Iowa Field Report has learned that State Auditor Rob Sand is working feverishly to get a hold of Iowans’ personal and confidential health records. According to Sand, he needs the information, which includes records of sexually transmitted diseases and other sensitive health records, to “audit” the State’s COVID-19 testing service, Test Iowa. 

The legality of the move is questionable. Sand’s request includes social security numbers, names, and addresses, and details of citizen health records like who has a sexually transmitted disease and blood test results from newborns. Sources say that it’s hard to understand how these records fall into the area of an auditor. It’s not clear whether Sand can even have access to the information that is protected by HIPAA, or perhaps more importantly, whether he has the required controls to keep it safe. 

It’s also unclear whether Sand, who announced that he is joining a group of other state auditors, will share that sensitive health information outside of Iowa’s borders. That raises additional concerns. 

In an interview yesterday,  Simon Conway asked Sand why he needs access to individual names and health records. Sand said he didn’t “need it”  but that “legally speaking” he is entitled to it.  Let that sink in. Sand doesn’t need your name and personal health information, but he is demanding it because he thinks he can legally get it. 

Sand also told Conway that he isn’t requesting all health records, just the Test Iowa records. But what Sand didn’t say is that the Department of Public Health has already told him that getting access to Test Iowa records means that he would get access to the entire Iowa Disease Surveillance System (IDSS). And as Public Health told Sand, “any individual granted access to IDSS as a state user would be able to see patient demographics and disease information on every case” in the system, including “information on sexually transmitted infections which are confidential under Iowa Code section 139A.30 and other reportable diseases which are confidential in accord with Iowa Code section 139A.3.”

Sand told Conway that he wasn’t asking for access to other health information; he wasn’t giving the whole story. Some might call that a lie. Others might call it a fib. Whatever it is, it’s misleading and dishonest. 

To many, the requests for their private personal health information is another example of Sand’s efforts to politicize the State Auditor’s Office and go beyond a state auditor’s role. 

Two things are clear: Iowans should be concerned, and Simon Conway shouldn’t be the only member of the press who is asking Sand questions.

Simon Conway’s Interview with Sand is below.