House File 488 seeks to protect the health information of Iowans. The bill keeps the state auditor from having access to an individual’s name or residential address from a reportable disease report.
Maddie Wilcox with the Iowa Department of Public Health said it is her understanding that the bill originated from communication between Auditor Rob Sand’s office and IDPH to ensure Sand only had the appropriate amount of data to be able to do his work but not access to personally identifiable information.
“So, you could help me out here, why is the auditor looking into COVID on a statewide basis,” asked State Sen. Jim Carlin. “What’s the justification for that? I don’t know why the auditor would need to get involved in that.”
Wilcox said Sand would have the ability to investigate a number of pieces of state programming.
“From the Department of Public Health’s perspective, it’s within his right to request that information to be able to produce the sort of investigatory work that they do within that office,” she said. “I’m not familiar with the specific nature of exactly where the investigation is at, but that would be a question for the state auditor’s office.”
Carlin said he didn’t understand why Sand was involved in investigating COVID.
“To be clear, the state auditor is not doing any kind of contact tracing or anything like that,” Wilcox said. “When I use the term investigation, the state auditor is not reaching out on individual cases like that.”
Carlin said he’s concerned that Sand said he was joining a group of other state auditors that will share sensitive health care information outside of Iowa’s borders.
“IDPH is the gatekeeper on this information and I guess we look to you to protect people’s private health care information,” he said. “But along these lines, and maybe you can speak to this, giving him access to Test Iowa records, wouldn’t he also have access to the whole Iowa disease surveillance system as well?”
Wilcox said an agreement came into place with the auditor’s office between Sand and IDPH on what would be shared.
“Only that information that was agreed upon and was within the department’s ability to share was shared out with Auditor Sand,” she said. “It wasn’t everybody’s personally identifiable information.”
Sen. Julian Garrett asked for clarification. IDPH has information on individuals, but the names and identification information did not go to Sand’s office.
“That is correct,” Wilcox said.
Carlin asked if Sand’s office requested private health care information.
“You said an agreement has been reached,” Carlin said. “So, I guess you could reasonably infer that some effort was made to get this information before that agreement was reached.”
Wilcox said those conversations happened before she came on board.
“There was an initial request,” she said. “I believe there was a more general request related to COVID measures.”
She asked if anyone from the auditor’s office was able to chime in.
“I guess I would like to know,” Carlin said. “Clearly, you can’t speak to this, I would like to know when the request was made, what information, like if that request had been met in its entirety, what information would have been included that the auditor would have gotten had that request been met by IDPH.”
Democrat Sen. Amanda Ragan said that Sand was investigating Test Iowa to see who they were giving information to.
“He was not going in to find out who was getting served,” Ragan said.
Ragan also said she wasn’t sure why the auditor’s office wasn’t on the call.
Ragan said she believes IDPH is doing this already. The auditor, Ragan said, was likely investigating who was getting information, not asking for it.
Garrett said what he had heard based on the information received the bill would require people to do things they’re already doing.
“So I guess there’s no problem with it,” he said. “I have no problem advancing it at all based on what I know so far.”
Carlin said the underlying purpose of the bill is spelled out pretty well.
“It prohibits a state or local agency employee or agent from having access to personally identifiable information included in a reportable disease report provided or maintained by IDPH,” he said. “So unless they’ve been trained in a completed at confidentiality training component to their job description, but we don’t want private health care information shared. We’re trying to close the door on sharing information with those who don’t have a legitimate interest in them.”
Ragan supported the bill, but said what Sand was doing may not be what was interpreted in the subcommittee.