The Department of Edu­cation should be able to report cases of COVID-19 at specific public schools within 24 hours without violating federal privacy laws, the state auditor said in a report released Friday.

The report described the department’s reporting on positive cases during the pandemic as “inconsistent and incomplete.”

“It is important — more so during the current pandemic — that the department be transparent and accountable for its actions,” the report said. “The public, which includes teachers, students and their families, is entitled to complete and timely information necessary to make decisions concerning health and safety.”

State Auditor Les Kondo released the 33-page “Report on the Hawaii State Department of Education’s Policies and Procedures for Handling Positive COVID-19 Test Results for Staff, Teachers and Students” at the request of the Senate COVID-19 Committee.

Notification of coronavirus cases at public schools is currently made in two ways, according to DOE. Principals promptly notify those affected, including staff, students’ families and/or service providers directly.

And the Department of Education posts a tally of COVID-19 cases each week on its website. The weekly chart lists the number of employees, students, parents or service providers who tested positive by complex area, rather than by individual schools. (Complex areas consist of a few high schools and their feeder lower schools.)

“Public disclosure is done at this level in accordance with federal and state laws protecting student and staff privacy and medical information,” the department says on its website.

But the auditor’s report says that federal law, at least, should not stand in the way. The Health Insurance Portability and Accountability Act Privacy Rule generally does not apply to elementary or secondary schools, it said.

“The U.S. Department of Education advised in March that Family Educational Rights and Privacy Act does not prohibit disclosure of information about students who are COVID-19 positive in non-personally identifiable form,” Kondo wrote. “Furthermore, FERPA applies only to students, not to teachers, school administrators support staff, or others who may be working at or visiting a school facility.”

The auditor’s report recommends that DOE obtain legal guidance from the state attorney general about whether state privacy laws bar the release of information regarding unidentified employees or students at specific public school campuses.

“To the extent HIPAA, FERPA and other laws do not prohibit DOE from reporting information about positive cases, the department should do so no later than 24 hours after it is informed of a positive case,” it said.

The disclosure should include the date of the positive result; whether it is a teacher, administrator, support staff or student; the specific school; and the dates and times the infected person was on campus.

Kondo lambasted the Department of Education for its “lack of cooperation” and not promptly providing documents that should have been “readily available.” Instead, the auditor relied on publicly posted policies and procedures, public statements and media reports.

Superintendent Christina Kishimoto, in turn, faulted the auditor for rushing to judgment and producing an “inaccurate report.” The auditor’s office, she said, demanded information and virtual meetings with educational officials the week of Aug. 17, when they were busy opening 257 public schools, as well as meeting with the Senate COVID Committee and participating in a lengthy Board of Education meeting.

“It is extremely disappointing that the state auditor considered his report more important than the provision of direct educational services to students during a health pandemic,” Kishimoto said in a statement. “He has shown extreme impatience and inflexibility.”

“Because of this, his rushed report is inaccurate in its dismissal of information provided by the Hawaii State Department of Education and glaringly lacks interviews with my team,” she added. “I am asking the Legislature to have this report accurately completed so that it can appropriately inform policy practice.”

On Aug. 18, Kishimoto asked the auditor to suggest dates the following week, but received no response. On Aug. 26, the department provided a written response to the auditor, along with contact information for relevant staff. But Kondo said that was “simply too late” and his staff did not contact them.

“We had finished the report, including our independent review process, before we received the department’s letter,” Kondo wrote.

“We recognize that the Hawaii State Department of Education had myriad responsibilities when it declined our requests for its COVID-19-related policies, plans and protocols,” the auditor wrote. “However, it is precisely during times of crisis when the public needs and deserves clear, concise, and transparent communication from its government.”

The report covers DOE protocols for isolating and quarantining staff and students who test positive or have been exposed, cleaning and disinfecting school facilities, and contact tracing, as well as communication about cases to employees, students, parents and the public.

It advised DOE to report the number of school personnel and students who are self isolating or in quarantine. And it called for the department to issue criteria it is using to decide issues such as when students will be allowed to return to school campuses for in- person instruction.

The auditor’s report is online at auditor.hawaii.gov.