Whistleblower lawsuit claims Mayo Clinic’s AI puts patient data, safety at risk

A former Mayo Clinic research director alleges the health system concealed a 67% error rate in an artificial intelligence assistant, put unapproved software into live clinical workflows, and fired her when she refused to stay quiet about it.

The allegations come in a whistleblower lawsuit filed July 6 in U.S. District Court in Minnesota by Traci Tamiko Eto, Mayo’s former director of research operations. The complaint claims Mayo retaliated against Eto for raising patient privacy and safety concerns about its AI work — and it lands at a moment when health systems are racing to deploy AI faster than anyone has agreed on how to govern it.

The sharpest allegations concern MAYA, Mayo’s AI digital assistant.

In November 2024, Eto reported problems with a study of MAYA, according to the complaint. She alleged the study team overstated what the tool could do, deleted results that reflected badly on it, and put an unapproved piece of software — described in the filing as software as a medical device, or SaMD — into use without regulatory clearance. Because that software sat inside the same live clinical workflow MAYA was operating in, the complaint argues, both patient safety and data security were exposed.

Eto was not alone. The filing counts 10 other whistleblower reports making the same charge: that people working on the study were trying to keep a 67% error rate from surfacing. Two Mayo executives named in the complaint — Jeffrey Schmoll, administrator of research shared services, and Scott Wright, senior chair of the institutional review board and Human Research Protection Program — approved the study anyway, the filing says, and exempted it from IRB inspection. When Eto pressed for an explanation, the complaint alleges, Schmoll told her that fixing the problem would cost “political capital” he was not prepared to spend.

The lawsuit accuses Mayo of violating the retaliation provisions of the False Claims Act, the Americans with Disabilities Act, and the Family and Medical Leave Act.

Eto took the research operations job in December 2023 and was charged with building Mayo’s AI security and privacy safeguards, according to the complaint — specifically, bringing the system in line with the Biden administration’s October 2023 executive order on AI governance for federal entities and contractors.

Beyond MAYA: Biospecimens, genome data, and ‘Commader’s intent’

The MAYA episode, in the complaint’s telling, was part of a pattern. Over her tenure, the filing says, Eto objected to gaps in patient privacy protection, “manipulation of data to conceal unfavorable outcomes,” software deployed without proper oversight and, in one instance, a cardiac surgery that went forward without full institutional review — a record the complaint characterizes as a running habit of dodging the federally mandated IRB process.

Among the specifics: de-identification steps inside the Mayo Clinic Platform, used when sharing data with global providers, that the filing says should have gone through the IRB and did not. An instruction to sign off on selling patient biospecimens to a commercial buyer with no IRB review at all. And an NIH-funded project that would have loaded patients’ genome sequencing data into a broadly accessible database when the consent forms those patients signed covered no such sharing.

The complaint also alleges that Wright steered one protocol to an IRB panel he expected to be accommodating, and that Schmoll defended those bypasses by telling Eto that Wright had “Commander’s intent” — meaning, as the complaint reads it, that he did not need to justify himself. The phrase, the filing notes, corresponds to no exemption anywhere in federal regulation.

Why the False Claims Act is in play comes down to money and attestation

Why the False Claims Act is in play comes down to money and attestation. The complaint puts Mayo’s 2025 revenue at roughly $21.5 billion and its research funding near $1 billion, with about $498 million of that coming from federal and state government. Federal grant money comes with strings: Mayo must attest, grant by grant, that it is following the federal rules governing human subjects, patient privacy, and the IRB process itself. That attestation structure is what turns a governance lapse into potential fraud exposure — AI-specific regulation may be young, but the old rules never stopped applying.

“The same access, the same minimum necessary obligations, the same audit or encryption obligations, all of those things that govern a human clinician, they still apply without exception to an AI system touching PHI,” said Phil Kim, a healthcare attorney and partner at Jackson Walker.

After she raised her concerns, Eto was excluded from projects and placed on a performance improvement plan, according to the complaint. On Sept. 2, 2025, about midway through a medical leave, she was told her position was being cut in a reduction in force that the filing says reached no one else. She applied for 15 internal jobs, got one interview, and was terminated Dec. 1, 2025.

Mayo Clinic declined to comment.

A wave of cases to come

The healthcare industry is eager to seize AI’s benefits while no cohesive oversight framework exists. The federal government has stayed largely hands-off — President Trump signed an executive order on June 2 addressing some AI oversight — while state-level AI regulation is frequently described as a patchwork.

The tension the complaint describes is not theoretical. When Eto first raised the de-identification concerns, the filing says, Wright never disputed her reading of the rules. His objection was about speed: another IRB pass would slow the research calendar and cost Mayo ground against competitors.

“It’s the tension between innovation versus governance, and there’s a wave of litigation anytime you have that kind of tension,” Kim said.

Others expect the docket to fill up. “We’re going to start to see a lot of healthcare cases, either whistleblower ones like this, a retaliation case, or just a straight fraud case. Because what AI is being used for — I’m starting already to see [it] with some of my clients — it’s being used to replace the judgment of the practitioner,” said Veronica Nannis, a principal in the False Claims Act and civil litigation departments at the law firm Joseph Greenwald & Laake.

If governance doesn’t keep pace with the pressure to move fast, health systems risk exposing protected health information and harming patients — and those failures tend to produce more whistleblowers, not fewer.

Resolution will be slow. “Cases like this take two to three years, if they’re fast,” Nannis told DHI. Whether the suit is dismissed, tried, or settled, others like it are almost certainly coming — and the litigation itself may do what regulators haven’t, prompting agencies and legislators to act and pushing health systems to rethink their AI governance.

“Litigation is much more expensive than investing in and putting together a framework that’s compliant and effective,” Kim said. “That’s what I’ve seen a lot of my clients show a greater willingness to do when you see news articles like this or allegations like this.”

Carrie Pallardy, a Chicago-based freelance writer and editor, began her career covering healthcare more than a decade ago. Her work has taken into many different industries, but covering healthcare delivery remains a constant focus. She can be reached at [email protected] or on LinkedIn.