Idaho legislators look to next steps for tough-to-regulate nonprofit health data service

Idaho’s bankrupt Health Data Exchange was difficult to regulate because of how the state created and managed it, a watchdog report released last week found.

Idaho legislators on the Joint Finance-Appropriations Committee on Friday asked the watchdog evaluators whether the exchange could be shut down, whether Idaho’s health information stored on the privately-ran but publicly funded exchange is secure and what next steps the Legislature can take. 

The answers were complicated.

Idaho needs a health data exchange, said Sen. Kevin Cook, R-Idaho Falls, relaying what he’d heard from talking with medical providers as part of his work on the Medicaid Managed Care Task Force, an interim committee that’s been meeting outside of legislative session this summer and fall.

“The data exchange is a good idea. It sounds like we’ve made some serious mistakes all the way around. I think there’s plenty of fingers to be pointed at everybody here. We need to fix it,” Cook said.

The presentation also followed up on a key question raised in the report. The data exchange is a nonprofit corporation, created by a commission within the Department of Health and Welfare. But Idaho law is unclear about the power that state entities have to create nonprofit organizations, the report found. 

It’s clear that Idaho needs more oversight into the operations of nonprofit corporations created or funded by state agencies, said JFAC co-chair Rep. Wendy Horman, R-Idaho Falls. The state is working to develop a list of nonprofits funded by government, she said.

Sen. Janie Ward-Engleking, D-Boise, asked if the initial legislation that led to the exchange’s creation played a role, “if we didn’t put enough sidebars in place.”

The initial legislation created a commission within the Department of Health and Welfare tasked with creating a health information exchange and developing a plan for how it’d be governed, O’Connell said. The statute could have added additional sideboards, she said. 

Are Idahoan’s patient health data secure?

While the Office of Performance Evaluations didn’t find evidence that records aren’t secure, O’Connell said evaluators didn’t believe that the Department of Health and Welfare received enough evidence to know that they’re secure. The report identified a potential, undisclosed conflict of interest in a third party that attested to the exchange’s security in 2021. 

“In light of that there is risk, can we shut this down?” asked Horman, R-Idaho Falls.

The state has options moving forward, O’Connell said. But “since it is a private corporation, I don’t believe that shutting it down is something that we have control over,” she said.

Idaho Health Data Exchange Executive Director Jesse Meldru, in response to the Idaho Capital Sun’s questions following the report, told the Sun that the exchange’s security is “top notch.”

What next steps can the Legislature pursue

The Legislature and the Department of Health and Welfare have a lot of options, O’Connell said. The Office of Performance Evaluations focused on two. 

The state could continue contracting with the exchange and be open to new companies as they become available, while improving data security in contracts, she said. Or the state could overhaul transparency requirements with the exchange. But O’Connell noted that it’s unclear how the exchange would respond to that.

JFAC co-chair Sen. C. Scott Grow, R-Eagle, asked if the hospitals could work together to create an exchange, which O’Connell said was a reasonable idea the Idaho Legislature could explore. 

Grow told the Idaho Capital Sun in an interview after the meeting that he wondered about the needs for this exchange, pointing to other existing data exchanges, and is skeptical about funding the Idaho Health Data Exchange more.

“I’ve always questioned the needs for this in the first instance,” Grow said.

Grow said existing state law does appear to allow state entities to create nonprofits, but their funding requests should go through the Legislature. 

“The real question is should state agencies be allowed to independently set up 501(c)(3)s. That’s a question we’re looking into also,” Grow said.

“I’m shocked something is not illegal. What do you think is inappropriate?” Rep. Josh Tanner asked evaluators, referencing a section of the report that said the Department of Health and Welfare administered multimillion-dollar noncompetitive contracts with the exchange. 

O’Connell, who led the report, said the office focused on evaluating the program’s performance. “As far as information about legality, we encourage you to speak to legal counsel about that,” she said.

The Office of Performance Evaluations report also suggested that lawmakers reach out to attorneys on several questions raised. Grow said lawmakers have not decided on that yet.