical Association (Ordem dos Médicos), which said it had no formal knowledge of the case, said AI information must be validated by the doctor before reaching the patient and called using a chatbot for basic urology food lists 'profoundly inept'. Trofa Saúde did not respond to the paper over three weeks.","incidentDate":"2026-06-02","incidentKind":"single_event","incidentDatePrecision":"day","exposurePattern":"single_interaction","reportedDate":"2026-07-15","aiSystem":"Google Gemini ('AI overview' output), used by a hospital urologist to produce dietary recommendations that were printed and handed to the patient","aiProduct":"Gemini (reported)","aiCompany":"Google","severity":"low","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["psychological_distress"],"harmOutcomeSummary":"The patient says a private consultation (about EUR 90 without insurance) ended with a printed Google Gemini food list instead of a personalised nutrition plan, handed over without any sign it had been checked against the patient's case, and called it 'a lack of consideration' (patient's account to Correio da Manhã; no health effect is reported).","frameworkFacets":[],"causationStatus":"alleged","participantUsersAffectedMin":1,"otherPeopleHarmedMin":0,"affectedCountStatus":"exact","affectedCountEvidence":"One patient, who received the Gemini printout and described the consultation to Correio da Manhã. The patient is counted as a participant because the AI-generated text itself was handed to them as the doctor's recommendation. Exact 1.","victimAgeRange":"unknown","jurisdiction":"PT","platformType":"assistant","outcomeType":"media_coverage","outcomeStatus":"unknown","primarySourceUrl":"https://www.cmjornal.pt/sociedade/detalhe/urologista-do-hospital-da-trofa-entrega-recomendacoes-geradas-por-ia-a-paciente-sem-validacao-medica","primarySourceLabel":"Correio da Manhã, 15 July 2026: Urologista do Hospital da Trofa entrega recomendações geradas por IA a paciente sem validação médica","firstPublishedAt":"2026-09-29T09:00:39.286269+00:00","updatedAt":"2026-09-30T01:17:57.094189+00:00","scopeVersion":"facts-v3","tags":["gemini","google","ai-overview","healthcare","urology","private-hospital","portugal","ordem-dos-medicos","institutional-use","portuguese-language"]}]}