diff --git a/application/backend/src/controllers/UsersController.test.ts b/application/backend/src/controllers/UsersController.test.ts
index 0b321735..6f4fd650 100644
--- a/application/backend/src/controllers/UsersController.test.ts
+++ b/application/backend/src/controllers/UsersController.test.ts
@@ -155,25 +155,27 @@ describe('UsersController', () => {
     })
 
     it('should not return user password', async () => {
+      const userId = TestUsers.PARTICIPANT_UNANSWERED.id
       const response = await request(app)
-        .get('/users')
+        .get(`/users/${userId}`)
         .set({ Authorization: `Bearer ${orgAdminToken}` })
       expect(response.status).toBe(200)
 
-      const body: GetAllUsersResponse = response.body
+      const body: GetUserByIdResponse = response.body
       expect(body).toHaveProperty('data')
-      expect(body.data[0]).not.toHaveProperty('password')
+      expect(body.data).not.toHaveProperty('password')
     })
 
     it('should not return user emailHash', async () => {
+      const userId = TestUsers.PARTICIPANT_UNANSWERED.id
       const response = await request(app)
-        .get('/users')
+        .get(`/users/${userId}`)
         .set({ Authorization: `Bearer ${orgAdminToken}` })
       expect(response.status).toBe(200)
 
-      const body: GetAllUsersResponse = response.body
+      const body: GetUserByIdResponse = response.body
       expect(body).toHaveProperty('data')
-      expect(body.data[0]).not.toHaveProperty('emailHash')
+      expect(body.data).not.toHaveProperty('emailHash')
     })
   })
 
diff --git a/application/backend/src/controllers/UsersController.ts b/application/backend/src/controllers/UsersController.ts
index 733e5598..aa2c2369 100644
--- a/application/backend/src/controllers/UsersController.ts
+++ b/application/backend/src/controllers/UsersController.ts
@@ -151,6 +151,7 @@ export class UsersController extends Controller {
     const user: UserResponse | null = await this.userRepo.findUnique({
       where: { id: userId },
       include: { adminOfStudies: { select: { name: true, id: true } } },
+      omit: { password: true, emailHash: true },
     })
     if (!user) {
       const errorMessage: string = `User with ID: ${userId} not found`