SALT LAKE COUNTY — Personal health information belonging to Salt Lake County residents was posted online after being tested for COVID-19.
Thousand of test results linked with addresses were up in the county’s COVID-19 data dashboard beginning Thursday until late Monday night.
Deena Pease and her husband discovered the breach of privacy while looking at COVID-19 data online.
“It was literally just one click,” Deena said.
They were shocked to find his COVID-negative test result next to their home address.
“It was pretty alarming just to know that people’s lab results and their personal lab results were available and their addresses. It’s pretty easy to find out the name of the person if you have that information,” Pease said.
A Salt Lake County Health Department spokesperson admits the HIPAA-protected information was up for nearly five days before Pease alerted the State Department of Health. It was taken down Monday night.
“We deeply regret this mistake; it was an unintentional artifact of our efforts to be transparent in our service to Salt Lake County residents," the department wrote in a statement.
The county health department added that they acted quickly to remove the health information and put in a new safeguard to make sure it doesn’t happen again.
“You just don’t know how someone is going to use that information. If you got a phone call from somebody who said they wanted to talk to you about your positive result, you would trust that it was someone from the health department, but it could be someone up to no good and you wouldn’t know because that information would be private,” Pease said.
The county is investigating how the protected information was posted online.
