Idaho built few accountability measures into Health Data Exchange, watchdog report finds

Report, commissioned by Legislature, attributed lack of accountability in part to how state created data sharing service as nonprofit without clear oversight laws

By: - November 6, 2023 4:30 am

The Idaho Health Data Exchange — propped up by almost $92 million in federal tax funds and $2 million in state tax funds — had few still-existing state-built accountability measures, more than a decade into its launch, a new watchdog report found. (Getty Images)

A bankrupt Idaho government-created nonprofit meant to make health data more widely available for doctors, insurance companies and Medicaid was created and managed in a way that made regulation difficult, a watchdog report released last week found.

The report found that the Idaho Health Data Exchange — propped up by almost $92 million in federal tax funds and $2 million in state tax funds — had few still-existing state-built accountability measures, more than a decade into its launch.

That’s partly because Idaho created the program as a private nonprofit corporation, not a state agency or independent body. And Idaho law “gave the state no meaningful oversight mechanisms for the exchange,” the report found, with informal accountability measures like relationships with the Department of Health and Welfare fizzling out over time.

The exchange filed for bankruptcy in fall 2022, emerging this year with a plan to repay 25% of its debts, according to the report. In an investigation published in June, the Idaho Capital Sun found that the exchange ran into financial troubles after its leadership made funding deals that fell through, leading to a bitter feud over a contract. 

Idaho didn’t build in key accountability measures for the Idaho Health Data Exchange when creating it, said the report published last Tuesday by the Idaho Office of Performance Evaluations, a nonpartisan watchdog Idaho state government agency that produces independent reports on whether state agencies or programs are operating cost effectively and achieving the desired results.

How to follow along?

The report is scheduled for a presentation Friday before the Joint Finance-Appropriations Committee, the Legislature’s budget committee, which is meeting before the 2024 legislative session to begin looking at budget requests.

JFAC sessions open to the public and are streamed online.

“We found that the state created the exchange as a nonprofit corporation and did not provide the exchange with enough oversight to fulfill its public purpose,” Office of Performance Evaluations Director Rakesh Mohan wrote in a letter to the Joint Legislative Oversight Committee, summarizing the report’s findings. “Furthermore, the state did not make full use of its system of checks and balances to ensure cost-effective use of public dollars on contracts with the exchange.”

The exchange didn’t receive all of the nearly $94 million in taxpayer funds. The biggest pool of funds identified in the report was about $65 million of federal grants given to health care providers to develop electronic health record systems. 

The Office of Performance Evaluations report contained little information about how the Idaho Health Data Exchange performs. The nonprofit did not reply to the watchdog agency’s request for documents “commonly made available during evaluations, such as contracts, meeting minutes and financial statements,” the report said. 

The report said it did not have enough information to suggest an investigation, but an investigation would serve as the state’s “main ongoing mechanism for accountability” with the exchange. 


The goal of the Idaho Health Data Exchange — like similar repositories in other states and regions — was to make every patient’s health records available at the click of a button when they needed to see a specialist, change doctors or get emergency care in another part of the state. (Illustration by Kent Schmidt for the Idaho Capital Sun)

The Attorney General’s Office could help the state access detailed financial information through an investigation, the Joint Finance-Appropriations Committee could conduct hearings and the Legislature could exercise its subpoena power, the report said. 

But without “transparency up front,” the report warned, “the state may not have enough information to determine whether an investigation is warranted.”

“Because of the state’s decision to operate the exchange through a nonprofit corporation with minimal transparency standards, our office did not have access to sufficient information to recommend an investigation,” the report said, mentioning that several people said the exchange had poor management and accused the exchange’s leadership of being deceitful and engaging in fraudulent activity.

Idaho Health Data Exchange Executive Director Jesse Meldru told the Idaho Capital Sun that he’s unaware “of any deceitful or fraudulent activity that (data exchange) has engaged in during my period of experience with the company.”

“It’s difficult to comment on this statement from the report because the statement seems subjective and based on speculative conjecture,” Meldru wrote. “I can comment that I am not aware of any deceitful or fraudulent activity that IHDE has engaged in during my period of experience with the company. In fact, IHDE is currently committed to anything but deceitful or fraudulent activity since our focus and commitment is to serve the interests of the community of stakeholders and clients, which includes the Department of Health and Welfare.”

