Michigan Children's Institute Audit: 626 Employees Outside the Unit Could View and Edit Records of 17,000-Plus State Wards; MDHHS Tells TDFP the Database Has Been Moved
A small Michigan office that serves as legal guardian for thousands of children whose parents' rights were terminated kept an unencrypted database holding records on more than 17,000 past and present state wards on a shared drive that 626 people outside the office could view and edit, and it did not know who had access, according to a performance audit released Thursday by the Michigan Office of the Auditor General.
The Michigan Children's Institute audit examined a seven-person unit inside the Michigan Department of Health and Human Services (MDHHS) and concluded that the guardianship activities it examined were "not sufficient." Auditors flagged two material conditions, the most serious category, and a third, reportable finding. MDHHS agreed with the database and adoption-consent findings and disagreed with the finding on its oversight of wards. The audit was first reported Thursday by The Detroit News.
In a statement to The Digital Free Press on Thursday, MDHHS spokesperson Erin Stover said the department "has enhanced data security by migrating the database to a more restricted environment and implementing annual access reviews." The statement did not address TDFP's questions about when the migration was completed, how many people have access today, or whether anyone without a work-related need viewed, edited or disclosed records.
WHAT THE MICHIGAN CHILDREN'S INSTITUTE AUDIT FOUND IN THE DATABASE
MCI used a Microsoft Access database to track adoption-consent requests for its wards and stored it on an MDHHS shared drive "accessible to other areas within and outside of the department," the report says. As of May 29, 2025, the database held records on more than 17,000 past and present wards, including each child's name and date of birth, prospective and competing adoptive families, and sibling information.
Auditors reviewed an MDHHS-provided list of everyone who, as of Aug. 14, 2025, had access to the folder holding the database and identified 626 non-MCI employees with permissions to view and edit the records, "including some individuals who were not employed by MDHHS." MCI told auditors it was unaware the drive was reachable by other parts of the department and had no procedures to segregate or lock down the information, or to monitor who accessed it.
Michigan law requires MCI to treat all ward records as confidential and to keep adoption records in separate locked files, and a state technical standard requires agencies to review annually who has access to proprietary information. Auditors rated the finding a material condition because of the "significant number" of outside employees with inappropriate access, the increased risk of improper disclosure and noncompliance with state law.
The report describes access permissions on a given date. It does not say that any record was actually misused or disclosed, and it does not say 626 people have access today.
In its written response in the report, MDHHS wrote that "MCI agrees with the finding." It said access to the database "was limited to users with an Active Directory account," that MCI coordinated with the Department of Technology, Management and Budget "to migrate the database to a more secure and restricted environment," and that the department "will develop and implement an annual review process to evaluate and validate user access."
MORE THAN HALF OF ACTIVE WARDS WERE NOT BEING MONITORED, AUDITORS SAY
The audit's first finding, which MDHHS disputes, is broader. State law makes the MCI superintendent the legal guardian of each child committed to the institute, generally until age 19. But auditors found MCI identified its wards only by tracking the consent requests caseworkers sent in. Those covered about 2,200 wards during the audit period, while the state's child-welfare data system showed more than 5,000 active MCI wards. For more than half of them, the report says, MCI "had not identified and/or carried out any monitoring activities."
Auditors also found MCI did not consistently order or review the home investigations state law requires for ward placements. In a limited review of Medicaid claims for procedures performed under anesthesia on MCI wards between July 1, 2024, and June 12, 2025, auditors sampled 30 nonemergency procedures and found MCI had neither consented to nor been notified of four of them, 13 percent, "which included surgical procedures performed under general anesthesia."
MDHHS disagreed, writing that it "maintains a comprehensive, multilayered system of oversight that fulfills all statutory guardianship requirements" for MCI wards through caseworkers, program areas and contracted foster-care agencies, and that oversight is "not the sole responsibility of MCI." The auditors replied that the Legislature created MCI to give the state added assurance it is exercising its duties to these children, and that the statute "imparts to MCI a level of oversight responsibility for its wards."
ADOPTION CONSENTS WITHOUT AUTHORIZATION
Only the MCI superintendent, or a county director with the superintendent's written delegation, may consent to an MCI ward's adoption. Reviewing 65 consents made by 26 county directors between Oct. 1, 2023, and May 23, 2025, auditors found 36 of them, 55 percent, were made by 14 directors with no written delegation, and 18 more, 28 percent, were made by six directors before their authorization arrived.
Three of the six MCI staff members employed during the audit period had no conflict-of-interest disclosure on file, though all three had handled adoption-consent requests for about nine years. MCI also missed its contractual decision deadlines for 96 percent of adoption-consent requests involving competing parties and 12 percent of regular requests in fiscal year 2024; in August 2025 it extended the window for competing-party consents from 90 to 120 days.
MDHHS agreed with that finding, noting that the Family Division of the Circuit Court "holds the ultimate authority to issue the final order of adoption." It said it will evaluate its delegation-letter process and train county directors annually, and that a human-resources review of personnel files found "no MDHHS staff conflicts."
WHAT COMES NEXT
The report adds an observation that the 1935 law creating MCI, most of which has gone unchanged for 70 to 90 years, does not define "guardian" or spell out MCI's duties, and that an evaluation of the statute "is likely needed." MDHHS's responses in the report are preliminary; the Auditor General's office publishes follow-up reports on whether agencies carry out its recommendations.
In her statement, Stover said MDHHS "cares deeply for the children it serves" and has "taken steps to strengthen adoption consent processes through improved authorization procedures, better conflict-of-interest monitoring, updated consent timelines and increased staffing." Asked whether the first annual access review has been completed, the department's statement did not say. This story will be updated if MDHHS provides those answers.
Sources: Michigan Office of the Auditor General, Performance Audit Report, Michigan Children's Institute, Michigan Department of Health and Human Services, Report No. 491-2700-25 (October 2026), https://audgen.michigan.gov/wp-content/uploads/2026/10/r491270025-973126.pdf; statement emailed to TDFP by MDHHS spokesperson Erin Stover (Oct. 15, 2026); The Detroit News, "Audit finds gaps in Michigan child welfare oversight" (Oct. 15, 2026).
Images: Cover photo of the Michigan State Capitol in Lansing by w_lemay via Wikimedia Commons (CC BY-SA 2.0), with TDFP headline overlay. In-post graphic: The Digital Free Press.
Comments