Henry County urged to boost compliance after poor training scores

MT. PLEASANT — Henry County supervisors agreed Oct. 30 to renew a $10,986 privacy and cybersecurity compliance program for another year after a vendor labeled the county its “problem child” for poor participation in required online training.

Carosh Chief Operations Officer Stephanie Lathrop told the board the county’s completion rate sits at 43.6%, well below the 80% benchmark the firm uses to certify clients as compliant and defend them in data-breach cases. The report showed only two county departments exceeded 80% — Public Health at 89% and the Treasurer’s Office — while others remain far below that mark.

“Henry County has the lowest training score, and we’re getting the least cooperation,” Carosh Roger Shindell said. “To move forward, you really need someone in the county who’s going to drive this thing forward. Our most successful counties have one of the supervisors take that role. They can talk to all department heads, make sure the training gets done.”

The compliance program tracks privacy, security, and breach-prevention standards, including HIPAA requirements for departments handling health or personal data. Under the county’s HIPAA Select package, the company provides annual audits, staff training, and a $100,000 indemnification against federal penalties — but only if the county maintains 80% training completion and reports any security incidents promptly.

Supervisors said they want to see those numbers improve.

“When I see $10,986 and then we’re not very compliant, we ought to do one of two things here,” Supervisor Steve Detrick said. “We ought to increase our engagement and make that happen or we need to rethink the dollars that we’re spending as a group here.”

After hearing from Lathrop that the training portals update quarterly, discussions shifted to the possibility of receiving quarterly progress reports from Carosh to better stay on top of compliance.

“We did that on a quarterly basis, and it proved very valuable for no other reason, than just to keep it in front of people’s minds so they don’t forget about it,” Carosh employee and former Washington County Auditor Dan Widmer said.

Supervisors approved the renewal on a 2—1 vote, with the understanding that the vendor will provide quarterly updates and coordinate closely with the county’s incoming IT director and department heads to make clear expectations for trainings moving forward.

Comments: AnnaMarie.Kruse@southeastiowaunion.com