A subcontractor sued the Idaho Health Data Exchange in 2021 for breach of contract and fraud, alleging that the exchange kept federal grant funds it was entitled to by contract, court filings show. An Ada County judge ordered about $790,000 seized from the exchange, with the Ada County Sheriff’s Office seizing only about $470,000. That lawsuit was dismissed in September 2023.

Meldru was the director of finance as of May 2021, court filings show.

The Idaho Health Data Exchange itself does have accountability measures, Meldru told the Capital Sun. He said the exchange’s corporate bylaws require annual audited financial statements for its board of directors, conducted by an independent accounting firm in Boise. 

“Were fraud or deceit a related activity underway, that accountability measure would likely have caught wind of it,” Meldru said.

The report found that while the exchange reported submitting 10 audits to the federal government, only one was submitted in 2015.

What is the Idaho Health Data Exchange? 

The Idaho Health Data Exchange is a state-created nonprofit organization meant to share electronic patient health records with health care providers across Idaho, which would let doctors see test results ordered by other doctors, help public health officials monitor infectious diseases and even help insurers verify patient’s needs. 

According to the recent Office of Performance Evaluations report, the Idaho Legislature in 2006 created the Health Quality Planning Commission, placing the commission within the Department of Health and Welfare. In 2008, the commission drafted plans to create the Idaho Health Data Exchange, which a former Department of Health and Welfare director approved to create the Idaho Health Data Exchange, Inc., as a nonprofit corporation. The commission’s board members were to be named by a former governor, the report said.

Idaho law is unclear about the power of agencies to create nonprofits, the report said, directing the Legislature to discuss this with lawyers.

“We found that Idaho Code did not prevent or explicitly give the commission or the department authority to create a nonprofit corporation. Idaho Code also did not dictate any additional requirements for nonprofit corporations created by government officials,” the report said. “Our analysis was not as wide reaching as a legal opinion and we encourage the Legislature to discuss this issue with counsel for more information about court findings and constitutionality.”

Idaho’s health data exchange is among several health information systems across the country meant to help health care providers, insurers and others share patient’s medical data more effectively. 

Every health data utility is different; some are part of a government apparatus, some are public-private partnerships, some are fully private organizations. The Idaho Health Data Exchange is the latter, a nonprofit.

Because it is privately owned and operated, the data exchange doesn’t have to answer directly to legislators, the governor or his directors in the Department of Health and Welfare and Department of Insurance. The data exchange gives updates to the Idaho Health Quality Planning Commission but isn’t controlled by it.

Still, the exchange was built with money from government programs, including Medicaid, and it holds millions of people’s medical records. The bankruptcy rattled members of the Idaho Legislature. Lawmakers in the 2023 legislative session ordered a look into the data exchange by the Office of Performance Evaluations.

Idaho Speaker of the House Mike Moyle, one of five legislators who requested the report, told the Idaho Capital Sun on Friday that the report highlights significant issues for the Legislature to address in state law, pointing to the ability of state entities to create nonprofits.

“We don’t need unelected state officials to create a nonprofit and stuffing taxpayer dollars into it. That’s a big concern,” Moyle said.

Idaho’s health data exchange had murky state-built accountability measures

The analyst who led the report, Sasha O’Connell, principal evaluator with the Office of Performance Evaluations, said when doing the report, it became clear that a “series of decisions by different actors over several years” shaped the exchange.

“Over the course of our evaluation, we found it really was several different entities acting and making decisions here. Everyone that we spoke with had good intentions, and I think that is still the case that there was a very lofty goal to create a health information exchange that would support the state’s many efforts,” O’Connell said.

The Legislature does have options moving forward.

It could, O’Connell said, continue to contract with the exchange and be open to new companies that could provide those services. And it could, she said, create a public entity that has clear accountability mechanisms.

“If the Legislature wanted to pursue something like that, it’s unclear if the exchange would cooperate with such an overhaul in accountability measures,” O’Connell said. “And if they did not, right now, the state does not have enough information to be able to recreate the work that is done with the exchange. And that means the Legislature would be required to make another investment in the exchange.”

