This sort of thing can't be helped, but it's a good reason why businesses must be diligent. Medical information is privileged, combined with family history, social security numbers, allergies, medication and vulnerabilities listed leave victims exposed in every way possible.
So far, no reports have indicated that the Utah Department of Health failed to protect those records to the best of their ability. Even the best systems can fail to the best hackers. It's just another reminder that no information is safe, no protection is foolproof.