Loading story…
A Utah state privacy audit concluded that systemic weaknesses in access controls, records request handling, and incident response preparedness are putting sensitive child welfare and health information at risk within two Utah Department of Health and Human Services (DHHS) data repositories. The audit—stemming from a May 2025 probe and published by state auditor Tina Cannon—characterized the deficiencies as a critical failure to protect vulnerable populations, warning that inadequate safeguards around highly confidential data could enable misuse and long-term harm.
The review was initiated following a whistleblower complaint from a DHHS employee, according to the state auditor’s office. One of the repositories examined was the SAFE system used by the Division of Child and Family Services, with auditors citing inadequate access controls and insufficient incident response planning as key gaps requiring remediation to reduce exposure of sensitive records affecting millions of children and adults in Utah.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Utah State Auditor Tina Cannon presented the audit findings to lawmakers, warning that sensitive child welfare and mental health data had been placed at risk by weak controls. State officials said there had been no hacking incidents, major data exposures, or confirmed misuse or inappropriate sharing involving the SAFE and eChart systems.
After completing the audit, the state auditor's office delayed public release of the findings to give DHHS time to address the identified weaknesses and reduce the risk that publicized gaps could be exploited. During this period, DHHS began implementing the audit's recommendations.
In May 2025, the audit found systemic deficiencies in the SAFE and eChart repositories, including overly broad access to sensitive records, weak role-based and least-privilege enforcement, insufficient monitoring, and incident-response gaps. Auditors reported that 1,222 SAFE users had broad viewing access without case-based restrictions or required justification, creating risk that a single compromised account could expose large volumes of data.
A whistleblower complaint prompted Utah state auditors to open a privacy audit into two Utah Department of Health and Human Services data repositories, the SAFE child welfare system and the Utah State Hospital's eChart system. The audit examined access controls, record handling, and incident response practices affecting sensitive child welfare and health data.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An audit by the Utah State Auditor found **critical privacy and security weaknesses** at the Utah Department of Health and Human Services (DHHS), following a whistleblower complaint alleging inadequate incident response procedures and insufficient monitoring to detect and manage privacy incidents. The review focused on two high-sensitivity systems—**SAFE** (Utah’s child welfare case management system, reported to contain ~6 million records tied to >2 million individuals) and **eChart** (a mental health records repository maintained by the Utah State Hospital)—and concluded that gaps in documentation, controls, and oversight increase the risk of unmitigated exposure of sensitive data, particularly children’s information. Separately, British Columbia’s Office of the Information and Privacy Commissioner reported **intentional “snooping”** by healthcare staff into patient records following the Lapu Lapu Day festival tragedy, with 71 unauthorized access incidents affecting the medical records of 16 individuals and attributed to 35 employees across multiple health authorities (plus one physician-office assistant). In contrast, HIPAA Journal’s reminder about the **March 1, 2026** deadline for reporting “small” (<500 individuals) healthcare breaches to HHS OCR is primarily compliance guidance rather than a specific incident, though it underscores regulatory expectations for timely breach notification and the risk of penalties and compliance investigations for late reporting.
Jun 29, 2026
The U.S. Department of Health and Human Services **Office of Inspector General (HHS-OIG)** published an audit of an unnamed **large Southeastern U.S. hospital** (more than 300 beds) identifying security weaknesses in **four internet-accessible web applications** that could be used as vectors for initial access and could hinder timely breach detection if not remediated. The review assessed whether the hospital’s controls could prevent and detect cyberattacks, maintain **continuity of patient care**, and protect **Medicare enrollee data**; the hospital is part of a broader provider network that shares protected health information for treatment, payment, and healthcare operations. According to reporting on the audit, the hospital had adopted the **HITRUST Common Security Framework (CSF) v9.4** and maintained HIPAA-required administrative, physical, and technical safeguards, and OIG evaluated policies/procedures (including data protection, data loss prevention, network management, and incident response) and interviewed staff. OIG also performed **penetration testing and external vulnerability assessments**, finding that while controls detected most simulated attacks, **web-application weaknesses remained** that could be exploited; the coverage emphasized that similar issues may be present across other U.S. hospitals with comparable internet-facing application exposure.
Jun 29, 2026
A two-year investigation of 100 education-technology applications used in Utah schools found widespread collection and disclosure of student data that appeared to conflict with vendor privacy agreements. The Utah State Board of Education, Brigham Young University, and Internet Safety Labs inspected live network traffic from 2023 through 2025; among 85 applications covered by relevant student-data agreements, **52%** collected at least one data element not permitted under those terms. Across all applications tested, **61%** shared data with third parties and **36%** transmitted data to advertisers, highlighting the gap between contractual assurances and observed application behavior. Utah responded with H.B. 55, effective July 1, 2026, which requires specified student-data safeguards in vendor contracts and directs schools to terminate contracts when confirmed violations are not remedied after notice.
Aug 26, 2026