The report identified a number of lack of accountability measures in the exchange:

  • Idaho law “never included an enforcement mechanism for Health and Welfare or its commission to oversee the exchange,” the report found. 
  • Idaho law required the commission until 2010 to produce detailed reports on the exchange, the report said. But once the exchange launched, Idaho lawmakers nixed those rules, the report said.
  • There was no rule or law requiring representatives from the Department of Health and Welfare or the Legislature to serve on the exchange’s board. The Health Quality Planning Commission in a 2007 report to the Legislature said the board would include representatives, but the board no longer has representation, the report said.

Since the Idaho Health Data Exchange was created as a nonprofit entity, and not a state agency, it doesn’t inherently have the same transparency measures that state government agencies have. That includes being subject to Idaho’s open meetings law, which requires government decision-making to be conducted publicly, or Idaho’s public records law, which allows members of the public to inspect government documents. 

There’s no evidence to prove that state-run exchanges perform better than non-state ran exchanges, according to a report by Idaho’s Office of Performance Evaluations. But states using a similar model to Idaho “tended to have more regulation and incentives for their” health information exchanges, the report said.

“The state’s informal mechanisms of accountability deteriorated over time as turnover left little overlap between the exchange and the state, particularly when consultants from out of state were brought in to manage the exchange,” the report said.

When Idaho has created some other public entities, like the state’s insurance exchange, Your Health Idaho, it has created in state law accountability measures that require open meetings and performance reports, the report said.  

“The state designed the exchange to be a public-private partnership without clear statutory guidance about responsibilities and oversight. As a result, the state’s influence and oversight faded over time. Transparency and accountability to the public also faded.”

– Office of Performance Evaluations report on the Idaho Health Data Exchange.

Recent and current legislators interviewed by evaluators “had little or no information about the state’s creation of the exchange as an independent, private corporation,” the report said.

More than 60% of the exchange’s funding comes from federal and state funds, according to bankruptcy records reviewed by the Office of Performance Evaluations.

Idaho Health Data Exchange explains cooperation with watchdog report

Meldru replaced Hans Kastensmith, managing partner of Capitol Health Associations — a Washington, D.C.-based consulting group — who served as the exchange’s executive director starting in October 2019, the Idaho Capital Sun previously reported. Meldru previously served as director of finance. 

Asked why the Idaho Health Data Exchange didn’t provide documents typically made available to the Office of Performance Evaluations during its reports, Meldru said the exchange did provide input “but clearly less than the (Office of Performance Evaluations) would have preferred.”

Meldru also said that during the review period, the exchange was in the middle of reorganizing around a bankruptcy and dealing with litigation, which it prioritized over the Office of Performance Evaluations’ “additional requests.”

Another important point of note is that (data exchange) hadn’t done anything wrong to warrant that level of intrusion by a regulatory agency and wasn’t the actual subject of the OPE investigation, which influenced the perspective to prioritize allocating IHDE’s scarce resources toward the bankruptcy and litigation activities as this was most aligned with supporting IHDE’s stakeholders and clients,” Meldru said.

The Office of Performance Evaluations, created by the Idaho Legislature, is limited by Idaho law to report on state agencies or political subdivision created by law. The exchange, created as a nonprofit by a state agency commission, is not either of those, O’Connell said.

Idaho’s health data systems weren’t bid competitively

The report also identified that the Idaho Department of Health and Welfare sought no-bid contracts or non-contracted work for the exchange, including at least $22 million to improve the exchange, while other states sought competitive bid contracts to develop or improve their health information exchanges.

“Although we found no evidence of impropriety, not going through the procurement process also led Health and Welfare to administer its own multimillion-dollar noncompetitive contracts with an untransparent vendor that was created by a commission in Health and Welfare and for many years had Health and Welfare officials on its board,” the report said.

“The state treated the exchange like a monopoly, even as Health and Welfare paid millions to expand the exchange’s capabilities,” the report said.

While the state health department disagreed with some findings in the report, agency director Dave Jeppesen said it “wholeheartedly concurs” that the Department of Health and Welfare (DHW) “did not have statutory or regulatory authority” over the exchange and that the exchange shouldn’t have been set up as an independent entity. 

“During the years when Capital Health Associates served as executive director of Idaho’s (health information exchange), DHW staff worked diligently and used the tools available to gain contract compliance and to advance Idaho’s (health information exchange,)” Jeppesen wrote. “However, lacking statutory and regulatory authority to truly hold Idaho’s (health information exchange) accountable, DHW’s efforts proved unfruitful. Yet DHW remains committed to the vision of improving health care quality, safety, and patient outcomes and reducing the overall cost of medical care to Idahoans that a robust, functioning, secure health data exchange could provide.”

