Privacy Audit Finds Utah Child Welfare, Health Data at Risk

Systemic issues in access controls, record request handling and incident response plans related to critical databases are putting the health information of millions children and adults in Utah at risk, state auditors concluded.

See Also: Proof of Concept: Machine Identities Fuel Rising IAM Crisis

The result of a May 2025 privacy probe published Tuesday by Utah state auditor Tina Cannon found inadequate access controls, insufficient incident response preparedness and other deficiencies related to two Utah’s Department of Health and Human Services data repositories.

“The deficiencies we uncovered at the DHHS represent a critical failure to protect the privacy of families, individuals and our most vulnerable, Utah’s children,” said Cannon in a statement.

“When systems that store confidential data about children and individuals lack fundamental safeguards, the potential for misuse and long-term harm is immense. This is not merely saved data or historical files. These are key aspects that represent and open people’s private lives.”

The audit was initiated in response to a whistleblower complaint by a DHHS employee, a spokesperson in the state auditor’s office told Information Security Media Group.

One repository examined by auditors was the SAFE system, used by the Division of Child and Family Services. It contains more than 6 million records related to child welfare, neglect and adoptions pertaining to more than 2 million individuals.

The auditors found that the SAFE system allowed 1,222 users “broad viewing access to the records within the database.” Besides DHHS social workers, government users granted access to SAFE included staff of the office of attorney general and several other offices.

“Viewing access to records is not restricted based on specifically assigned cases or tasks, and the system does not require justification to be entered before viewing documents outside of a user’s workload,” the audit found. Users were expected to limit themselves to appropriate record lookup – and the system did not monitor which records they examined, auditors found.

Some SAFE records are slated to remain in the system for 100 years, “accumulating long-term exposure risk,” the auditors wrote. “Retention periods for typical records related to child welfare case management span from seven to 10 years, with only very specific vital records – such as adoption records – needing to be archived permanently.”

The other repository audited was eChart, which is used by the Utah State Hospital, a psychiatric facility. The repository contains mental health information records of more than 10,000 individuals, including pediatric patients.

As with the SAFE repository, auditors found that the eChart system permitted access to sensitive records without enforcing or adequately monitoring role-based and least privilege access.

Both systems allowed broad access to sensitive records without enforcing or adequately monitoring access, the auditors said. “A single compromised account could expose entire data repositories and opens the threat of identity theft, especially critical for children’s data that is highly valuable on the darkweb,” the report said.

Auditors made several recommendations. A state government spokesman told Information Security Media Group that DHHS is in various stages of implementing the recommendations, and that there have been no hacking incidents nor major data exposures involving SAFE and eChart.

“The report did not identify any instances where data was misused or inappropriately shared,” the spokesman also said.

Cannon presented the findings of the DHHS privacy audit to state lawmakers during a legislature meeting on Wednesday.

Cannon said the audit was the first such examination conducted by her office following the state audit office in May 2025 taking on the duty of data security and privacy audits for 1,800 Utah state agencies. Her office has only three privacy auditors, she told the legislators.

“It is not an easy challenge,” she said.

Cannon’s office withheld the report until now to give DHHS time to “close the gaps,” so that the security and privacy vulnerabilities were not publicly exposed and then potentially exploited, Cannon said.