- State Auditor Tina Cannon reported on Tuesday that the Utah Department of Health and Human Services put 2 million Utah residents' data at risk.
- Her audit revealed inadequate policies and widespread access to sensitive information.
- The DHHS acknowledged issues and took steps to address concerns raised in August 2025.
SALT LAKE CITY — The state auditor says the sensitive personal data of millions of Utahns, including children, was put at "significant risk" by the Department of Health and Human Services.
Auditor Tina Cannon said a privacy audit, prompted by a whistleblower, was conducted last year. The audit found confidential data and records of more than 2 million people were not properly safeguarded. The problems spanned multiple areas including widespread access to sensitive information, how records are disseminated, and inadequate department policies, according to the audit.
"I have some real angst over this. I do," Cannon told KSL on Tuesday. "We should be concerned, and I would expect this type of information to be better protected than it is today, and that should be a warning call out to every government entity."
Cannon said one of the big problems the audit found was that DHHS made sensitive records available to more than 1,200 people — many more than there should have been, especially as cybersecurity threats become more prevalent. Those records included cases involving abuse or neglect as well as the foster family system.
"When systems that store confidential data about children and individuals lack fundamental safeguards, the potential for misuse and long-term harm is immense," Cannon said. "This is not merely saved data or historical files. These are key aspects that represent and open people's private lives."
In a statement to KSL on Tuesday, DHHS responded to the audit.
"Protecting the privacy of the millions of Utahns we serve — particularly children and vulnerable adults – is a foundational priority for the Department of Health and Human Services," the department said. "Any concerns about the security of sensitive records within the department are taken very seriously. Immediate steps were taken to address the concerns raised by the state auditor when first communicated to DHHS back in August of 2025."
DHHS went on to point out that while the audit identified ways to better protect records in department databases, it did not identify any instances where personal data was inappropriately shared or misused.
"These databases are only used by authorized users who are required to pass background checks and receive additional training," DHHS said. "They primarily include child welfare caseworkers, attorneys, and medical professionals."
The audit recommended the Department of Health and Human Services make a number of changes, including implementing stricter access controls and reevaluating how sensitive documents are stored and distributed.
Even though the audit was completed last year, Cannon said she waited several months to publicly release the findings to give DHHS time to implement changes.
Cannon was scheduled to present the audit's findings to state lawmakers on Wednesday at 9 a.m.
