Iowa State Auditor calls Test Iowa reporting chain risky

Tuesday, July 21, 2020
Health professionals with the Spirit Lake Test Iowa site moved their equipment from the Dickinson County Expo Building to the Lakes Area Ice Arena. Iowa's State Auditor recently took issue with the chain of reporting the tests follow after being processed at the State Hygienic Lab.
File photo

State initiative hits 100,000 test milestone

Iowa's COVID-19 testing initiative — Test Iowa — had performed 100,000 tests as of July 9, according to Iowa Gov. Kim Reynolds, but Iowa's Auditor of State Rob Sand recently took issue with Test Iowa's reporting methods. Results are to be reported immediately to the Iowa Department of Public Health, according to Sand, but state auditors found Test Iowa results were first being sent to three different entities before reaching IDPH. Sand called the four-part reporting chain an unnecessary risk while health officials are expected to base local responses on the data.

"It creates apparently pointless risk, because it has a long reporting chain before it gets to public health officials," Sand said. "Every step along that chain is another place where something can happen to negatively effect Iowa's pandemic response. It doesn't have to be intentional. It could be accidental. It could be a hacking attempt on a private company. It could be a power outage."

Test Iowa was launched by Reynolds on April 21, with the intention of increasing the state's COVID-19 testing capacity. Test Iowa was the result of a $26 million no-bid contract between the state and private Utah-based company Nomi Health, which partnered with two other private companies in Utah — Qualtrics and Domo. Sand's report pointed out an emergency proclamation allowed Reynolds' office to pursue no-bid contracts related to COVID-19. Reynolds said Test Iowa is now conducting more than 3,000 tests each day across 20 sites — including one which opened June 22 in Spirit Lake.

"By using real time data available through the platform, we can zero in on potential hotspots right down to a ZIP code, targeting our response with precision to help contain the virus," Reynolds said earlier this month.

Sand said his office began its investigation of Test Iowa after being contacted by some of Iowa's state and county officials with concerns about reporting delays in the state initiative. State auditors found Test Iowa results were first being sent from the State Hygienic Lab to Qualtrics, rather than the IDPH. The results were then being sent to Domo, before going to Iowa's Office of the Chief Information Officer and finally being reported to IDPH. Sand's report said no written order for the reporting chain was found or provided, but both the state lab and IDPH agreed on the method.

"Our finding about this indirect reporting chain exists only for Test Iowa," Sand said. "For the other tests that are happening in Iowa, they are reported according to law directly and immediately to the Iowa Department of Public Health. It's not that we only looked at Test Iowa. It's that the problem is located only within Test Iowa, compared to all other tests."

Sand mainly took issue with the reporting chain, saying it not only increases the potential for mishandled data, but also does not meet the Iowa Supreme Court's definition of immediate reporting — which he said could be grounds for a potential lawsuit. Assistant Iowa Attorney General Heather Adams replied to Sand's investigation, saying the Iowa Department of Justice feels the State Hygienic Lab is complying with state code and citing several electronic reporting methods which have been used by the state since 2010 — a counterpoint Sand found less than relevant.

"As noted in our report, data integration engines are indeed common," Sand said in a July 14 statement. "But comparing them to wholly separate private entities is like comparing apples to bacon."

A letter from the lab's deputy counsel Ian Arp said the lab believes itself to be fully compliant with IDPH's reporting requirements.

"Part of our office's responsibility is to be a watchdog — to be looking out for potential issues before they become an issue," Sand said. "Let's say hypothetically that nothing has happened, and all of that data is coming back into IDPH at the end of this long chain in exactly the same form that it came from the State Hygienic Lab. That would be great, but it would still be unnecessary risk … Just introducing that risk into the system is simply a bad idea, and our office has an obligation to call out illegal practices, unbusinesslike practices and inefficient practices. I would describe this with all three of those."

Respond to this story

Posting a comment requires free registration: