Washington County Audit Finds Public Records System Lacks Basic Access Controls, Exposing Sensitive Data

Washington County, OR. — Washington County’s public records request application — the cloud-based system that processed 7,774 records requests in fiscal year 2024 — has significant gaps in identity and access management controls, according to a new audit released this week by County Auditor Kristine Adams-Wannberg.

The 57-page report concludes the application sponsor, primarily the County Administrative Office, “needs better support” to establish reasonable safeguards over who can access the system, what they can do inside it, and how that access is reviewed. The system handles sensitive information regulated under federal and state laws, including Criminal Justice Information Services data, electronic protected health information and federal taxpayer information.

Auditors identified four primary findings:

Unclear roles and responsibilities.

Management of the application is split among the County Administrative Office, Information Technology Services and the Sheriff’s Office, yet county policy and procedures do not clearly assign accountability. Job descriptions for staff who manage user access omit these duties, and departments lack standardized processes for granting, reviewing or removing access.

Poor account management and documentation.

Of 539 active user accounts examined, 77 percent had not logged in for more than 90 days — far exceeding both county and industry inactivity thresholds. Fifty-two accounts (10 percent) showed no activity for more than seven years. Many users surveyed were unaware they even had access or what role they held.

Excessive and poorly defined user privileges.

The application has eight roles, three of which grant high-level administrative powers. Auditors found 11 accounts, including the vendor’s, assigned administrator-level access. Most did not require that level of authority for their jobs, and some had not been used in nearly two years. Role definitions and permission documentation were incomplete and inconsistent.

Authentication controls lag behind standards.

While basic username/password and single sign-on are in place, multi-factor authentication is not consistently enforced — particularly for users with elevated access or those handling regulated data. County password policies have not kept pace with evolving industry standards or updated federal Criminal Justice Information Services requirements.

The audit assigns most recommendations a “medium” or “high” risk rating. Among the 11 recommendations are updates to Administrative Policy 203 and related procedures, clearer role matrices, periodic account and privilege reviews, documentation of authorization changes, and implementation of multi-factor authentication for appropriate users.

County management’s written response partially agrees with the findings but cautions that the audit does not fully reflect the system’s design purpose: facilitating the lawful release of public records, many of which become public once processed. Officials note the application replaced a more cumbersome manual process and that many employees legitimately require access. They say several policy and training improvements are already underway or planned and emphasize resource constraints. Details on multi-factor authentication were withheld as exempt from public disclosure.

Auditor Adams-Wannberg wrote in her transmittal letter that the review was conducted to ensure “the right people and devices have the right level of access for their job responsibility.” She thanked county staff for their cooperation and highlighted the work of Management Analyst Mary Harshorn.

The report is available on the county auditor’s website. County officials have not yet announced a timeline for implementing the recommendations.