Idaho’s bankrupt Health Data Exchange was difficult to regulate because of how the state created and managed it, a watchdog report released last week found.
Idaho legislators on the Joint Finance-Appropriations Committee on Friday asked the watchdog evaluators whether the exchange could be shut down, whether Idaho’s health information stored on the privately-ran but publicly funded exchange is secure and what next steps the Legislature can take.
The answers were complicated.
Idaho needs a health data exchange, said Sen. Kevin Cook, R-Idaho Falls, relaying what he’d heard from talking with medical providers as part of his work on the Medicaid Managed Care Task Force, an interim committee that’s been meeting outside of legislative session this summer and fall.
“The data exchange is a good idea. It sounds like we’ve made some serious mistakes all the way around. I think there’s plenty of fingers to be pointed at everybody here. We need to fix it,” Cook said.
The presentation also followed up on a key question raised in the report. The data exchange is a nonprofit corporation, created by a commission within the Department of Health and Welfare. But Idaho law is unclear about the power that state entities have to create nonprofit organizations, the report found.
It’s clear that Idaho needs more oversight into the operations of nonprofit corporations created or funded by state agencies, said JFAC co-chair Rep. Wendy Horman, R-Idaho Falls. The state is working to develop a list of nonprofits funded by government, she said.
Sen. Janie Ward-Engleking, D-Boise, asked if the initial legislation that led to the exchange’s creation played a role, “if we didn’t put enough sidebars in place.”
The initial legislation created a commission within the Department of Health and Welfare tasked with creating a health information exchange and developing a plan for how it’d be governed, O’Connell said. The statute could have added additional sideboards, she said.
What did the report find?
The Idaho Health Data Exchange is meant to make health data more widely available for doctors, insurance companies and Medicaid. It filed for bankruptcy in fall 2022. This year it promised to repay 25% of its debts.
But the exchange was created by a state commission within the Department of Health and Welfare as a nonprofit corporation, not a state agency or independent body. And Idaho law didn’t spell out clear accountability measures for the exchange. That’s according to a new report by the Idaho Office of Performance Evaluation, a state agency that produces watchdog reports on state programs.
When Idaho has created some other public entities, like the state’s insurance exchange, Your Health Idaho, lawmakers have baked accountability measures into state law that require things like open meetings and performance reports.
More than 60% of the exchange’s funding comes from federal and state funds. Evaluators found that $92 million in federal tax funds and $2 million in state tax funds helped support the exchange.
The report didn’t have enough information to suggest an investigation. But it said that an investigation would serve as the state’s main ongoing accountability mechanism for the exchange.
Are Idahoan’s patient health data secure?
While the Office of Performance Evaluations didn’t find evidence that records aren’t secure, O’Connell said evaluators didn’t believe that the Department of Health and Welfare received enough evidence to know that they’re secure. The report identified a potential, undisclosed conflict of interest in a third party that attested to the exchange’s security in 2021.
“In light of that there is risk, can we shut this down?” asked Horman, R-Idaho Falls.
The state has options moving forward, O’Connell said. But “since it is a private corporation, I don’t believe that shutting it down is something that we have control over,” she said.
Idaho Health Data Exchange Executive Director Jesse Meldru, in response to the Idaho Capital Sun’s questions following the report, told the Sun that the exchange’s security is “top notch.”
GET THE MORNING HEADLINES DELIVERED TO YOUR INBOX
What next steps can the Legislature pursue
The Legislature and the Department of Health and Welfare have a lot of options, O’Connell said. The Office of Performance Evaluations focused on two.
The state could continue contracting with the exchange and be open to new companies as they become available, while improving data security in contracts, she said. Or the state could overhaul transparency requirements with the exchange. But O’Connell noted that it’s unclear how the exchange would respond to that.
JFAC co-chair Sen. C. Scott Grow, R-Eagle, asked if the hospitals could work together to create an exchange, which O’Connell said was a reasonable idea the Idaho Legislature could explore.
Grow told the Idaho Capital Sun in an interview after the meeting that he wondered about the needs for this exchange, pointing to other existing data exchanges, and is skeptical about funding the Idaho Health Data Exchange more.
“I’ve always questioned the needs for this in the first instance,” Grow said.
Grow said existing state law does appear to allow state entities to create nonprofits, but their funding requests should go through the Legislature.
“The real question is should state agencies be allowed to independently set up 501(c)(3)s. That’s a question we’re looking into also,” Grow said.
“I’m shocked something is not illegal. What do you think is inappropriate?” Rep. Josh Tanner asked evaluators, referencing a section of the report that said the Department of Health and Welfare administered multimillion-dollar noncompetitive contracts with the exchange.
O’Connell, who led the report, said the office focused on evaluating the program’s performance. “As far as information about legality, we encourage you to speak to legal counsel about that,” she said.
The Office of Performance Evaluations report also suggested that lawmakers reach out to attorneys on several questions raised. Grow said lawmakers have not decided on that yet.