Jeppesen, in a letter responding to the report before it published, wrote the Idaho Health Data Exchange was Idaho’s sole health information exchange because policymakers said so. He disagreed that the agency could have “legally sought competitive bids” because former Gov. C.L. “Butch” Otter and the Legislature directed that Idaho’s health information exchange would be the Idaho Health Data Exchange. Jeppesen also said the Legislature “reaffirmed and, in some cases, explicitly directed” that DHW distribute funds to the” exchange in recent years.

O’Connell, the analyst who led the report, said the Office of Performance Evaluations reviewed all comments from Health and Welfare during the technical review process “and did not find them valid for many reasons.”

The no-bid approach was also concerning, the report said, “because other vendors may have been able to build a better exchange or do so more efficiently with public dollars.”

“The state’s special relationship with the exchange initially led Health and Welfare to focus on the exchange’s financial stability rather than deliverables. … However, the exchange’s special relationship with the state led to loose guidelines in the contract, which Health and Welfare staff later found to be insufficient because of the exchange’s new management,” the report said.

The report found that Health and Welfare staff grew concerned with “the capabilities and trustworthiness of the exchange’s new Washington, D.C.-based management subcontractor.” 

Meanwhile, the exchange fell behind on work and didn’t meet other provisions of a federal grant that funded their work, even before Idaho legislators appropriated more funds to the exchange.

“We found that the exchange’s new management subcontractors were reluctant to accept and sometimes avoided the department’s attempts to amend the contract with common transparency requirements,” the report found.

Idaho Department of Administration Director Steve Bailey, heading the agency tasked with administering state contracts, responded that Health and Welfare and the state Division of Purchasing believed the exchange was “the only vendor that could meet” Health and Welfare’s needs. 

“The department agrees with many of the recommendations related to procurement and contracting that OPE makes in its report; however, we believe there may be additional context required and some more systematic changes needed to achieve the outcomes OPE is seeking,” Bailey wrote.

“Any time the state engages in negotiations with a vendor that has disproportionate bargaining power, the ability to achieve the desired performance is significantly diminished. In these situations, negotiating additional requirements, such as audits and other methods of transparency, is extremely difficult,” Bailey wrote. “Managing performance through corrective action and cure notices is often ineffective when the agency feels it has no alternative vendor: one of the greatest tools in contract administration is the threat of termination or future disqualification, neither of which is effective if a vendor knows the state has (or believes it has) no alternative.”

What the report recommended:

The report recommended several methods that the Legislature should consider to increase transparency in future public-private partnerships like the exchange:

  • The state could be explicit in how it will oversee the program and its expectations of such partnerships.
  • The state can clarify the authority officials have to create nonprofits and other corporations for public work. 
  • It could be more appropriate, the report said, to pursue what Idaho law calls “independent public bodies corporate and politic.” Those are public organizations that are independent from units of government. Their requirements are spelled out in Idaho law. The report mentioned Your Health Idaho, which has a board that includes appointees confirmed by state government officials, has open meetings, and reports to the Legislature.
  • The state health department and Department of Administration should, in future contracts, try to prevent “inappropriately avoiding” competitive bids and external oversight.
  • The state health department should require that the exchange’s data be validated as secure in existing contracts. (The report didn’t find evidence that the data’s exchange is vulnerable, but identified a potential conflict of interest in a third party that attested to its security in 2021. Meldru called the exchange’s data security “top notch,” saying that the exchange “continues to revalidate its high level of IT security posture with required reviews and audits by significant (exchange) clients and stakeholders,” naming major Idaho health systems and insurers. O’Connell, who led the report, told the Sun, “We look forward to the exchange sharing those audits with the state, and agreeing to ongoing security audits.”)

Editor’s note: This story has been updated to correct typos in a quote by Idaho Department of Health and Welfare Director Dave Jeppesen.

OPE Idaho Health Data Exchange report

Our stories may be republished online or in print under Creative Commons license CC BY-NC-ND 4.0. We ask that you edit only for style or to shorten, provide proper attribution and link to our web site. Please see our republishing guidelines for use of photos and graphics.