SALT LAKE CITY — The Utah State Auditor’s Office released a state audit that has uncovered gaps in how sensitive information belonging to some of Utah’s most vulnerable children and families is handled.
"This was disturbing on so many levels," State Auditor Tina Cannon said. "The ability to access these records is pervasive."
The office launched the privacy audit in June 2025 after receiving a whistleblower complaint about security weaknesses. The review examined data systems used by the Division of Child and Family Services and the Utah State Hospital.
Cannon said investigators found that personal information for more than 2 million Utahns could be at risk. “The assumption is that all case workers and all social workers are just good people, and that gives broad access to everyone. When an agency pushes back and says, 'no everybody needs access to everything,' that’s just not reasonable in today’s world,” Cannon said.
Auditors found that more than 1,000 people could access case files containing details about foster families and abuse survivors. “Based on the interviews of correspondents within the agency, yes, there were breaches made. That information was shared inappropriately,” Cannon said.
Cannon said the findings highlight risks for exploitation of vulnerable children. "If you can get access through any of these access points, and now you have a database of children who are vulnerable, you’ll know who your next victim is going to be,” she said.
Cannon said her office held the report for seven months to allow the agency time to implement its suggestions and improve safeguards. She says that although they've made changes, the progress has been slower than expected.
“We just don’t feel like the agency is giving it the kind of attention and efforts to correct the problem that it really deserves,” she said.
The Utah Department of Health and Human Services shared a statement with FOX 13 News: "Protecting the privacy of the millions of Utahns we serve—particularly children and vulnerable adults—is a foundational priority for the Department of Health and Human Services. Any concerns about the security of sensitive records within the department are taken very seriously. Immediate steps were taken to address the concerns raised by the state auditor when first communicated to DHHS back in August of 2025.
While the auditor’s privacy data report highlights needed steps to better protect records within two databases, the report did not identify any instances where data was misused or inappropriately shared. These databases are only used by authorized users who are required to pass background checks and receive additional training. They primarily include child welfare caseworkers, attorneys, and medical professionals."
Cannon will present the audit findings to the Social Services Appropriations Committee at the Utah Capitol today.
